FCC to vote on reversing cyber rules adopted after Salt Typhoon hack

The FCC is scheduled to vote to rescind a January Biden-era cybersecurity ruling and related proposed rules that would have required telecom operators to secure networks under Section 105 of CALEA, with Chairman Brendan Carr saying the order exceeded the agency’s authority and advocating a federal-private partnership approach instead; the move follows industry requests and the FCC’s claim of recent provider commitments to bolster security. The original rules were adopted after the 2024 “Salt Typhoon” campaign—attributed by U.S. officials to China-linked actors—that penetrated major telecom networks and targeted communications of government figures, prompting CISA advisories about persistent router compromises. While telecom associations argue voluntary collaboration has strengthened defenses, Senators Mark Warner and Ron Wyden are pressing DHS to release a 2022 vulnerabilities report, and the House has passed legislation to create a CISA‑led interagency task force, indicating continued Congressional pressure to address state‑sponsored telecom threats even as regulatory approach shifts.

Analysis

The Federal Communications Commission is scheduled to vote this week on an order to rescind a January Biden-era ruling and related proposed cybersecurity rules that would have required telecom operators to secure networks under Section 105 of the Communications Assistance for Law Enforcement Act; Chairman Brendan Carr contends the January action exceeded agency authority and proposes relying on federal‑private partnerships and targeted rulemaking instead. The original rules were adopted after the 2024 “Salt Typhoon” campaign, which U.S. officials attribute to China-linked actors and which CISA warned involved persistent compromises of backbone, provider-edge and customer-edge routers and the targeting of communications of political figures including then-candidate Donald Trump and JD Vance. Congressional dynamics remain active: Senate Republicans and Democrats (Mark Warner, Ron Wyden) are pressing DHS to release a 2022 vulnerabilities report, and the House passed the Strengthening Cyber Resilience Against State-Sponsored Threats Act to create a CISA‑led interagency task force. Near-term implications include reduced regulatory compliance burden if rescinded but continued policy and reputational risk given bipartisan congressional attention; market signals show mildly negative sentiment (score −0.3) with a modest market‑impact score (0.35), implying measurable but contained sector volatility.

Key Decisions for Investors

• Reassess exposure to large telecom operators and consider holding or selectively trimming positions that priced in stricter regulatory mandates since rescission would reduce near‑term compliance costs but increases policy uncertainty
• Monitor the FCC vote outcome, DHS release of the 2022 vulnerabilities report, and passage/implementation of the CISA‑led task force as primary catalysts that could force capital spending or regulatory re‑imposition
• Favor carriers with documented voluntary security improvements and documented cooperation with federal agencies per the FCC factsheet, as they face lower operational risk from threat actors like Salt Typhoon
• Use short‑dated hedges or reduce position size ahead of the vote and imminent congressional actions to limit downside from renewed mandates or disclosure of additional network vulnerabilities