Proposed rule requires stronger security barriers for US carriers

The alleged Chinese infiltration of the US telecommunications infrastructure continues to leave its mark. US authorities are still working to expel all potential attackers. Meanwhile, a proposed rule by the FCC contemplates fines to US phone companies for not establishing sufficient security barriers.

US phone companies could face fines for insufficient security measures

The FCC has proposed a new rule that requires mobile carriers to effectively protect their networks against “unlawful access or interception of communications.” In addition, they will have to submit an annual report certifying the security measures they have taken. Anne Neuberger, deputy national security advisor, said that at least eight telecom providers were breached during the hacking campaign.

“While the Commission’s counterparts in the intelligence community are determining the scope and impact of the Salt Typhoon attack, we need to put in place a modern framework to help companies secure their networks and better prevent and respond to cyberattacks in the future,” FCC Chair Jessica Rosenworcel said.

The situation came to light in a Wall Street Journal report from October. The source named companies such as AT&T, Verizon, and Lumen among those affected. A later report added that T-Mobile could also be on the list. However, the carrier denied this in an official statement. There were also reports claiming that T-Mobile had managed to stop the infiltration of its infrastructure before it happened.

Hacking campaign has been going on for “likely one to two years

Initial reports mentioned that the hacking campaign had been going on for at least eight months. However, Neuberger mentioned a period of “likely one to two years” for the attacks. That said, she doesn’t believe that “any classified communications has been compromised” so far. The FBI has identified Salt Typhoon, a hacker group associated with the PRC, as the perpetrators of the attacks.

The telecoms breach sought to obtain confidential information that could endanger US national security, authorities say. The attackers targeted the campaign staff of the latest US presidential candidates. They also allegedly breached communication and surveillance tech used by law enforcement.

US representatives have urged Department of Defense Inspector General Robert Storch to investigate the “failure to secure its unclassified telephone communications from foreign espionage.” Any decision on the rule will have an immediate effect on US legislation. If the rule is approved, mobile carriers will be required to take immediate action to secure their networks. How long the rule will give telecoms to catch up is unknown.