Implications of Salt Typhoon Attack and FCC Response

The Federal Communications Commission is taking steps to address vulnerabilities in US telecommunications networks following the Salt Typhoon cyberattack, a sophisticated intrusion linked to foreign state-sponsored actors. These measures aim to safeguard critical communications infrastructure and ensure national security, public safety, and economic resilience in the future:

• Affirming Cybersecurity Obligations and Increasing Accountability: FCC Chairwoman Jessica Rosenworcel has proposed a Declaratory Ruling that would clarify that Section 105 of the Communications Assistance for Law Enforcement Act (CALEA) creates a legal obligation for telecommunications carriers to secure their networks against unlawful access and interception.  The proposal clarifies that telecommunications carriers’ duties extend not just to the equipment they use but how they manage their networks.
• New Compliance Framework: Under a Notice of Proposed Rulemaking circulated today, the FCC proposed an annual certification requirement for communications service providers to:
  • Create, update, and implement cybersecurity risk management plans.
  • Certify compliance with these plans to the FCC to ensure accountability.
• Seeking Broader Action: The proposed Notice of Rulemaking invites public comment on:
  • Expanding cybersecurity requirements across a range of communications providers. 
  • Identifying additional ways to enhance cybersecurity defenses for communications systems.