FCC, for first time, proposes cybersecurity rules tied to wiretapping law

The proposed rules are a response to Salt Typhoon’s breach of at least eight U.S. telecom companies.

Federal Communications Commission Chairwoman Jessica Rosenworcel presented draft regulations Thursday to fellow commissioners that would for the first time require telecom companies to upgrade cyber defenses under a federal wiretapping law, or face fines.

The draft rules are a response to alarming breaches of telecom providers by Chinese government hackers known as Salt Typhoon. The breaches have drawn scrutiny on how those hackers exploited the Communications Assistance for Law Enforcement Act (CALEA), the means by which telecom carriers are obligated to provide law enforcement access to their systems. 

“The cybersecurity of our nation’s communications critical infrastructure is essential to promoting national security, public safety, and economic security,” Rosenworcel said in a statement. “As technology continues to advance, so does the capabilities of adversaries, which means the U.S. must adapt and reinforce our defenses. 

“While the Commission’s counterparts in the intelligence community are determining the scope and impact of the Salt Typhoon attack, we need to put in place a modern framework to help companies secure their networks and better prevent and respond to cyberattacks in the communications sector in the future,” she said.

The potentially yearslong intrusions of at least eight U.S. telecom companies have spurred Hill briefings, a looming Cyber Safety Review Board probe, upcoming congressional hearings and exclamations that the breaches amount to the worst telecom hack in U.S. history, in addition to global ramifications.

Under the rules that would take effect immediately, commissioners “may choose to vote on them at any moment,” according to an FCC fact sheet. 

Specifically, the FCC declaratory ruling “creates a legal obligation for telecommunications carriers to secure their networks against unlawful access and interception” under CALEA, the FCC fact sheet explained. Multiple lawmakers have called on the FCC to take action similar to what Rosenworsel proposed under CALEA on Thursday.

The FCC also circulated a notice of proposed rulemaking Thursday for an annual cybersecurity risk management plan certification process.

The commission has two more scheduled open meetings before the second Trump administration begins. While the 2024 Republican platform discussed the need for minimum cybersecurity standards for critical infrastructure, some Trump-aligned parties have suggested he is less likely to welcome cyber regulations than the Biden administration, which has embraced them more vigorously than past administrations.

On Wednesday, prior to the proposal of the new rules, Republican FCC chair nominee Brendan Carr commented on the need for action in response to Salt Typhoon.

“The Salt Typhoon intrusion is a serious and unacceptable risk to our national security. It should never have happened,” he said on X. “I will be working with national security agencies through the transition and next year in an effort to root out the threat and secure our networks.”

Neither Rosenworcel nor Carr had previously committed to the idea of FCC cyber rules tied to CALEA.

Jonathan Spalter, president and CEO of USTelecom – The Broadband Association, provided this statement when asked about the FCC proposal.

“Securing our networks from cyber threats is a dynamic and evolving process that broadband providers take extremely seriously, harnessing cutting-edge technologies to defend our nation’s critical connectivity infrastructure in the face of military-grade aggression by foreign adversaries,” he said. “Ensuring the security of our customers is our top priority and we will continue to work side-by-side with intelligence agencies, law enforcement and other government partners to identify and address the root causes of cybersecurity incidents.”

Critics call FCC router rule a ‘big swing’ that could create more supply chain uncertainty

The choice to ban all foreign-made routers instead of targeting known risks could create legal and supply chain disruptions with unclear national security returns.

Cantwell claims telecoms blocked release of Salt Typhoon report 

Why Anna Gomez believes the FCC is letting telecoms off easy after Salt Typhoon

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure