‘Salt Typhoon’ telecoms hack prompts new US cybersecurity regulations

(CN) — The Federal Communications Commission on Thursday pushed “urgent action” on updating U.S. telecoms cybersecurity regulations following federal officials’ discovery that a Chinese hacking group pilfered the metadata of a large number of Americans.

The group, called Salt Typhoon, reportedly infiltrated at least eight major U.S. telecommunications companies as part of an extensive cyber espionage operation that has affected numerous countries, including the United States.

“While the Commission’s counterparts in the intelligence community are determining the scope and impact of the Salt Typhoon attack, we need to put in place a modern framework to help companies secure their networks and better prevent and respond to cyberattacks in the future,” FCC Chairwoman Jessica Rosenworcel said in a statement.

She noted that while U.S. intelligence agencies are still investigating the scope of the Salt Typhoon attack, the agency will take immediate steps to ensure telecom companies are better prepared to prevent future breaches.

The FCC has proposed requiring telecom companies to enhance the security of their networks against attacks and implementing an annual cybersecurity risk management planning certification requirement for communications services.

Rosenworcel good cybersecurity is essential to national security, public safety and economic security.

Deputy National Security Advisor Anne Neuberger confirmed the breach on Wednesday. She revealed that the hackers accessed the communications of senior government officials and political figures, however, she assured the public that no classified communications had been compromised.

Speaking to lawmakers in a closed-door briefing, senior officials said the operation targeted people both in the U.S. and abroad and that the hacking campaign focused on telecom and telecom infrastructure companies. The targeted companies have yet to speak publicly on the full scope of the damage.

Earlier this week, the Chinese embassy in Washington balked at claims it was behind the attack.

Embassy spokesperson Liu Pengyu called on the U.S. to “stop its own cyberattacks against other countries” and accused American officials of using cybersecurity as a tool to “smear and slander China.”

The stolen metadata includes information such as call records — who placed the call, to whom it was made, the duration and the location of the call — that essentially offer a snapshot of a person’s personal life, work and social connections.

Next Wednesday, a Senate subcommittee on commerce will hold a hearing to discuss the ongoing threat posed by Salt Typhoon and the vulnerabilities of U.S. communications networks.

The breach adds to a growing list of Chinese cyber intrusions, following previous reports of election-era hacks involving the campaigns of then-presidential candidate Donald Trump, Vice President Kamala Harris and other U.S. officials.