Dive Brief:

• The Federal Communications Commission on Thursday made good on a pledge it made last month to strengthen rules requiring telecom operators to secure their networks from attack or intercept. 
• The declaratory ruling, which took effect immediately, clarifies that telecom operators are legally obligated to secure networks under Section 105 of the Communications Assistance for Law Enforcement Act. 
• The FCC also published a notice of proposed rulemaking, which calls for a wide range of communications services providers to develop and implement cybersecurity and supply chain risk management plans.

Dive Insight:

The declaratory ruling and proposed regulation come three months after reports surfaced about an espionage campaign conducted by Salt Typhoon, a threat group sponsored by China’s government, that federal officials are still scrambling to assess and contain.

The federal agency took action four days before President-elect Donald Trump assumes office and FCC Chair Jessica Rosenworcel departs the agency.

“In light of the vulnerabilities exposed by Salt Typhoon, we need to take action to secure our networks,” Rosenworcel said in a Thursday statement. “Our existing rules are not modern. It is time we update them to reflect current threats so that we have a fighting chance to ensure that state-sponsored cyberattacks do not succeed. The time to take this action is now.”

Part of the FCC’s effort leans on executive accountability, including an annual certification to the agency attesting their organization has updated and implemented a cybersecurity risk management plan designed to improve defenses against future attacks. 

“The FCC’s actions today are an important step in securing the nation’s telecommunications infrastructure against the very real threat posed by the People’s Republic of China and other threat actors,” Cybersecurity and Infrastructure Security Agency Director Jen Easterly said in a statement.

Salt Typhoon compromised at least nine U.S. telecom companies in a campaign that went undetected for months and has been underway for up to two years, according to U.S. officials.

The notice of proposed rulemaking is now open for public comment, which means adoption, and any follow-through action or amendments will likely fall to new leadership at the FCC. 

Brendan Carr, Trump’s pick to chair the FCC and a member of the five-person commission since 2017, dissented against the proposed rule and said he will issue a separate statement at a later date.

The Biden administration took multiple actions in its final days to bolster cyber defenses, including an executive order requiring technology companies to develop more secure software. The future of these regulatory measures remain uncertain under the incoming administration.