Last-Minute FCC Cybersecurity Ruling

At the final meeting of the Jessica Rosenworcel FCC, the agency adopted a Proposed Rulemaking to address the Chinese and other cybersecurity attacks against US networks. The order includes some startling statistics. Verizon said it has collected and analyzed over 914,000 cybersecurity incidents and 235,000 breaches in the last fifteen years. There are several citations claiming that cyberattacks doubled in 2024.

The order would have widespread implications, and the FCC estimated it would impact 69,575 communications providers. This wouldn’t just cover ISPs and telcos, but would apply to cellular companies, satellite companies and earth stations, radio stations, television stations, VoIP providers, commercial radio operators, MVNOs, and 911 providers.

The gist of the proposal is that all communications providers would have to submit an annual certification that they have created and implemented a cybersecurity and supply chain risk management plan. Specifically:

  • Cybersecurity plans would have to be actionable, not just a written plan.
  • Plans would have to be certified by top management.
  • While providers can hire outside help to develop the plan, the provider is still fully liable for any failure to protect against cyberattacks.
  • The supply chain risk management would put providers on notice to not buy electronics from questionable counties and sources.
  • The plans would be due quickly for large companies and would give smaller providers up to a year to submit a plan.
  • The FCC recognizes this will be costly and estimated a cost of $10,000 to create a plan.

It’s not likely that this proposal will survive in the current form. Incoming Chairman Brandon Carr criticized the plan for being ineffective and for relying on questionable authority, such as CALEA, in citing the FCC’s authority. However, Carr has been quoted saying that the Chinese Salt Typhoon attacks are the worse cyber security intrusion in the nation’s history.

It seems likely that the FCC under Chairman Carr will take a different approach. This will be an interesting challenge for a new FCC that is clearly in favor of lowering regulations. It’s hard to think that the nation’s networks can be protected and bolstered without new regulations that require communications companies to actively protect networks and infrastructure.

The last-minute proposed approach would rely on annual certification that companies are actively working to protect their networks. It will be interesting to see if the new FCC has something stronger in mind.

What Survives from the Rosenworcel FCC?

Any time there is a change of administration at the White House the FCC gets a new Chairman and a new agenda – and we now know the new Chairman will be current Commissioner Brandon Carr. With a new Chairman comes new policies, but also a turn against some of the policies of the previous FCC. In today’s blog, I speculate on what might survive and what might get tossed from the agenda pushed by Chairwoman Jessica Rosenworcel.

There are a few things that obviously get reversed. First is net neutrality, which is poorly named and is really an effort to put some regulatory oversight on broadband. The new FCC has an interesting choice. Chairman Carr could act quickly to kill Title II regulation, like was done by Chairman Ajit Pai. The FCC could instead bide its time to see if the Courts kill it. Big ISPs appealed the reinstatement of Title II authority, and there is a chance that the Sixth U.S. Court of Appeals could side with the ISPs. That would be a stronger way to reject the issue than a reversal by the FCC.

It seems likely that Commissioner Carr will reverse Chairman Rosenworcel’s decision on discrimination. ISPs were strongly in favor of an intentional discrimination standard – one that means the FCC has to prove that an ISP is purposefully discriminating before it can take any action. The FCC instead chose a disparate discrimination standard, which means that discrimination can be proved by seeing the impact of ISP actions on the public. Congress required the FCC to adopt a discrimination standard, so it’s likely that the standard will be softened.

It gets a little harder after that to find policies that will get reversed. Part of the reason for this is that the Rosenworcel FCC wasn’t able to implement a lot of its ideas since it took several years to seat a fifth Democratic Commissioner after the 2020 election.

It will be interesting to see if the FCC will continue with plans for the 5G Plan for Rural America. This plan proposes to use $9 billion from the Universal Service Fund to bring new cell sites to rural America. The concept is popular, and I know a lot of rural counties that are excited about the idea. However, there is a big chance that a new FCC will instead reexamine the overall role of the USF – or that Congress will do so. The current USF is getting increasingly difficult to fund with a levy on voice services, and there are some aspects of the fund that are not popular in Congress.

For example, there are some big subsidies in the Universal Service Fund to build rural broadband, like finishing the RDOF and EACAM infrastructure spending. There are already rumors floating that there is a growing administration sentiment against spending federal money to build rural fiber. It would not be shocking to see these programs curtailed or even ended – possibly in favor of supporting rural satellite service.

There has been an open docket for a year looking at the issue of banning bulk billing for apartments. This is an attempt by the FCC to get more broadband choice for apartment tenants. This docket has been open for a long time with a lot of loud support against the idea from building owners and ISPs. This was always going to be tough to enforce since courts have often sided in the past with building owner rights over FCC rules. My guess is that this will never come up for a vote.

One of the big wins for the Rosenworcel FCC was an emphasis on going after spam robocallers. It’s hard to think this will be reversed, and more likely will be strengthened.

The FCC is always involved in a lot of issues that get little press. For example, the current FCC took another shot at making it easier to add fiber to poles. The FCC has been investigating ways to free up more wireless spectrum, although its hands have been tied when Congress let the ability for the FCC to auction spectrum lapse. It’s likely that most of the mundane things the FCC has been doing will continue.