FCC looks to torch Biden-era cyber rules sparked by Salt Typhoon mess
- Reference: 1763489795
- News link: https://www.theregister.co.uk/2025/11/18/fcc_salt_typhoon_rules/
- Source link:
The regulator's monthly open meeting, due to be held on Thursday, will dedicate time to the Communications Assistance for Law Enforcement Act (CALEA) and the rules the FCC introduced following a reinterpretation of the 1994 legislation.
In January 2025, five days before President Trump returned to the White House, the [1]FCC adopted a declaratory ruling that imposed sweeping rules on communications organizations to prevent unauthorized access to their networks.
[2]
A declaratory ruling is a regulator's official interpretation of a law. It is legally binding and becomes so immediately.
[3]
[4]
Under the Trump administration, the FCC wants to reverse this ruling. A [5]fact sheet [PDF] that will be handed to those voting on Thursday cites two main reasons for the decision.
The first is that the FCC feels the ruling was unlawful. It follows strongly-worded petitions made by various organizations overseen by the FCC, which claimed the regulator was acting beyond its legal powers, and its interpretation of the law, as one petition described it, was "wholly inconsistent with CALEA's text, structure, and purpose."
[6]
Brought to the FCC by CTIA (the Wireless Association), NCTA (the Internet and Television Association), and USTelecom (the Broadband Association), the [7]petition [PDF] added: "Congress did not intend for CALEA to evolve into a general cybersecurity statute over three decades after its enactment."
CALEA was introduced, in part, to maintain law enforcement's ability to carry out lawful interceptions of communications.
However, the declaratory ruling aimed to – in the associations' view – expansively interpret section 105 of that legislation to introduce "prescriptive, burdensome, and uniform" cybersecurity duties to "prevent all incidents of unauthorized interception of communications," in the context of the Salt Typhoon attacks.
[8]
These "onerous" duties would have included implementing measures such as role-based access controls, adopting MFA, mandatory vulnerability patching and exploit mitigation, and changing default passwords across the networks of in-scope organizations.
The Electronic Privacy Information Center (EPIC) [9]submitted its opposition [PDF] to the associations' petition, arguing that their attempts to repeal the declaratory ruling were a ploy "to create a sort of safe harbor for insecure cybersecurity practices."
Then-national security advisor Jake Sullivan and then-CISA boss Jen Easterly endorsed the declaratory ruling when it was [10]announced [PDF], both noting that it was an important step toward improving US cybersecurity.
The second reason for the reversal, according to the FCC, is that the declaratory ruling is ineffective at promoting cybersecurity.
It argues that the ruling is not specific enough about the vulnerabilities in-scope organizations are required to patch or otherwise mitigate, and fails to account for the different requirements of each organization, which may already employ adequate safeguards to prevent related exploits.
According to the FCC's fact sheet, the ruling also abandons the long-running practice of the regulator working with industry to identify the most pertinent risks and ways to reduce them.
[11]China's president Xi Jinping jokes about backdoors in Xiaomi smartphones
[12]Suspected Chinese snoops weaponize unpatched Windows flaw to spy on European diplomats
[13]Salt Typhoon hit governments on three continents with SharePoint attacks
[14]Suspected Salt Typhoon snoops lurking in European telco's network
It went on to say: "Instead of taking the declaratory ruling's broad tack, we believe that the Commission should promote an agile and collaborative approach to cybersecurity as reflected in existing federal and state cybersecurity requirements and federal-private partnerships that protect and secure communications networks.
"This collaborative approach to cybersecurity includes industry participation in the Comm-ISAC; the contribution of technical expertise to CSRIC, and collaboration with other federal agencies such as [15]NIST and [16]CISA to help produce best practices, guidelines, and tools to reduce cybersecurity risk."
The FCC also appeared to be satisfied with how in-scope communications organizations are improving their security standards on a voluntary basis while partnering with the federal government.
The regulator went on to note the various other commitments to cybersecurity made by the associations and the government and how this collective approach "continues to be effective."
Described by many as one of the most impactful cyberespionage attacks, China's Salt Typhoon campaign began in 2019 but was not detected until late 2024.
Details about the attack, which likely compromised information belonging to almost every single US resident, as well as those in [17]more than 80 other countries , are [18]still being unearthed a year after the initial discovery.
