FCC Signals Possible Update to Wiretap Regulations in Light of Massive Breach

On December 4, a U.S. security agency confirmed reports that foreign actors, sponsored by the People’s Republic of China, infiltrated at least eight U.S. communications companies, compromising sensitive systems and exposing vulnerabilities in critical telecommunications infrastructure. It is widely believed that this attack was made possible by exploiting the requirements imposed upon carriers to make data available to law enforcement by the Communications Assistance for Law Enforcement Act (CALEA)–a vulnerability long-criticized by cybersecurity experts and privacy advocates, including members of Congress. This attack, carried out by a group called “Salt Typhoon”, exposed the communications content data and communications metadata of more than a million Americans, many of whom may still not be aware that their communications were intercepted.

Once the news became public, the FBI and Cybersecurity and Infrastructure Security Agency (CISA) urged Americans to use messaging applications that feature end-to-end encryption, such as Signal, WhatApp, Google Messages (between Android devices), and iMessage (between iPhones). FCC Chairwoman Jessica Rosenworcel was quick to announce a forthcoming proposed rulemaking to require carriers to implement greater cybersecurity. Rosenworcel’s successor as FCC Chair, Brendan Carr, has indicated that he is gathering information, and that he plans to emphasize coordination across agencies as well as feeding information to targeted companies as the FCC identifies vulnerabilities and solutions, acknowledging this as most likely the most significant and far-reaching cyber incident in U.S. history.

EPIC has consistently advocated for stronger safeguards in America’s communications networks to ensure the data privacy and data security of those who rely on it.