The Communications Assistance for Law Enforcement Act (CALEA) of 1994 mandates that the FCC ensure operators secure their systems from unauthorised interceptions — something it never fully implemented.
Ron Wyden’s new Secure American Communications Act introduced earlier this week would demand the FCC to issue cybersecurity regulations required under the CALEA, with US telcos required to submit annual security tests and audits to the FCC.
Subscribe today for free
“It was inevitable that foreign hackers would burrow deep into the American communications system the moment the FCC decided to let phone companies write their own cybersecurity rules,” Senator Wyden said.
“Telecom companies and federal regulators were asleep on the job and as a result, Americans’ calls, messages, and phone records have been accessed by foreign spies intent on undermining our national security.”
Mobile devices belonging to President-Elect Donald Trump, VP-elect JD Vance, and Vice President Kamala Harris were targeted by Salt Typhoon, a group of Chinese-linked hackers as part of what the FBI described as a “cyber espionage campaign”.
Verizon, AT&T, and Lumen were targeted by hackers, while T-Mobile’s cybersecurity chief denied that the operator’s defences were compromised by Salt Typhoon.
In response to the hacks, Senator Wyden’s legislation would force US operators to conduct annual testing on whether systems can be breached.
Telcos would have to conduct tests that are set by the FCC, documenting all findings and corrective measures taken in response.
An operator’s CEO, CISO, or equivalent would then have to sign a written statement saying it is in compliance with the FCC’s cybersecurity rules.
The FCC’s cybersecurity tests, as mandated under the CALEA, would need to be created with the Director of the US Cybersecurity and Infrastructure Security Agency as well as the US Director of National Intelligence.
Independent auditors would then be tasked with conducting annual compliance assessments, documenting all failures that could lead to potential breaches.
“Congress needs to step up and pass mandatory security rules to finally secure our telecom system against an infestation of hackers and spies,” Senator Wyden added.
RELATED STORIES
T-Mobile defends its cyber defences as Chinese hackers continue to target telcos
FBI warns Chinese hackers are targeting telcos in major espionage campaign
T-Mobile hit by alleged Chinese cyber attack in major data breach
Iranian cyber actors target critical infrastructure: FBI, CISA, and NSA warn
