Despite Chinese hacks, Trump's FCC votes to scrap cybersecurity rules for phone and internet companies

The FCC voted 2-1 along party lines to rescind cybersecurity rules that had required U.S. phone and internet carriers to secure their networks from unlawful access, with Trump-appointed commissioners Brendan Carr and Olivia Trusty voting to withdraw the Biden-era rules and Democratic Commissioner Anna Gomez dissenting. The move removes regulations enacted after the discovery of a China-backed hacking campaign, Salt Typhoon, that penetrated more than 200 telcos including AT&T, Verizon and Lumen, and has drawn sharp rebukes from Senate Democrats such as Gary Peters and Mark Warner who warned it leaves critical security gaps. The telecommunications industry trade group NCTA praised the rollback as a relief from “prescriptive” rules, while Gomez and critics argue that voluntary cooperation without enforcement will not prevent future state-sponsored intrusions and weakens national cybersecurity defenses.

Analysis

The Federal Communications Commission voted 2-1 along party lines to rescind rules that required U.S. phone and internet carriers to “secure their networks from unlawful access,” with Trump-appointed chairman Brendan Carr and Commissioner Olivia Trusty voting to withdraw the Biden-era rules and Democratic Commissioner Anna Gomez dissenting. The rules were adopted earlier this year in response to a China-backed espionage campaign dubbed Salt Typhoon.

Salt Typhoon reportedly breached more than 200 telcos, including AT&T, Verizon and Lumen, and in some instances targeted wiretap systems that had been required for law-enforcement access; Commissioner Gomez called the now-overturned rules the agency’s only meaningful effort since those intrusions. Senate Democrats including Gary Peters and Mark Warner have publicly rebuked the FCC rollback, arguing it leaves critical security gaps and undermines a credible plan to address state-sponsored threats.

The industry trade group NCTA praised the rollback as removing “prescriptive” regulation, but Gomez warned that voluntary cooperation without enforcement will not prevent future breaches, highlighting an enforcement gap that raises operational and reputational risk for carriers. Market-sentiment outputs are moderately negative for tickers T, VZ and LUMN, indicating potential near-term investor concern and elevated regulatory uncertainty that could spur future legislative or oversight responses.

Key Decisions for Investors

• Reduce or hedge near-term exposure to AT&T, Verizon and Lumen given heightened cybersecurity, political and regulatory risk while monitoring volatility
• Monitor Congressional activity and statements from the Senate Homeland Security and Intelligence committees for potential legislative or oversight responses that could restore mandatory standards or introduce penalties
• Review each carrier’s public disclosures for documented cybersecurity controls, incident histories and planned remediation capex and favor names with clearer, enforceable security programs
• Consider purchasing downside protection or insurance-sensitive hedges and incorporate higher cyber-insurance cost scenarios into portfolio stress tests