Loading story…
The Federal Communications Commission (FCC) announced plans to vote on rescinding cybersecurity regulations that were enacted in response to major breaches of U.S. telecommunications companies by Chinese state-sponsored actors, specifically the Salt Typhoon group. These regulations, introduced at the end of the Biden administration, required telecom providers to implement enhanced network security measures and submit annual certifications of their cybersecurity risk management plans. The breaches included the theft of sensitive correspondence belonging to President Donald Trump and Vice President JD Vance, prompting the initial regulatory response.
FCC officials, including Chairman Brendan Carr and Secretary Marlene Dortch, argued that the existing rules were overly broad, inflexible, and imposed unnecessary burdens on telecom providers, many of whom have already adopted voluntary security measures. The FCC contends that a more targeted, collaborative approach between federal agencies and private industry would be more effective in addressing sophisticated threats like those posed by Salt Typhoon, rather than blanket regulations. The upcoming vote will determine whether these Biden-era cybersecurity requirements for telecoms will be officially rescinded.
See the reporting duties and controls this puts on the clock.
2 events from the most recent confirmed update back to the earliest known activity.
On October 31, 2025, multiple reports said the FCC planned to vote the following month on reversing or rescinding the earlier telecom cybersecurity rulemakings. The proposed rollback would remove requirements that providers secure their networks.
The FCC previously approved a Biden-era ruling requiring telecommunications providers to secure their networks, following concerns raised by the theft of information related to President Donald Trump from telecom systems. This rulemaking established new cybersecurity obligations for carriers and ISPs.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
3 references tracked. Mallory keeps watching after this page renders.
arstechnica.com
Open sourcenextgov.com
Open sourcetherecord.media
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The Federal Communications Commission (FCC) is preparing to vote on whether to repeal cybersecurity regulations that were introduced following the Salt Typhoon attacks on U.S. telecommunications providers. These Biden-era rules, enacted in early 2025, required telecom carriers to implement basic security controls to prevent unauthorized access, but are now facing reversal under the Trump administration. Industry groups have petitioned the FCC, arguing that the agency overstepped its legal authority by interpreting the Communications Assistance for Law Enforcement Act (CALEA) to impose broad cybersecurity mandates, which they claim were not intended by Congress. The move to rescind these rules comes amid ongoing concerns about the security of the U.S. telecommunications sector, highlighted by the Salt Typhoon incident and subsequent calls from lawmakers for stronger, mandatory cybersecurity standards. Despite bipartisan pressure, including a Senate resolution and letters from Senators Wyden and Warner, the Cybersecurity and Infrastructure Security Agency (CISA) has not released a critical report on telecom sector vulnerabilities. The debate underscores the tension between regulatory authority, industry resistance, and the urgent need to address persistent cyber threats targeting national communications infrastructure.
Jun 29, 2026
Officials say the **Salt Typhoon** espionage campaign against U.S. telecommunications providers continues to shape policy debates, but weak public concern is undermining efforts to impose stronger cybersecurity requirements on the sector. The campaign compromised at least **10 U.S. telecom companies** and provided broad access to phone data affecting **millions of Americans**, yet state and federal officials report that many residents do not view telecom espionage as an urgent threat in the same way they would attacks on power grids or water systems. Officials and experts argue that the abstract nature of telecom data theft, combined with broader public desensitization to privacy loss, has made it harder to build political momentum for tougher rules. New Jersey officials highlighted the challenge of explaining why Chinese access to call records and related telecom data matters to the public, while security experts warned that the absence of sustained public pressure could stall regulatory action intended to strengthen the cybersecurity posture of U.S. telecommunications infrastructure.
Jun 29, 2026
The Federal Communications Commission approved new cybersecurity rules for the **Emergency Alert System** and **Wireless Emergency Alerts**, adding baseline controls such as strong passwords, timely patching, and firewalls to reduce the risk of hijacking, duplicate, or unauthorized alerts. The agency also said it will introduce an authentication ID mechanism to verify alerts before submission, warning that compromise of emergency communications by foreign governments, cybercriminals, or other malicious actors could spread disinformation, cause public panic, and disrupt coordination during real crises. The FCC also adopted its first major overhaul of submarine cable security oversight in decades, expanding licensing requirements to cover **submarine line terminal equipment** (`SLTE`) operators and updating safeguards for equipment, third-party providers, and supply-chain risks. The framework tightens scrutiny of undersea cable infrastructure that carries most global internet traffic, including restrictions on equipment tied to China and other designated foreign adversaries, while allowing some low-risk, U.S.-headquartered providers to receive streamlined approval if they self-certify to high security standards and accept ongoing oversight.
Jun 29, 2026