Warner and Cruz propose voluntary telecom cyber standards after Salt Typhoon

Sens. Warner and Cruz introduced a bill for voluntary telecom cybersecurity practices and optional certification after China's Salt Typhoon campaign.

Senate Intelligence Vice Chairman Mark Warner and Commerce Chairman Ted Cruz introduced the Telecommunications Cybersecurity and Resilience Act, proposing voluntary telecom cybersecurity standards after the China-linked Salt Typhoon campaign. The bill would create an NTIA working group of carriers, suppliers, experts, and agencies to draft sector-specific best practices within 18 months, reviewed every two years or after major incidents; The Record also says the group would report annually to Congress. Companies could seek optional third-party certification aligned with existing federal risk frameworks. CyberScoop describes Salt Typhoon as compromising major U.S. carriers and collecting data tied to presidential campaigns, while The Record says China-backed hackers held years-long access to at least nine carriers, including Verizon, AT&T, and Lumen, taking call-detail records and sometimes audio and text from about 150 high-profile targets. The Record adds that the proposal comes nearly a year after earlier mandatory telecom cybersecurity rules adopted after those intrusions were scrapped.

• Sens. Mark Warner and Ted Cruz introduced the Telecommunications Cybersecurity and Resilience Act.
• An NTIA working group of carriers, suppliers, experts, and agencies would draft voluntary telecom cybersecurity best practices within 18 months.
• Practices would be reviewed every two years or after major incidents; The Record also says the group would report annually to Congress.
• Companies could seek optional third-party certification aligned with existing federal risk frameworks.
• Salt Typhoon, described as a Chinese espionage campaign, compromised major U.S. carriers; The Record specifies at least nine, including Verizon, AT&T, and Lumen, with years-long access.
• The Record says the hackers collected call-detail records and sometimes intercepted audio and text tied to about 150 high-profile targets; CyberScoop says data tied to presidential campaigns was collected.
• The Record says the bill comes nearly a year after earlier mandatory post-Salt Typhoon telecom cybersecurity rules were scrapped.