FCC wants to revamp data breach laws for telecom carriers

The rule change could create additional reporting requirements for companies.

The Federal Communications Commission is exploring updating data breach laws for telecom carriers, the agency announced Wednesday.

“Current law already requires telecommunications carriers to protect the privacy and security of sensitive customer information,” said FCC Chairwoman Jessica Rosenworcel. “But these rules need updating to fully reflect the evolving nature of data breaches and the real-time threat they pose to affected consumers.”

One key change suggested in a proposal Rosenworcel circulated Wednesday is eliminating the seven-business-day waiting period required of businesses before notifying customers of a breach. The proposed rule would also require carriers to report breaches to the FCC in addition to the FBI and U.S. Secret Service.

Current FCC rules require that carriers over 5,000 or more customers notify the FCC of a data breach within seven days of discovery, while breaches affecting fewer than 5,000 customers must be reported no later than 30 days.

The FCC proposal aims to “align the Commission’s rules with recent developments in federal and state data breach laws covering other sectors,” according to an agency news release.

The proposal will be publicly released if adopted in a vote by the full Commission, Paloma Perez, press secretary to Rosenworcel, said in an email. The rulemaking process would include a period for public comment.

Efforts to overhaul data breach notification laws in the United States have surged alongside growing concerns about cybersecurity attacks. Members of both the Senate and the House have introduced legislation that would tighten reporting requirements for companies in critical industries. The House passed legislation that would establish mandatory cybersecurity incident reporting for critical infrastructure operators as part of the national defense spending bill for 2022. However, the provision was cut.

The FTC also recently sent a warning about data breaches, advising that it would pursue penalties against companies who fail to patch critical vulnerabilities, resulting in the breach or exposure of consumer information.

The rulemaking process will explore what kinds of information carriers should be required to report in customer breach notices, as well as the expansion of requirements for “inadvertent breaches.” Currently, the FCC only requires reporting of “inadvertent breaches” in instances where there is a likelihood of customer harm.

Such breaches have previously resulted in significant fines for telecom companies. In 2015 the FCC settled the investigation of a 2013 and 2014 data breach by AT&T with a $25 million civil penalty. In August, the agency said it was investigating a data breach disclosed by T-Mobile affecting more than 50 million current and former customers.

The FCC does not comment on ongoing investigations, Perez said.

The proposal is the latest example of the FCC’s mission to improve cybersecurity in the industry. In September the agency proposed rules requiring carriers to safeguard against cybercriminals porting numbers from a legitimate account to scammer-controlled devices, a technique known as “SIM-swapping” or “port-out fraud.”

There’s a possibility that a final vote on either rule could be slowed down by the standoff in Congress over approving a new Democratic commissioner. The commission is currently split 2-2 and Republicans have fiercely fought the confirmation of Biden nominee Gigi Sohn, who was recently renominated for consideration.

Updated 1/13/22: Updated to include comment from the FCC.

FCC tightens KYC rules for telecoms, closes loophole for banned foreign services

The commission wants telecoms to do more to verify their callers and prevent illegal calls and scams from reaching Americans.

Critics call FCC router rule a ‘big swing’ that could create more supply chain uncertainty

Cantwell claims telecoms blocked release of Salt Typhoon report 

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure