FCC Equipment Security Order Seen Facing Likely Legal Challenges

The approved order, released Friday, also includes a Further NPRM seeking comment on extending the FCC authorization ban to components of covered equipment and on revoking previous authorizations of covered equipment.

Hikvision, in a recent filing, said the Secure Equipment Act, doesn’t provide the statutory underpinning for clamping down on much of the equipment the company sells. “A video surveillance camera on the private premises of an end user is in no way essential to the operation of broadband networks or to the provision of broadband service,” the company said: “To assert otherwise stretches the statutory requirement of ‘essential’ beyond any recognizable or reasonable meaning.”

Hikvision questioned whether including the companies under new regulation would be in keeping with the Supreme Court’s recent decision in West Virginia v. EPA, which underlined the importance of the “major questions” test in weighing agency decisions. “Extending Commission regulation to equipment operating on private networks that poses no risk of harm to public telecommunications networks is so unprecedented as to be a major question requiring explicit congressional delegation,” the company said.

Dahua USA differentiated between what the FCC can do under the Secure Networks Act and the 5th U.S. Circuit Court of Appeals’ decision last year denying Huawei’s challenge to the FCC ban of the Chinese telecom gear vendor's equipment from networks funded by the Universal Service Fund.

“The court’s decision in Huawei was expressly based on the Commission’s public interest discretion under Section 254 of the Communications Act, not on an interpretation of the SNA [Secure Networks Act],” Dahua said: “Nor did the court interpret the SNA to cover the entire companies.” The Communications Act “does not give the Commission discretion to deny equipment authorization based on considerations other than RF interference and similar technical criteria,” the company said. “That authority derives solely from the Secure Equipment Act, and therefore must be exercised in accordance with the specific definitions incorporated in that statute.” The companies didn't comment.

Lawyers active in the proceeding said concerns over potential legal challenges apparently slowed release of the order after it was circulated last month. The lawyers said challenges are likely.

“As with anything at the FCC, it will come down to what the final text of the order says,” said Digital Progress Institute President Joel Thayer. “Generally, the FCC has been cautious about its statutory authority in this proceeding, which possibly explains why it is taking a little more time to come out with its rules. Frankly, there is a lot of vagueness in the SNA and the law clearly directs the FCC to resolve many terms in the statute, including on the issue of video surveillance,” he said: “This could lead courts to find that Congress gave the FCC some rope to make calls on what equipment it considers a national security threat.”

“Even under a major-questions analysis, the FCC would still have a pretty strong case assuming the rules emulate what's in the NPRM, and, thus, would make a challenge to its rules an uphill battle,” Thayer said.

“Nearly every FCC action is litigated in one way or another,” said China Tech Threat’s Roslyn Layton. The group offers reports on alleged abuses by China. “What would the D.C. telecom bar do otherwise?” she asked. “The commission has been bracing for that,” she said: “If anything, their hesitancy and leniency in not being so hard [on the companies] could likely reflect a courtroom strategy. If the FCC can demonstrate that it went easy on the covered list entities, it makes their lawsuits that much easier to discredit.”

“This is not about Hikvision, Dahua, and Hytera challenging the FCC,” emailed John Strand of Strand Consult: “This is about the Chinese government beating down U.S. security policy within U.S. courts through its surrogates. Sadly U.S. law firms will sign up and help covered list entities, and indirectly the Communist Party, achieve its goals.” Strand said companies from authoritarian countries “enjoy all the benefits of the U.S. legal system: due process, representation, defense, etc. Western companies never get such an opportunity in China to challenge arbitrary rules and regulation.”

Most media coverage focuses on “discrete activities by the U.S, and European nations to restrict individual firms like Huawei, ZTE and TikTok for documented violations and abuses of privacy, security, weapons proliferation, and other laws,” Strand said. “Less attention is paid to the systematic restriction of tens of thousands of websites and related internet technologies by the People’s Republic of China,” he said.”

The fact that equipment can be imported to the U.S. and sold to buyers not using federal funds "does not make any sense," Rosenworcel said as the FCC released the order. "There is little benefit in having these lists and these bans in place just to leave open other opportunities for this equipment to be present in our networks."

The commission said Friday's order fulfills Congress' directive the agency adopt such rules within a year of the Secure Equipment Act's enactment. The FCC faced a Nov. 11 statutory deadline under the Secure Equipment Act, requiring the agency to stop authorizing equipment by companies the commission decides are a national security risk (see 2111120058).

Some components coming from companies on the covered list, if included in finished products, could be as much a security risk as the covered equipment now prohibited from authorization, the FCC said in the FNPRM. Congress in the Secured Networks Act's reimbursement program voiced the same concerns, the agency said. It seeks comments on such issues as identification of such component parts and how the agency can ensure prohibiting authorization of equipment that includes such components.

Commissioner Brendan Carr applauded the commission for making clear in the order that it has the authority to revoke existing authorizations. The order itself doesn't revoke existing authorizations, but he said he was "gratified that the agency has now put revocations squarely on the table [and] I hope that we soon exercise that authority."

Beyond this focus on equipment originating from state-controlled companies, the FCC needs to tackle the broader issue of proliferating insecure devices, Commissioner Nathan Simington said. "This is a ticking time bomb for the security of our wireless networks and devices, and a disincentive to building more, because the public will have justified low expectations of their security," he said.