EPIC Continues to Support FCC Efforts to Secure Communications Networks Post-Salt Typhoon

On February 28, 2025, EPIC filed opposition to an attempt by the telecom industry to eliminate industry obligations to the FCC for deficient cybersecurity in protecting America’s phone networks.

In Fall 2024, news broke that systemic breaches of major US telecom carriers had occurred, likely orchestrated by hackers backed by the People’s Republic of China, dubbed “Salt Typhoon.” The hack was successful by exploiting a system telcos were required to create in order to facilitate lawful requests to intercept communications under the Communications Assistance for Law Enforcement Act (CALEA). For many years, experts warned of the privacy and cybersecurity dangers of such a system. The Salt Typhoon hack was so severe that the FBI took the unprecedented step of recommending that Americans switch from traditional texting (or Short Message Service, SMS) to instead use end-to-end encrypted messaging. In December 2024, and as recently as February 2025, there was evidence to suggest that the Salt Typhoon hack was still ongoing.

In January, the Federal Communications Commission undertook an initial effort to strengthen the cybersecurity of America’s communications networks in the aftermath of the “worst telecom hack in our nation’s history.” In short, the FCC’s Declaratory Ruling clarified that telcos’ obligations under CALEA included obligations to adequately secure the communications interception system so that it could not be exploited by malicious actors.

In February, several industry groups filed a petition intended to undo the FCC’s Ruling. EPIC opposed this position, urging that Congress did not enact CALEA as a means for carriers to justify negligent cybersecurity and that as a matter of factual reality carriers’ current standards were clearly deficient.

EPIC has consistently advocated for stronger safeguards in America’s communications networks to ensure the data privacy and data security of those who rely on it.