Jump to content

FCC will vote to scrap telecom cybersecurity requirements


Recommended Posts

Posted

https://apple.news/AIlfmUYYEQeiR9bgNnXCKkA

https://www.fcc.gov/news-events/blog/2025/10/29/halloween-treats

 

Quote

Discarding the CALEA declaration and proposed rules would eliminate the U.S. government’s most substantial response to the widespread cybersecurity failures in the U.S. telecom industry that China’s Salt Typhoon hacking campaign exposed in late 2024. In an espionage operation widely considered one of the most damaging cyber incidents in U.S. history, China-linked hackers penetrated U.S. telecom networks and accessed information about federal wiretaps, the call recordings of high-profile Americans and more than a million other people’s call and text metadata.

What could go wrong ..

  • Rage+1 8
Posted

As with most things this era, to understand this move, just ask and answer the question "who in the regime/closely aligned with the regime will benefit and profit from this, and how?"  Once you answer that, you'll understand exactly why this is happening.  You don't have to bother wondering whether "this is good policy," or "is it good for the people?"  Those are not in play in any way.  Just find who benefits, and it will be clear.

  • Hook 'Em 5
  • Like 1
Posted
2 minutes ago, Brisketexan said:

As with most things this era, to understand this move, just ask and answer the question "who in the regime/closely aligned with the regime will benefit and profit from this, and how?"  Once you answer that, you'll understand exactly why this is happening.  You don't have to bother wondering whether "this is good policy," or "is it good for the people?"  Those are not in play in any way.  Just find who benefits, and it will be clear.

I’m sure Palantir will somehow benefit, thus giving even more money to Trump’s backers. 

Posted

Ehh, who are we kidding. They have already gone through the back door and remodeled the house to build even more backdoors that we don't know about. This just leaves the front door unlocked which doesn't really mean shit.

  • Hook 'Em 1
  • Rage+1 1
Posted

CALEA's purpose is to enhance the ability of law enforcement agencies to conduct lawful interception of communication by requiring that telecommunications carriers and manufacturers of telecommunications equipment modify and design their equipment, facilities, and services to ensure that they have built-in capabilities for targeted surveillance, allowing federal agencies to selectively wiretap any telephone traffic; it has since been extended to cover broadband Internet and VoIP traffic. Some government agencies argue that it covers mass surveillance of communications rather than just tapping specific lines and that not all CALEA-based access requires a warrant.

Journalists and technologists have characterised the CALEA-mandated infrastructure as government backdoors.[1][2] In 2024, the U.S. government realized that China had been tapping communications in the U.S. using that infrastructure for months, or perhaps longer.[3]

Posted

The cybersecurity requirement under the Biden administration was a response to the Chinese hacking campaigns. The declaration was not prescriptive and amounted to "do something!" Which is fine because that's how these things get started. 

The evolution of NERC CIP over the last twenty years is a good example of how this things are supposed to work. CIP started off as a "do something" declaration and initially rolled out a "best effort" requirement similar to the FCC one. Overtime a framework and standards were established based on NIST until eventually a mature security framework was established. 

From what I understand, CSRIC was following the NERC process by utilizing NIST to build industry specific guidelines and standards. USTelcom has also been pushing the FCC to adopt NIST standards but for some weird reason the whole thing is being thrown in the trash.

I've seen NERC CIP evolve from a vague guideline to a very prescriptive and mature framework and I do find the maturation process pretty impressive. There are regular iterations of more prescriptive controls and guidelines to adapt to non-standard situations but this took a couple of decades to accomplish. Really, things didn't pick up speed until the last 12 years. It took a long time to lay the ground work.

You don't scrap an effort like this without an alternative plan. These things really do take years to be developed, by ending the cybersecurity declaration Carr is putting the U.S. behind schedule when it's already way behind schedule. 

 

  • Hook 'Em 4
  • Fuck Around and Find Out 3
Posted
10 minutes ago, SubliminalHorn said:

It’s weird. It’s almost like every decision made by the regime benefits China everyone but every day Americans in some way

fify

The US Government is absolutely hostile to the average American

  • Hook 'Em 5
Posted
7 minutes ago, Js1 said:

fify

The US Government is absolutely hostile to the average American

I don't think it's hostile nearly as much as it's just completely ambivalent and indifferent to about 90% of Americans. 

Posted
Just now, SydneyCarton said:

I don't think it's hostile nearly as much as it's just completely ambivalent and indifferent to about 90% of Americans. 

No I think they legitimately hate those 90% of Americans.  

