Cybersecurity
The ruling won’t affect ‘rip and replace’ targets Huawei and ZTE.
Photo of Judge Florence Pan in 2012 by Diego Radzinschi from the National Law Journal
WASHINGTON, April 16, 2024 – The D.C. Circuit Court of Appeals ruled on April 2 that the Federal Communications Commission must better define its criteria for banning the authorization and sale of equipment from certain foreign companies.
The FCC’s “covered list” includes equipment from certain Chinese companies deemed by lawmakers to be national security threats, and as of November 2022 inclusion on the list blocks those companies from receiving authorization from the agency to sell new wireless products and from serving as vendors for federally funded projects.
Huawei and ZTE, two major Chinese telecommunications manufacturers, saw all their telecom and video surveillance equipment included on the list, but the same categories of products from other companies, including Hangzhou Hikvision and Dahua Technology, are only included to the extent they’re used “for the purpose of public safety, security of government facilities, physical security surveillance of critical infrastructure, or other national security purposes.”
Hikvision and Dahua sued after the FCC adopted its authorization restrictions for covered entities in an attempt to get themselves taken off the list. Judges were not receptive to that, as the Secure Equipment Act, the law requiring the agency to halt new authorization for covered entities, specifically names the companies. But the court said in its decision that the agency’s definition of “critical infrastructure” is overly broad.
The 2022 rule implementing the ban takes cues from the Patriot Act, a CISA report, and a 2013 executive order for its definition of critical infrastructure, all of which the court said was “reasonable.” The agency’s final definition of “any systems or asset, physical or virtual, connected to” the infrastructure those sources describe, like government facilities and transportation systems, on the other hand, was too broad for judges.
D.C. Circuit Judge Florence Pan wrote the definition “threatens to envelop ever-broadening sectors of the economy” and was not satisfied with the agency’s justification.
“The FCC did not rebut Petitioners’ argument that “coffee shops, residential apartment buildings, used car lots, and dry-cleaning stores” could all plausibly fall within the Commission’s definition,” Pan wrote. “Indeed, at oral argument, the FCC was unable to identify any relevant infrastructure that would not be covered, whether critical or not.”
The court ultimately vacated the part of the 2022 order defining critical infrastructure and directed the agency to “comport its definition and justification for it” with the law.
The FCC did not respond to a request for comment.
The ruling will not affect Huawei and ZTE products, which are covered regardless of their use. The FCC’s rip and replace program, which reimburses providers for swapping out telecom equipment from those companies, is still underfunded by about $3 billion.
Lawmakers were unable to include extra funding attached to last month’s spending package, and progress has been slow going.
