Despite Chinese hacks, Trump’s FCC voted to rescind cybersecurity rules for phone and internet companies

The Federal Communications Commission voted 2-1 along party lines Thursday to rescind rules requiring U.S. phone and internet giants to meet minimum cybersecurity requirements.

Two Trump-appointed FCC commissioners, Chairman Brendan Carr and fellow Republican Olivia Trusty, voted to withdraw rules that require telecommunications companies to “secure their networks from unlawful access or interception of communications.” The Biden administration adopted these rules before leaving office earlier this year.

The FCC’s only Democratic commissioner, Ana Gomez, has defected. In a statement following the vote, Gomez called the now-rescinded rules “the only meaningful effort this agency has put forward” since the discovery of a large-scale campaign by a Chinese-backed hacking group called Salt Typhoon that included hacking a wide range of U.S. phone and internet companies.

Hackers broke into more than 200 telecommunications companies, including AT&T, Verizon and Lumen, during a years-long campaign to conduct widespread surveillance of US officials. In some cases, hackers targeted eavesdropping systems that the US government had previously required telecom companies to install to reach law enforcement.

The FCC’s move to change the rules has drawn rebuke from top lawmakers, including Sen. Gary Peters (D-Mich.), the ranking member on the Senate Homeland Security Committee. Peters said he was “troubled” by the FCC’s efforts to roll back “basic cybersecurity safeguards” and warned that doing so would “leave the American people exposed.”

Sen. Mark Warner (D-Va.), the ranking member on the Senate Intelligence Committee, said in a statement that the rule change “leaves us without a credible plan” to address the fundamental security vulnerabilities exploited by Salt Typhoon and others.

For its part, NCTA, which represents the telecommunications industry, praised the repeal of the rules, calling them “prescriptive and counterproductive regulations.”

But Gomez cautioned that while cooperation with the telecom industry is valuable for cybersecurity, it is insufficient without implementation.

“Toothless handshake agreements will not prevent state-sponsored hackers from seeking to infiltrate our networks,” Gomez said. “They will not prevent the next breach. They do not ensure that the weakest link in the chain is strengthened. If volunteer cooperation were sufficient, we would not be sitting here today in the aftermath of Hurricane Salt.”