US FCC Scraps CALEA Move, Raising Telecom Security Fears

The U.S. Federal Communications Commission’s move to scrap its short-lived interpretation of the Communications Assistance for Law Enforcement Act – the 1994 statute known as CALEA – sparked warnings that the agency just eliminated one of the few enforceable cybersecurity tools for the telecom sector.

See Also: Live Webinar | Staying Secure and Compliant in a Work From Home Environment

Lawmakers and cybersecurity analysts spoke out Monday after the vote, saying the decision strips away one of the only mechanisms the federal government had to hold large carriers to baseline security expectations. Critics warned the rollback could weaken accountability for telecom providers that have been prime targets for cyberespionage campaigns (see: Experts See Little Progress After Major Chinese Telecom Hack).

The move follows one of the worst telecommunications hacks in U.S. history, in which Chinese hackers tracked as Salt Typhoon exposed flaws across the nation’s telecom and routing infrastructure, lawful intercept platforms and privileged administrative systems. Experts told Information Security Media Group the FCC’s reversal leaves the country more vulnerable to nation-state hacking and revives the same voluntary model that failed to prevent the breach in the first place.

The Salt Typhoon hack “demonstrated that voluntary security practices were not sufficient to deter nation-state activity” in the U.S. telecom sector, said Shane Tierney, senior program manager of cybersecurity governance, risk and compliance for the compliance automation platform Drata. He added that “shifting from mandatory standards to voluntary cooperation increases the likelihood of uneven security maturity across providers, which creates more entry points for attackers.”

“This may offer short-term regulatory relief for industry, but it introduces long-term national security risk at a time when the threat landscape is accelerating rather than stabilizing,” Tierney said.

The then-Democrat dominated commission in January voted to interpret CALEA as affirmatively requiring carriers “to secure their networks from unlawful access or interception of communications.” The agency framed the vote as a necessary update to a decades-old statute that was written for wiretaps and call records but now sits at the center of modern signaling, routing and intercept systems that have become high-value targets for foreign intelligence services.

The FCC acted in the final weeks of the Biden administration and responded directly to intelligence and Homeland Security assessments that Salt Typhoon had exploited structural weaknesses in telecom infrastructure. The order took effect immediately and was paired with a rulemaking that sought annual cybersecurity certifications from carriers and required them to develop written risk management plans for critical systems.

Republican leadership put in place by the Trump administration and Congress said the CALEA rule would be one of the first items slated for review. Chairman Brendan Carr argued the order expanded CALEA beyond its intended scope and said the agency needed to reconsider whether the statute could support any kind of cybersecurity mandate without congressional action.

The new majority withdrew the interpretation last week, saying the earlier commission relied on a broad reading of CALEA that failed to match the specific operations employed during the Salt Typhoon campaign. The rollback also scrapped the parallel rulemaking that would have required carriers to attest annually to the strength of their cybersecurity programs.

Requirements proposed in January would have obligated telecom providers to document how they manage access to lawful intercept nodes, secure administrative planes and segment critical routes while monitoring for suspicious activity across systems that handle sensitive communications. The FCC said the framework was designed to target the layers of infrastructure that attackers exploited to locate users and intercept traffic.

Supporters of the January move said it would have filled long-standing gaps in federal oversight by forcing carriers to maintain a minimum set of protections for the systems that support routing and intercept operations. They also argued the plan would have given regulators a clearer view and better oversight of how each provider manages identity and access controls within high-value environments (see: Experts Warn Congress Another Salt Typhoon Attack Is Coming).

Sen. Mark Warner, D-Va., said the FCC’s reversal leaves no credible replacement for those cybersecurity mandates. He pointed to failures such as credential reuse and the absence of multifactor authentication on privileged accounts as evidence that voluntary safeguards have not kept state-backed operators out of U.S. networks.

“The Salt Typhoon intrusion made clear that existing voluntary measures alone have not been sufficient to prevent sophisticated, state-sponsored actors from gaining long-term, covert access to critical networks,” Warner said in a statement. “While collaboration with industry is essential, it must be paired with clear, enforceable expectations that reflect the scale of the threat.”

Sen. Maria Cantwell, D-Wash., ranking member of the Senate Committee on Commerce, Science and Transportation, wrote in a letter to Carr that the FCC “should be focused on further enhancing the cybersecurity of our critical infrastructure networks, not rolling back existing protections.”

Some industry groups praised the decision, including USTelecom, the CTIA and NCTA, which said in a joint statement that the move ensures “communications companies retain the agility they need to swiftly address complex threats in a dynamic cybersecurity landscape.”