  • Hook 'Em 1
Posted (edited)
15 hours ago, F250 said:

The cybersecurity requirement under the Biden administration was a response to the Chinese hacking campaigns. The declaration was not prescriptive and amounted to "do something!" Which is fine because that's how these things get started. 

The evolution of NERC CIP over the last twenty years is a good example of how this things are supposed to work. CIP started off as a "do something" declaration and initially rolled out a "best effort" requirement similar to the FCC one. Overtime a framework and standards were established based on NIST until eventually a mature security framework was established. 

From what I understand, CSRIC was following the NERC process by utilizing NIST to build industry specific guidelines and standards. USTelcom has also been pushing the FCC to adopt NIST standards but for some weird reason the whole thing is being thrown in the trash.

I've seen NERC CIP evolve from a vague guideline to a very prescriptive and mature framework and I do find the maturation process pretty impressive. There are regular iterations of more prescriptive controls and guidelines to adapt to non-standard situations but this took a couple of decades to accomplish. Really, things didn't pick up speed until the last 12 years. It took a long time to lay the ground work.

You don't scrap an effort like this without an alternative plan. These things really do take years to be developed, by ending the cybersecurity declaration Carr is putting the U.S. behind schedule when it's already way behind schedule. 

 

I worked in VZ for over 15 years. I worked for another small telecom company who was a supplier to the big 3 (4 at the time). Mostly companies "want" to be good at cyber security, up to a point. I don't think you can ever build Fort Knox around a network. There are just way too many points of entry from switches, routers, corporate spies, to Joe Blow clicking on a phishing link. Maybe Fort Knox can be built, but it'll be expensive as fuck. But even then it won't protect you from the threats which have already been installed and lay dormant.

Cyber security is all cost. You can't market and sell that you spend $200M a year on protecting your network, knowing that's not going to be enough. That dictates the smaller guy's attention to it.

But having government regulations requiring something will at least make some companies spend money on cyber security. The leadership at the small company did not want to do anything. We were mandated by our customers (the big 3). Even then it was the least amount (cheapest) effort possible.

Edited by crash_davis
  • Hook 'Em 2
Posted
Just now, crash_davis said:

I worked in VZ for over 15 years. I worked for another small telecom company who was a supplier to the big 3 (4 at the time). Mostly companies "want" to be good at cyber security, up to a point. I don't think you can ever build Fort Know around a network. There are just way too many points of entry from switches, routers, corporate spies, to Joe Blow clicking on a phishing link. Maybe Fort Knox can be built, but it'll be expensive as fuck. But even then it won't protect you from the threats which have already been installed and lay dormant.

Cyber security is all cost. You can't market and sell that you spend $200M a year on protecting your network, knowing that's not going to be enough. That dictates the smaller guy's attention to it.

But having government regulations requiring something will at least make some companies spend money on cyber security. The leadership at the small company did not want to do anything. We were mandated by our customers (the big 3). Even then it was the least amount (cheapest) effort possible.

Most firms approach cybersecurity like outrunning a bear: you don't need to be the A-1 best/fastest, you just need to not be the worst/slowest. And tbh, just doing baseline security patching with defense in depth will be "good enough". No matter how much security you put in place, you're always vulnerable to social engineering attacks which will always sidestep most controls put in place

  • Hook 'Em 1
Posted
31 minutes ago, crash_davis said:

I worked in VZ for over 15 years. I worked for another small telecom company who was a supplier to the big 3 (4 at the time). Mostly companies "want" to be good at cyber security, up to a point. I don't think you can ever build Fort Knox around a network. There are just way too many points of entry from switches, routers, corporate spies, to Joe Blow clicking on a phishing link. Maybe Fort Knox can be built, but it'll be expensive as fuck. But even then it won't protect you from the threats which have already been installed and lay dormant.

Cyber security is all cost. You can't market and sell that you spend $200M a year on protecting your network, knowing that's not going to be enough. That dictates the smaller guy's attention to it.

But having government regulations requiring something will at least make some companies spend money on cyber security. The leadership at the small company did not want to do anything. We were mandated by our customers (the big 3). Even then it was the least amount (cheapest) effort possible.

I did some SOC/DFIR consulting at Verizon in the past. Without going into the details, I will say that the type of monitoring that they were implementing was far beyond what most of my other customers were doing. In my experience I would say AT&T has there shit together too.

Agree with the last part. A mandated framework will not only make the unwilling responsible but it will provide guidance for the smaller organizations. A security framework work and standard controls forces organizations to remove all the low hanging fruit. 

  • Hook 'Em 2

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.



×
×
  • Create New...