ASUS settlement with FTC over router flaws from 2014 requires 20 years of security audits
Dan Goodin / Ars Technica :
Context & Ripple Effects
This 2016 settlement is where the FTC first turned router security into a consent-decree matter rather than a one-off fine: instead of a payment, ASUS accepted two decades of independent security audits over its 2014 router flaws.
The agency then ran the same play forward, when it sued D-Link in 2017 over hard-coded logins and exposed sign-in keys in routers and IP cameras, and later extracted a mandated security program from D-Link in settlement — while ASUS itself resurfaced in the coverage in 2019 after researchers found staff had published passwords to public GitHub repos. The pattern suggests these decrees are becoming the standard enforcement instrument for consumer network gear.
First-order effects
- ASUS must submit to independent third-party security audits every two years for 20 years and maintain a comprehensive vulnerability-disclosure and patching program — a compliance apparatus far heavier than any monetary penalty.
- Every ASUS router sold during that window falls under the decree's scope, so engineering and firmware release processes are directly constrained by FTC oversight.
Second-order effects
- Rival router makers face the same playbook: D-Link was sued by the FTC on comparable lax-security allegations within a year of the ASUS decree and ended up accepting a court-enforced security program of its own.
- Regulators are splitting enforcement lanes by product type — the FCC handled Wi-Fi compliance separately, extracting a $200K fine and open-firmware concessions from TP-Link — so vendors now face parallel security and radio-regulation regimes.
Third-order effects
- If the ASUS and D-Link decrees hold as templates, consumer-IoT security shifts from a best-effort patch cycle to a regulated compliance function, with multi-decade audit obligations priced into hardware businesses.
- The ASUS recurrence — the 2019 GitHub credential leak landing years into its decree period — points at a structural gap: paper audit programs may not prevent operational lapses, raising the question of how regulators verify practice rather than policy.
The trend: The FTC is converting consumer-router security failures into decades-long consent decrees, building a repeatable enforcement template it has since applied across the networking industry.