The Chinese state-backed attackers quietly gained access to government agencies, telecoms companies, and top universities, sucking up untold quantities of data – and likely trade secrets and other economically sensitive information – in the process. ®
Get our [19]Tech Resources
[1] https://www.theregister.com/2025/01/17/fcc_telcos_calea/
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2aRz6htu_JyGpCxRCk0deTgAAAAg&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aRz6htu_JyGpCxRCk0deTgAAAAg&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aRz6htu_JyGpCxRCk0deTgAAAAg&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[5] https://docs.fcc.gov/public/attachments/DOC-415190A1.pdf
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aRz6htu_JyGpCxRCk0deTgAAAAg&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[7] https://www.fcc.gov/ecfs/document/102183024015116/1
[8] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aRz6htu_JyGpCxRCk0deTgAAAAg&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[9] https://www.fcc.gov/ecfs/document/102183024015116/1
[10] https://docs.fcc.gov/public/attachments/DOC-408945A1.pdf
[11] https://www.theregister.com/2025/11/04/chinas_president_xi_jinping_jokes/
[12] https://www.theregister.com/2025/10/30/suspected_chinese_snoops_abuse_unpatched/
[13] https://www.theregister.com/2025/10/22/salt_typhoon_sharepoint_attacks/
[14] https://www.theregister.com/2025/10/20/salt_typhoon_european_telco/
[15] https://www.theregister.com/2025/07/31/nist_devsecops_guide/
[16] https://www.theregister.com/2025/10/27/jen_easterly_ai_cybersecurity/
[17] https://www.theregister.com/2025/10/22/salt_typhoon_sharepoint_attacks/
[18] https://www.theregister.com/2025/10/22/salt_typhoon_sharepoint_attacks/
[19] https://whitepapers.theregister.com/
It's not working...
...what with AWS and Azure in the last couple of weeks and Cloudflares woes today, it seems that voluntary commitments to "security" are not enough, especially when they can whinge about how expensive it is. The poor dears might have to downsize their yachts to help pay for it.
Re: It's not working...
Don't worry! The current administration won't legislate security but they WILL legislate yachts for the 1%, just wait a bit.
What could possibly go wrong?
Call me cynical...
...but "working with industry" with this administration sounds more like "roll over, play dead, let the industry do whatever it wants... and you're fired to save costs" while the working-class Americans make up that cost difference by paying dearly for every cyber-attack involving their personal data and devices. It seems like the man "hired" to "drain the swamp" is fine with his lackeys playing in the perpetual muck of lobbyists and industry influence.
Congress needs to do THEIR job write a proper 21st-century communications bill: 1) ISPs are common carriers without censorship or traffic prioritizing, 2) they also must ensure their systems are patched and architected to avoid single points of failure (like too much reliance on a single cloud provider and/or Cloudflare), and 3) give FCC full regulation authority, spelling out what is and isn't allowed (in case prior legislation isn't clear) making their actions immune from the "major questions doctrine" used by the current Supreme Court. Then the FCC needs to do whatever is necessary under this new act, including authoring broad guidelines AND/OR specific tailored measures.
(Anon because some of you love the current Swamp Monster. Not saying previous ones weren't also monsters, but this hypocrite claimed to be anything but, so let's call it what it is.)
How dare you expect me to lock the bank's vault door every time I leave the vault? I don't have time for this nonsense!
Hacking
Did it make it too difficult for Russian hackers? Krasnov got a phone call from Moscow?
this administration
would try to convince people that drinking water is bad for your health if Biden had come out and told people to "drink plenty of water"
(of course if you drink too much you will drown...)
Re: this administration
Remarkably the health of drinking water (wrt fluoridation) is, on the face of it, a rare point of agreement between the Biden & Trump administrations: https://subscriber.politicopro.com/article/eenews/2025/07/21/trump-admin-fights-historic-fluoride-ruling-00465318
(You rather suspect the reasons for disagreement with the ruling are very different)
Re: this administration
Exactly. If it was enacted during the Biden administration, it must be eradicated. ESPECIALLY if it is useful.
Their excuses for doing so are just that, excuses. And usually word-salad lies, at that.
I've been tempted to send Trump a short treatise on the evils of DiHydrogen Monoxide (DHMO), just for a giggle ...
Not so much a matter of rearranging the deck chairs on the Titanic, more a case of arguing that it isn't even letting in water.
more a case of arguing that it isn't even letting in water, but if it WAS letting in water, it was clearly either one of the Clintons or Obama's fault.
Sorry but I find it too burdensome to do business with any of these companies.