Yes, and several points reduce the risk of the ZTE device: 1. The ZTE device is on the untrusted side of the network. It carries encrypted OpenVPN packets. 2

Yes, and several points reduce the risk of the ZTE device: 1. The ZTE device is on the untrusted side of the network. It carries encrypted OpenVPN packets. 2. The ZTE device does not download new firmware. 3. The ZTE device is not addressable on the public Internet. It participates in the GSM network. It tunnels data between its USB interface and the NAT proxy server (APN) provided by the carrier. And one point increases the risk: The ZTE device is physically attached to the USB port of the router. CCP-sanctioned action directed at me is not part of my thread model. I'm more concerned with them breaking the security of the firmware to facilitate monitoring of PRC citizens who use GL.inet devices. There is precedent for this. For example CCP forces everyone in an entire province to install spyware on their phones that logs their activities and communications and transmits them to a central server unencrypted. The data goes over whatever network the user is connected to, with zero privacy or even any protection against MITM. If GL.inet broke their firmware security, how long would the blackhats use it before the rest of us found out about the problem?