FCC rolls back cybersecurity rules for telcos, despite state-hacking risks

[erek]

"Disclosed in October 2024, the Salt Typhoon attacks were linked to a Chinese espionage campaign that impacted several companies, including Verizon, AT&T, Lumen Technologies [1], T-Mobile [2], Charter Communications, Consolidated Communications [3], and Windstream [4].

The hackers accessed core systems that U.S. federal government used for court-authorized network wiretapping requests, and potentially intercepted extremely sensitive information, up to the level of government officials.

FCC's plan met with criticism​

Given that the risk for similar hacker operations remains unchanged, the FCC’s latest decision was met with criticism.

Commissioner Anna M. Gomez, the only one voting against the current decision, expressed frustration about the reliance on telecom providers for self-evaluating their cybersecurity stance and the effectiveness of the protective measures.

“Its [FCCs] proposed rollback is not a cybersecurity strategy,” stated Gomez. “It is a hope and a dream that will leave Americans less protected than they were the day the Salt Typhoon breach was discovered.”

“Salt Typhoon was not a one-off event but part of a broader campaign by state-sponsored actors to infiltrate telecommunications networks over long periods of time,” Gomez warned in her statement.

“Federal officials have stated publicly that similar reconnaissance and exploitation attempts are ongoing today, and that telecommunications networks remain high-value targets for foreign adversaries,” the official said.

Senators Maria Cantwell and Gary Peters have also sent letters to the FCC before the vote to urge the agency to maintain the cybersecurity safeguards.

BleepingComputer has emailed the FCC for a statement and will update the article when we get a reply"

Source: https://www.bleepingcomputer.com/ne...rules-for-telcos-despite-state-hacking-risks/

 

[sleepeeg3]

The US federal government only has a few roles in the Constitution.
The major one is defense.
Cybersecurity is one thing we need to defend against and we are doing a poor job of it.
I'm not sure how to handle this. Maybe a carrot and stick approach - "we'll give telecom companies X amount of money, but take away Y amount of money if you get infiltrated?"

 

[philb2]

The US federal government only has a few roles in the Constitution.
The major one is defense.
Cybersecurity is one thing we need to defend against and we are doing a poor job of it.
I'm not sure how to handle this. Maybe a carrot and stick approach - "we'll give telecom companies X amount of money, but take away Y amount of money if you get infiltrated?"

Unilateral disarmament.

 

[sfsuphysics]

And I would say to Zarathustra[H] this is why we will never hold companies responsible for our data... we apparently don't give enough of a fuck to deal with cybersecurity ourselves.

 

[uOpt]

Before I judge this I would like to know what these rules were, specifically. There is a lot of garbage in security rules.

 

[philb2]

There is a lot of garbage in security rules.

Like?

 

[MrGuvernment]

Like?

Cyber Insurance and some things still wanting password changes done every 90 days or less....

 

[uOpt]

Cyber Insurance and some things still wanting password changes done every 90 days or less....

Good example.

 

[Lakados]

Before I judge this I would like to know what these rules were, specifically. There is a lot of garbage in security rules.

The big one that opponents of the roll back are against removing is this one..

The Communications Assistance for Law Enforcement Act (CALEA) is a U.S. wiretapping law passed in 1994 that requires telecommunications carriers and manufacturers to build in capabilities for law enforcement to conduct lawful surveillance of communications networks. It was originally designed for digital telephone networks but has since been extended to cover broadband and Voice over Internet Protocol (VoIP) services. CALEA also provides law enforcement with accelerated access to basic subscriber information, without a warrant.

Aka a mandatory back door.

The roll back also removes a lot of red tape around tower upgrades and network expansions, also written in the 90’s and early 2000’s. Most of them revolve around environmental impact assessments for stuff we now know doesn’t have any meaningful impacts.