Reps Gallagher, Krishnamoorthi Write to FCC on Potential Risk of Chinese Internet Connectivity Modules Sabotaging Americans' Devices

We write to request information about the security risks posed by cellular connectivity modules provided by companies subject to the jurisdiction, direction, or control of the People’s Republic of China (PRC) or the Chinese Communist Party (CCP). Connectivity modules are components that enable Internet of Things (IoT) devices—from cars to medical equipment to tractors—to connect to the internet. Connectivity modules are typically controlled remotely and are the necessary link between the device and the internet. Recent events demonstrate the power of these small modules. In 2022, Russia stole $5 million worth of farm equipment from a John Deere dealership in Ukraine and attempted to bring it back to Russia. Luckily, that equipment was embedded with Western-made connectivity modules. Because the modules can be controlled remotely and the vehicles require internet connectivity to operate, remotely shutting down the module allows the module provider to shut the vehicle down. When Russia moved the stolen John Deere vehicles across the border into Russia, the modules were disabled—shutting down the equipment and effectively turning the vehicles into bricks. Connectivity modules are used in a wide variety of devices throughout the US, from consumer ‘smart devices’, to electric cars, to US telecommunications networks regulated by the FCC. Serving as the link between the device and the internet, these modules have the capacity both to brick the device and to access the data flowing from the device to the web server that runs each device. As a result, if the CCP can control the module, it may be able to effectively exfiltrate data or shut down the IoT device. This raises particularly grave concerns in the context of critical infrastructure and any type of sensitive data.