But, although availability and price are critical concerns, IT must first decide how seriously to take the cybersecurity risks; consultants are divided.
A likely US administration ban on Chinese optical transceivers for AI data centers may have an unintended consequence: IT will rush to buy as many of the components as possible before restrictions kick in.
Reuters on Tuesday reported that the US Federal Communications Commission (FCC) “is working on the measure to bar imports of new Chinese optical transceivers” and that officials hope to publish and implement it this year.
The report, from unnamed sources, said that the official rationale is “to prevent Chinese firms from stealing data, installing malware or disrupting service at US data centers.” The sources did, however, stress that such a ban could still be modified or shelved.
A valid concern
Analysts and consultants agree that the concern, albeit hypothetical at the moment, is valid.
If implemented, such a ban would have a severe impact on data center (DC) strategies for both enterprises and hyperscalers. Although higher costs for replacement products would be all but certain, the greater concern is the lack of availability of non-Chinese transceivers and other components, regardless of price.
A potentially even more worrying element of a ban is the need for far more sophisticated supply chain visibility. That is because many of those non-Chinese component suppliers actually use some Chinese components in their products, which means that the exact wording of any potential FCC restrictions will be critical. It will define how closely enterprises will need to examine their suppliers’ supply chains.
Aman Mahapatra, chief strategy officer for Tribeca Softtech, a New York City-based technology consulting firm, said that he thinks that an FCC ban is quite likely, because it “has run this exact playbook four times in eighteen months, against drones, routers, robots, and the July 28 inverter and robotics restrictions. The mechanism is tested, the machinery is warm.”
If the ban is enacted, said geopolitical analyst Irina Tsukerman, “CIOs will need to reassess vendor diversification, and other factors such as replacement compatibility, lifecycle planning and inventory management, given that many organizations have historically treated optical components as interchangeable commodities.”
“Enterprises will also need much greater visibility into firmware development, manufacturing origin, as well as subcontractors, and software update processes, because future procurement decisions are increasingly likely to examine the entire supply chain rather than simply the company selling the finished product,” she added. This will make future procurement more complex.
IT pain will vary
Tsukerman said that, although prices would certainly spike, the pain felt will vary based on the nature and size of each affected business She noted that while hyperscale operators can negotiate directly with manufacturers, secure long-term supply, and qualify multiple vendors for critical components due to their purchasing power, enterprises, regional data center operators, and colocation providers generally lack that leverage. Rather, they often depend on distributors supplying lower-cost Chinese products, making them considerably more vulnerable to price increases and delivery delays.
Mahapatra added that the preliminary indications suggest any such ban would have a “new models only” framing that would protect the installed base while restricting the next generation of products, which, he said, would be a compromise “generous enough to mute the hyperscaler objection.”
But, he said, “the enterprise CIO running a colocation expansion or private AI cluster is about to discover they are competing with Microsoft and Meta for the same constrained supply and losing.”
He recommended that enterprises lock down forward optics supply for anything they plan to build through 2028 before the restriction publishes, because, he pointed out, “announced-but-not-effective bans consume non-Chinese capacity through panic buying, and buyers who move after publication pay in schedule rather than dollars.”
However, such a move depends on how serious IT considers the cybersecurity risks from the Chinese components. Tsukerman argued that data leakage and malware fears need to be taken seriously, because modern optical transceivers often contain firmware, onboard memory, and management interfaces, and may also offer capabilities that can influence how traffic is monitored and managed throughout the data center.
In that case, she noted, “the risk would extend beyond espionage to include compromised firmware updates, manipulation of diagnostic information, disruption of maintenance support, delayed replacement shipment, or in the worst case scenario, interference with critical infrastructure during periods of heightened political tension.”
However, Mahapatra sees the risk quite differently.
“A transceiver is a comparatively dumb device converting electrical signals to optical and back, not a router running a network operating system with deep packet visibility,” he said. “The near-term espionage risk from currently shipping Chinese optics is thin, and CISOs who reallocate budget toward this threat over their software supply chain and identity attack surfaces are responding to headlines rather than risk.”
The suppliers involved
Consultant Brian Levine, executive director of FormerGov, labeled the potential US administration move as “one of the more consequential supply-chain moves the FCC has contemplated, because optical transceivers are the workhorse components that move data across fiber inside every AI data center, and Chinese vendors dominate that market.”
He noted that Chinese vendors Innolight and Eoptolink alone reportedly account for the majority of the 800-gig modules going into Nvidia’s AI clusters, so a ban “wouldn’t be a minor substitution,” and non-Chinese alternatives such as Coherent and Lumentum in the US don’t yet have sufficient capacity to fill the gap.
Nader Henein, a Gartner VP analyst, agreed, adding that since the nature of the AI data center supply chain is both complex and fragile, a small change can deliver a disproportionate industry impact.
“If you remove one provider from the equation, it’s not as if the others have capacity to fulfil the increase in demand, so it’s not simply a question of added cost, it’s a question of placing a ceiling on capacity and growth,” he said.
Tsukerman said that her list of the companies most likely to benefit from such an FCC ban would include Coherent, Lumentum, Applied Optoelectronics and Cisco’s Acacia business, while Broadcom and Marvell, as well as Japanese and Taiwanese manufacturers, also provide important optical and connectivity technologies that support advanced networking infrastructure.
Other components in the crosshairs
She pointed out that there is also a strong probability that a transceiver ban would quickly be followed by attacks on other components.
Networking switches, SmartNICs, data processing units, baseboard management controllers, storage controllers, intelligent power distribution units, cooling management controllers, optical transport systems, and embedded management processors “all perform functions that could influence the operation of an entire facility if compromised,” she said. “None of these products simply passes data or delivers electricity. They manage, monitor, or control critical infrastructure, making them increasingly attractive targets for supply-chain attacks.”
Her list of likely future US targets for restrictions also includes top-of-rack switches, spine switches, and rack management systems,.
Flavio Villanustre, CISO for the LexisNexis Risk Solutions Group, echoed Henein’s fears about industry impact.
“I think that the appropriate response to these types of risks needs to be more nuanced than just a blanket ban,” he said. “Since 15%-20% of all world’s semiconductors are manufactured in China, and that number rises to 80% or 85% if you include Taiwan, blocking Chinese imports for these components could hamper the entire datacenter industry.”
Although there have been rumors of insecure or trojanized hardware components sourced from China in the past, given that many large American and multinational technology vendors manufacture their parts there, ”a sledgehammer approach could spike prices for these types of systems, jeopardizing development of new technologies,” he noted. “A far more reasonable approach would be to require appropriate testing and quality controls to ensure that those risks are appropriately mitigated.”
Would likely harm the US
In addition, independent technology analyst Carmi Levy said that he is skeptical about whether an FCC ban would ultimately be a good move for the US.
“It’s fair to ask whether this will truly make American technology infrastructure more secure, or whether it’s little more than a performative stunt designed to score geopolitical points,” Levy said, pointing out that Canada didn’t end up any safer because of the Huawei and ZTE ban, and “no one should fool themselves into believing a Chinese data center ban in the US would be any different. It would only add further constraints to a supply chain that’s already close to collapsing under its own weight [and it] will likely harm American interests more than anyone else’s.”
But he also concluded that such a move would likely fail, given the current global state of data center technologies.
“Chinese suppliers and components have been so ingrained in the global technology supply chain for so long that no ban of any form could hope to have any tangible impact on so-called national security,” Levy said. “To claim otherwise exposes the true motivations of this misdirected policy strategy.”
