Tag Archives: Salt Typhoon

Last-Minute FCC Cybersecurity Ruling

At the final meeting of the Jessica Rosenworcel FCC, the agency adopted a Proposed Rulemaking to address the Chinese and other cybersecurity attacks against US networks. The order includes some startling statistics. Verizon said it has collected and analyzed over 914,000 cybersecurity incidents and 235,000 breaches in the last fifteen years. There are several citations claiming that cyberattacks doubled in 2024.

The order would have widespread implications, and the FCC estimated it would impact 69,575 communications providers. This wouldn’t just cover ISPs and telcos, but would apply to cellular companies, satellite companies and earth stations, radio stations, television stations, VoIP providers, commercial radio operators, MVNOs, and 911 providers.

The gist of the proposal is that all communications providers would have to submit an annual certification that they have created and implemented a cybersecurity and supply chain risk management plan. Specifically:

  • Cybersecurity plans would have to be actionable, not just a written plan.
  • Plans would have to be certified by top management.
  • While providers can hire outside help to develop the plan, the provider is still fully liable for any failure to protect against cyberattacks.
  • The supply chain risk management would put providers on notice to not buy electronics from questionable counties and sources.
  • The plans would be due quickly for large companies and would give smaller providers up to a year to submit a plan.
  • The FCC recognizes this will be costly and estimated a cost of $10,000 to create a plan.

It’s not likely that this proposal will survive in the current form. Incoming Chairman Brandon Carr criticized the plan for being ineffective and for relying on questionable authority, such as CALEA, in citing the FCC’s authority. However, Carr has been quoted saying that the Chinese Salt Typhoon attacks are the worse cyber security intrusion in the nation’s history.

It seems likely that the FCC under Chairman Carr will take a different approach. This will be an interesting challenge for a new FCC that is clearly in favor of lowering regulations. It’s hard to think that the nation’s networks can be protected and bolstered without new regulations that require communications companies to actively protect networks and infrastructure.

The last-minute proposed approach would rely on annual certification that companies are actively working to protect their networks. It will be interesting to see if the new FCC has something stronger in mind.

Is Your Router Spying on You?

If you’ve followed the telecom industry at all you’ve heard of the effort to rip-and-replace Chinese network gear used mostly in cellular networks and in some fiber networks. The U.S. government ordered that such equipment be replaced, although it has funded the replacement in dribs and drabs.

There is heightened scrutiny of Chinese electronics since the recently discovered Beijing-sponsored cyberattacks that that are reported to have infiltrated the networks of major U.S. ISPs and carriers. U.S. officials recently said that they have been unable to expel the Chinese hacking presence that was instigated by the Salt Typhoon Group from China.

In something that is scary news to a lot of folks, an announcement was recently made that the Justice, Defense, and Commerce Departments have all been scrutinizing WiFi and other routers made by TP-Link. The announcement say this is the most commonly used routers in the U.S. and is marketed under a number if brand names including TP-link, Tapo, Kasa, Omada, VIGI, Aginet, HomeShield, and Tapo Care.

The scrutiny of TP-Link routers started in October when Microsoft reported that the routers have been targeted by Chinese hacking groups. Security experts say the company has a history of not responding quickly when security flaws are identified in its gear. The U.S. government hasn’t announced a specific link between TP-Link and the Chinese hackers, but the recent warning of concerns means there must be strong suspicions.

It’s hard to know what the U.S. government might do if it is established that TP-Link routers are a security risk. They could ban the routers, sending millions of homes and businesses in search of new devices. They might take a softer approach and suggest that people replace them. It’s hard to imagine the government funding the replacement of home and business routers in the same way it is doing for carriers.

Perhaps the government will push for more U.S manufacture of routers. Luckily, unlike many kinds of electronics, there are alternatives to Chinese routers. Netgear routers are manufactured primarily in Vietnam, Thailand, Indonesia, and Taiwan. Linksys is Manufactured in Taiwan and Vietnam. There are smaller brands manufactured around the world – but not many routers are made in the U.S.

What’s probably the most interesting aspect of the sudden focus on WiFi routers is that security experts have been complaining for years that most routers on the market have shoddy security measures and are easy to hack. Perhaps one outcome of the sudden focus on routers will be new government rules demanding better security for all devices.

It’s always a little hard to distinguish politics from reality. Politicians are suddenly lining up to dump on the Chinese, which is easy to do for an issue with no domestic political backlash. Everybody from the incoming FCC Chairman Brandon Carr to many in Congress are suddenly saying that something needs to be done. Only time will tell if this is rhetoric or a real threat.