FCC to Vote on Repeal of Telecom Cybersecurity Rules Enacted After Chinese Hackers Stole Trump, Vance Communications

WASHINGTON — A Policy Reversal Amid Persistent Threats

The Federal Communications Commission (FCC) announced plans this week to rescind key cybersecurity regulations introduced earlier this year in the wake of the Salt Typhoon cyber-espionage campaign—a coordinated intrusion attributed to Chinese state-backed hackers who compromised multiple U.S. telecommunications providers and accessed the communications of President Donald Trump, Vice President JD Vance, and other high-ranking officials.

The proposed repeal would reverse a declaratory ruling issued in January 2025, which mandated that telecommunications carriers develop and annually certify cybersecurity risk management plans. The ruling was designed to address network weaknesses exposed by the Salt Typhoon incident, which affected major providers across the U.S., Europe, and Asia.

---

FCC’s Position and Rationale

FCC Chairman Brendan Carr confirmed that the agency intends to vote on the rescission during its November 20 open meeting, describing the earlier rule as “legally flawed and operationally redundant.”

In a 72-page regulatory filing, FCC Secretary Marlene Dortch outlined the new administration’s reasoning, writing that the prior mandate “applied inflexible, across-the-board cybersecurity requirements to all carriers without regard to size, scope, or specific threat exposure.”

Dortch stated that the January ruling created “a vague and amorphous standard that risked imposing costly, redundant, or irrelevant obligations on smaller carriers”—many of which, she noted, already adhere to security frameworks established by the SEC, NIST, CISA, and CIRCIA (Cyber Incident Reporting for Critical Infrastructure Act of 2022).

She added that while the Salt Typhoon exploit prompted necessary industry-wide review, the federal government should pursue “an agile and collaborative approach to cybersecurity through federal-private partnerships and targeted, legally sound rulemaking.”

---

The Salt Typhoon Breach

The Salt Typhoon campaign, uncovered in late 2024, was one of the most damaging intrusions in U.S. telecommunications history.
At least nine major carriers, including Verizon, AT&T, Lumen, and others, were compromised by Chinese government-linked hackers who gained prolonged access to Call Detail Records (CDRs) and in some cases intercepted live voice and text communications.

The campaign focused on approximately 150 high-profile individuals, including senior government officials from both parties.
Among those reportedly targeted were Trump, Vance, Sen. Chuck Schumer (D-NY), and staff members of former Vice President Kamala Harris.

A separate federal analysis later concluded that the hackers achieved broad access due to weak administrative controls, including a single telecom administrator account with unrestricted visibility into more than 100,000 routers.

---

Political and Legislative Reaction

Lawmakers from both parties condemned the breach as a national security failure and pressed the federal government to enforce cybersecurity standards across the telecommunications sector.

Sen. Mark Warner (D-VA) called the incident “the worst telecom hack in our nation’s history.”
Sen. Rick Scott (R-FL) criticized the lack of federal accountability, saying, “There’s no plan to fix it. That’s unacceptable.”
Sen. Ron Wyden (D-OR) added that the damage was “the direct result of carriers failing to implement basic cybersecurity measures such as patching and multi-factor authentication.”

The January declaratory ruling under the Biden administration cited the Communications Assistance for Law Enforcement Act (CALEA) as its legal foundation—asserting that telecommunications carriers have a statutory duty to prevent unlawful access to communications.
The ruling framed that duty as inclusive of network segmentation, access control enforcement, and incident response visibility.

---

The New FCC’s Legal Argument

The Trump administration’s FCC leadership argues that the prior rule was legally overbroad and that its mandates fell outside the Commission’s statutory jurisdiction.

The agency’s Fact Sheet released Thursday described the previous order as “an ill-advised, rushed effort lacking a proper notice-and-comment process.” It also noted that the ruling “offered no prioritization of vulnerabilities or specific guidance on threat mitigation.”

The new FCC asserts that telecom carriers have since demonstrated voluntary compliance and proactive security improvements through existing partnerships with CISA, FBI, and NSA.
Dortch cited letters from multiple industry associations outlining “accelerated patching cycles, enhanced access controls, improved remote access configurations, and heightened threat-hunting operations” following Salt Typhoon.

Industry correspondence reviewed by TRJ confirms that several providers coordinated with law enforcement to share threat indicators in real time, helping to remove intruders from compromised networks and prevent re-entry.

---

The Path Forward

The FCC’s draft order to rescind also pledges the formation of a Council on National Security, established in March 2025, to advise on future cybersecurity initiatives and maintain interagency coordination on emerging threats.

Dortch emphasized that the Commission will continue to engage with carriers through Comm-ISAC (Communications Information Sharing and Analysis Center) and that telecommunications providers have committed to ongoing collaboration with federal agencies to defend against foreign intrusion campaigns.

The pending vote will also withdraw an associated Notice of Proposed Rulemaking (NPRM) that aimed to extend cybersecurity compliance requirements to all FCC licensees, citing similar legal and procedural concerns.

---

Broader Context: Balancing Autonomy and Accountability

The planned repeal underscores a long-standing tension in U.S. cybersecurity governance: how to enforce protection standards across critical industries without overstepping regulatory authority or duplicating existing frameworks.

Federal cybersecurity oversight remains distributed among multiple agencies—CISA for civilian infrastructure, NSA for classified networks, NIST for technical standards, and the FCC for communications systems. Each operates under different mandates, creating overlap and occasional jurisdictional friction.

While critics fear deregulation could leave telecom infrastructure vulnerable, proponents argue that flexibility, industry-specific risk assessment, and faster adaptation are essential to keeping pace with evolving state-sponsored threats.

---

TRJ Analysis

The upcoming FCC vote represents a critical inflection point in how the United States defines accountability for national communications security.

The Salt Typhoon breach revealed how digital trust collapses when infrastructure providers fall behind adversaries with near-limitless resources and patience. Yet the debate now centers on whether government-imposed uniformity strengthens defenses or hinders adaptive response.

As of this writing, no additional federal rulemaking has been proposed to replace the rescinded directive. The decision may set a precedent for how far regulatory agencies can go in compelling cybersecurity compliance — particularly when private-sector infrastructure becomes the front line of geopolitical conflict.

The world will be watching the November 20 vote — and the signal it sends to both allies and adversaries about America’s approach to securing its most vital networks.

---

---

---

---

---

---