Last week, four of the nation’s sharpest state attorneys general filed a coordinated set of lawsuits that deserve our attention. On October 6, Iowa’s Brenna Bird, Florida’s James Uthmeier, Nebraska’s Mike Hilgers, and Montana’s Austin Knudsen each sued TP-Link Systems. TP-Link is the dominant seller of home internet routers, the boxes that connect a household’s phones, computers, and smart devices to the internet. According to congressional testimony, it holds at least 60% of the U.S. retail market for home routers. The attorneys general’s charge is simple: TP-Link has misled consumers about how secure its devices are and how tied it remains to Communist China.
This is why electing effective, intelligent, and strategic attorneys general matters.
The threat here is real, and it starts with Chinese law. China’s 2017 National Intelligence Law requires Chinese companies and citizens to “support, assist, and cooperate” with state intelligence work. A 2021 Chinese regulation requires tech companies to report newly discovered security holes to the government within two days. A senior Department of Homeland Security official has warned that Beijing appears to use that rule to learn about those vulnerabilities before companies can fix them.
TP-Link was founded in Shenzhen, China, in 1996 by two brothers, Zhao Jiaxing and Zhao Jianjun, known in the West as Cliff and Jeffrey Chao. It entered the American market in 2008 and spent over a decade here as a Chinese company. By its own admission, it did not complete its separation from its Chinese operations until 2024. The brothers divided the company between them. Cliff Chao kept operating control of the Chinese side, TP-Link Technologies, which the Pentagon designated a Chinese military company in June. Jeffrey Chao became CEO and owner of the California-based TP-Link Systems (the named defendant in all four suits, which refer to it as “TP-Link”).
When the split was completed, TP-Link said it covered everything from its workforce to research and production. It claims that “no government—foreign or domestic—has access to and control over the design and production of our routers and other devices.” But as all four complaints lay out, “much of TP-Link’s research, development, and manufacturing remains in China, entrenched in China’s state-sponsored technology ecosystem.” Jeffrey Chao himself has acknowledged that TP-Link’s Chinese operations have “recently received state accolades and benefits.” TP-Link touts its own factory in Vietnam as an added safeguard. Yet for every dollar that factory spends on parts, only half a penny goes to parts bought in Vietnam. Everything else comes from or through China.
TP-Link calls the lawsuits “built on false premises” and insists it “is an independent, U.S. company that is not owned or controlled by any foreign government.” But several of the attorneys general’s key facts come from TP-Link’s own admissions. The complaints also cite revelations from outside sources: Bloomberg’s reporting found roughly 11,000 people working in China for TP-Link and its former Chinese affiliate, compared with about 305 employees in the United States. Microsoft reported that Chinese hackers had hijacked a network made up mostly of TP-Link routers and used it to break into accounts at American organizations. Rob Joyce, the NSA’s former cybersecurity director, testified that TP-Link routers were among the brands Chinese state-sponsored hackers exploited. The FBI and NSA have also warned that Russian military intelligence hacked TP-Link routers. Through hacked routers like these, the Russians could read traffic people believed was secure, including their Microsoft Outlook email. It should come as no surprise that TP-Link has reportedly been under investigation by the Departments of Commerce, Defense, and Justice. In March, the Federal Communications Commission added foreign-made routers to its list of equipment deemed a national security risk.
Meanwhile, TP-Link has told customers that its built-in security service, HomeShield, “covers all security scenarios” and, until recently, that it offered a “100% safeguard.” It marketed its Archer AX21 router, once a top seller on Amazon, for its “Refined Password Security.” Yet a flaw in early versions of that model let hackers take control of it without even knowing the password.
Bird’s Iowa petition bluntly states that “TP-Link lies to minimize the risk that Iowans will know or be able to find out about its longstanding and ongoing connections to China.” The four lawsuits, which follow a similar action Texas filed earlier this year, are raising public awareness of a serious national security problem.
These suits dovetail nicely with federal efforts, and they illustrate the distinctive power of state attorneys general to bring relief to consumers. Iowa, Montana, and Nebraska all ask courts to return money to consumers. Iowa, Nebraska, and Florida ask courts to strip TP-Link of profits it made unlawfully. Iowa and Florida also seek extra penalties for wrongs against seniors, who are among the least likely to track down and install a security fix themselves. Florida extends that protection to veterans, servicemembers, and people with disabilities. Bird’s Iowa petition further asks the court to make TP-Link warn every Iowa customer it can identify who owns a router the company no longer provides security fixes for, or one with a security flaw hackers are known to be exploiting, and to tell them how to protect their networks.
Citizens need a strong attorney general in their state. That means one who does more than sign on to bipartisan investigations that move paper for years and end in a mere press release. Brenna Bird, James Uthmeier, Mike Hilgers, and Austin Knudsen fit that bill. In an age when more of our lives run through devices with often-invisible vulnerabilities, these leaders have displayed the vigilance to help ensure that what Uthmeier calls consumers’ “digital front door to their home network” will not be left open to Chinese or other foreign hackers. Thank goodness for these attorneys general.