Loading story…
The Federal Communications Commission (FCC) is preparing to vote on whether to repeal cybersecurity regulations that were introduced following the Salt Typhoon attacks on U.S. telecommunications providers. These Biden-era rules, enacted in early 2025, required telecom carriers to implement basic security controls to prevent unauthorized access, but are now facing reversal under the Trump administration. Industry groups have petitioned the FCC, arguing that the agency overstepped its legal authority by interpreting the Communications Assistance for Law Enforcement Act (CALEA) to impose broad cybersecurity mandates, which they claim were not intended by Congress.
The move to rescind these rules comes amid ongoing concerns about the security of the U.S. telecommunications sector, highlighted by the Salt Typhoon incident and subsequent calls from lawmakers for stronger, mandatory cybersecurity standards. Despite bipartisan pressure, including a Senate resolution and letters from Senators Wyden and Warner, the Cybersecurity and Infrastructure Security Agency (CISA) has not released a critical report on telecom sector vulnerabilities. The debate underscores the tension between regulatory authority, industry resistance, and the urgent need to address persistent cyber threats targeting national communications infrastructure.
See the reporting duties and controls this puts on the clock.
4 events from the most recent confirmed update back to the earliest known activity.
On or before November 20, 2025, the FCC voted along party lines to roll back the Biden-era telecom cybersecurity regulations adopted after the Salt Typhoon breaches. Chairman Brendan Carr said voluntary cooperation with carriers was working, while critics warned the move removed enforceable safeguards for critical communications infrastructure.
By November 2025, Senators Ron Wyden and Mark Warner sent a letter to DHS Secretary Kristi Noem arguing that suppressing the 2022 telecom-sector report harms the cybersecurity community. They urged immediate publication and FCC action to set mandatory minimum cybersecurity standards for communications providers.
In July 2025, the US Senate unanimously passed a resolution requiring CISA to publish a 2022 report detailing serious security weaknesses in the telecommunications sector. The report had still not been released as of mid-November.
In January 2025, the FCC adopted a declaratory ruling imposing new cybersecurity requirements on telecom carriers in response to the China-linked Salt Typhoon espionage campaign. The measures were intended to require carriers to secure networks and certify cybersecurity risk management plans.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
7 references tracked. Mallory keeps watching after this page renders.
go.theregister.com
Open sourcebleepingcomputer.com
Open sourcecsoonline.com
Open sourcenextgov.com
Open sourcetherecord.media
Open sourcego.theregister.com
Open sourcego.theregister.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The Federal Communications Commission (FCC) announced plans to vote on rescinding cybersecurity regulations that were enacted in response to major breaches of U.S. telecommunications companies by Chinese state-sponsored actors, specifically the Salt Typhoon group. These regulations, introduced at the end of the Biden administration, required telecom providers to implement enhanced network security measures and submit annual certifications of their cybersecurity risk management plans. The breaches included the theft of sensitive correspondence belonging to President Donald Trump and Vice President JD Vance, prompting the initial regulatory response. FCC officials, including Chairman Brendan Carr and Secretary Marlene Dortch, argued that the existing rules were overly broad, inflexible, and imposed unnecessary burdens on telecom providers, many of whom have already adopted voluntary security measures. The FCC contends that a more targeted, collaborative approach between federal agencies and private industry would be more effective in addressing sophisticated threats like those posed by Salt Typhoon, rather than blanket regulations. The upcoming vote will determine whether these Biden-era cybersecurity requirements for telecoms will be officially rescinded.
Jun 29, 2026
Officials say the **Salt Typhoon** espionage campaign against U.S. telecommunications providers continues to shape policy debates, but weak public concern is undermining efforts to impose stronger cybersecurity requirements on the sector. The campaign compromised at least **10 U.S. telecom companies** and provided broad access to phone data affecting **millions of Americans**, yet state and federal officials report that many residents do not view telecom espionage as an urgent threat in the same way they would attacks on power grids or water systems. Officials and experts argue that the abstract nature of telecom data theft, combined with broader public desensitization to privacy loss, has made it harder to build political momentum for tougher rules. New Jersey officials highlighted the challenge of explaining why Chinese access to call records and related telecom data matters to the public, while security experts warned that the absence of sustained public pressure could stall regulatory action intended to strengthen the cybersecurity posture of U.S. telecommunications infrastructure.
Jun 29, 2026
The Federal Communications Commission approved new cybersecurity rules for the **Emergency Alert System** and **Wireless Emergency Alerts**, adding baseline controls such as strong passwords, timely patching, and firewalls to reduce the risk of hijacking, duplicate, or unauthorized alerts. The agency also said it will introduce an authentication ID mechanism to verify alerts before submission, warning that compromise of emergency communications by foreign governments, cybercriminals, or other malicious actors could spread disinformation, cause public panic, and disrupt coordination during real crises. The FCC also adopted its first major overhaul of submarine cable security oversight in decades, expanding licensing requirements to cover **submarine line terminal equipment** (`SLTE`) operators and updating safeguards for equipment, third-party providers, and supply-chain risks. The framework tightens scrutiny of undersea cable infrastructure that carries most global internet traffic, including restrictions on equipment tied to China and other designated foreign adversaries, while allowing some low-risk, U.S.-headquartered providers to receive streamlined approval if they self-certify to high security standards and accept ongoing oversight.
Jun 29, 2026