FCC calls for urgent cybersecurity overhaul amid Salt Typhoon espionage case – Source: www.csoonline.com

In the wake of the Salt Typhoon cyberespionage campaign allegedly linked to China, Federal Communications Commission (FCC) Chairwoman Jessica Rosenworcel has proposed immediate measures to strengthen the cybersecurity of US telecommunications infrastructure.

The FCC’s action came a day after top US security agencies briefed senators and the Commission on the scope of Salt Typhoon’s espionage campaign, which involved infiltrating major telecommunications networks to steal sensitive data and intercept phone communications.

The initiative includes a draft Declaratory Ruling that mandates telecom carriers to secure networks against unauthorized access under section 105 of the Communications Assistance for Law Enforcement Act (CALEA).

The proposal, if adopted, would require service providers to submit annual certifications to the FCC, ensuring they “have created, updated, and implemented a cybersecurity risk management plan, which would strengthen communications from future cyberattacks.”

“As technology continues to advance, so does the capabilities of adversaries, which means the US must adapt and reinforce our defenses,” Rosenworcel said. “While the Commission’s counterparts in the intelligence community are determining the scope and impact of the Salt Typhoon attack, we need to put in place a modern framework to help companies secure their networks and better prevent and respond to cyberattacks in the future.”

The Commission further added that it will “ensure telecommunication companies are required to secure their networks.”

“By requiring communications service providers to submit annual certifications of their cybersecurity plans, the FCC aims to establish a robust framework for network security and threat response, aligning with the evolving cyber threat landscape,” said Dheeraj Maken, Practice Director at Everest Group.

The FCC will also seek public input on expanding risk management requirements across a broad spectrum of communications providers.

“However, smaller providers may face resource constraints, and broader coordination with federal and private initiatives is essential to enhance effectiveness,” Maken pointed out. “Addressing vulnerabilities in critical systems, such as submarine cables and Emergency Alert Networks, will require steps like enhanced monitoring, redundancy planning, encrypted communications, and decentralized architectures.”

Salt Typhoon breach raises alarm

The proposals come after revelations of Salt Typhoon’s extensive cyber intrusions, targeting US telecommunications networks and stealing vast quantities of metadata and call records. FBI and CISA officials briefed reporters earlier, acknowledging the breach’s scope remains unclear.

A day before, top security agencies including the FBI, CISA, and NSA briefed senators behind closed doors on the magnanimity of the Salt Typhoon campaign in the US.

Participants in the briefing included high-ranking officials like FBI agents, Director of National Intelligence Avril Haines, and FCC Chair Jessica Rosenworcel.

US senators, including Ron Wyden and Bob Casey, have called for legislative action, citing gaps in cybersecurity readiness.

Meanwhile, telecom giants like Verizon and AT&T have collaborated with federal agencies to assess and remediate network vulnerabilities.

Broader national security implications

Salt Typhoon has reignited concerns about Chinese cyber activities and their implications for US security and commerce. The attack targeted not only major telecom operators but also submarine cable systems and emergency alert systems.

Chairwoman Rosenworcel’s latest proposal builds on earlier measures to safeguard critical infrastructure, including requiring submarine cable operators and alert system participants to develop robust cybersecurity plans.

With bipartisan scrutiny on Salt Typhoon, the FCC’s initiative signals a heightened effort to counter evolving cyber threats. However, experts warn that addressing vulnerabilities may take years, emphasizing the need for swift yet comprehensive action to secure America’s digital infrastructure.