Congressional Inquiry into Telecommunications Cybersecurity and Salt Typhoon Incursion
On November 18, 2025, Senator Maria Cantwell, Ranking Member of the Senate Committee on Commerce, Science, and Transportation, sent a letter to Federal Communications Commission (FCC) Chairman Brendan Carr raising concerns regarding telecommunications security in the wake of the Chinese-state-sponsored Salt Typhoon cyber campaign.
Senator Cantwell opposed the FCC's move to rescind a January 2025 Declaratory Ruling and Notice of Proposed Rulemaking (FCC 25-9). That prior ruling determined that the Communications Assistance for Law Enforcement Act (CALEA) affirmatively requires telecommunications carriers to secure their networks from unlawful access or interception. Cantwell requested that the FCC withdraw draft item FCC-CIRC 2511-04 and produce internal cybersecurity assessments, carrier remediation documents, and evidence supporting collaborative cybersecurity models.
- Inquiry cited foreign cyber exploits targeting major telecommunications routing infrastructure and law enforcement wiretap systems.
- Referenced petitions for reconsideration filed by CTIA, NCTA, and USTelecom concerning the Commission's January 2025 CALEA interpretation.
- Requested production of documents related to network remediation and forensic verification by November 25, 2025.
Chairman Carr's Response and National Security Measures
In a response dated January 21, 2026, Chairman Brendan Carr detailed the FCC's actions addressing cybersecurity threats and foreign adversary incursions. Carr highlighted the establishment of a new Council on National Security within the FCC to investigate the U.S. operations of entities aligned with the Chinese Communist Party and enforce exclusions under the FCC's Covered List.
Carr also cited regulatory actions taken regarding the FCC's equipment authorization process. Under rules adopted in May to eliminate untrustworthy testing entities ('Bad Labs'), the Commission initiated proceedings in September to withdraw recognition from seven test laboratories owned or controlled by the Chinese government, while allowing the recognition of four other such laboratories to expire without renewal.
- Creation of the FCC Council on National Security to monitor compliance with the Covered List.
- Rule changes prohibiting untrusted test laboratories from participating in the equipment authorization program.
- Proceedings initiated to withdraw FCC recognition from seven Chinese state-owned or state-controlled test labs.
Justification for Reversing the January 2025 Declaratory Ruling
Chairman Carr defended the Commission's vote to reverse the January 2025 Declaratory Ruling, stating that the prior ruling was neither lawful nor effective. According to Carr, the previous interpretation improperly expanded statutory wiretap requirements under CALEA across every portion of a carrier's network management practices rather than remaining within statutory limits.
Carr emphasized that the FCC is pursuing an agile, collaborative approach with telecommunications carriers to harden infrastructure. Specific technical measures undertaken with carriers include accelerated patching of outdated or vulnerable equipment, updating and reviewing access controls, disabling unnecessary outbound connections, expanding threat-hunting operations, and increasing threat information sharing.
- FCC concluded the prior CALEA Declaratory Ruling exceeded statutory authority regarding network management mandates.
- Carrier remediation priorities focus on vulnerability patching, access control tightening, and disabling unauthorized outbound connections.
- Emphasis placed on direct information-sharing and coordinated threat mitigation.