Dive Brief:

• Federal Communications Commission Chair Jessica Rosenworcel on Thursday proposed stronger rules requiring telecom operators to secure their networks from intrusions, in response to the wave of China-linked attacks on U.S. carriers’ infrastructure.
• The measure has two parts. Rosenworcel proposed a declaratory ruling to clarify telecom operators are legally obligated to secure their networks under Section 105 of the Communications Assistance for Law Enforcement Act. The second lever, a notice of proposed rulemaking, includes an annual certification requirement for telecom providers to maintain cybersecurity risk management plans.
• “While the commission’s counterparts in the intelligence community are determining the scope and impact of the Salt Typhoon attack, we need to put in place a modern framework to help companies secure their networks and better prevent and respond to cyberattacks in the future,” Rosenworcel said in a statement Thursday.

Dive Insight:

The FCC’s proposals come two months after news first broke about an espionage campaign sponsored by China's government that federal officials scrambled to assess and have yet to contain.

“Given the magnitude of this global attack, it’s clear that we were caught off guard, need to catch up and then keep up,” said Stéphane Téral, founder and chief analyst at Téral Research.

Salt Typhoon, a China-affiliated threat group, compromised at least eight U.S. telecom providers, stole a large amount of records and still has access to the networks, officials said earlier this week. The threat group gained broad access to communications of everyday Americans and also stole private audio and text content of targeted U.S. government and political officials.

The FCC did not respond to a request for comment or explain when or how soon the declaratory ruling or proposed rule could take effect. The agency took an active role in enforcing cybersecurity and data protection in the sector this year, expanding cooperation with state attorneys general and instituting new data breach reporting rules.

Zeus Kerravala, founder and principal analyst at ZK Research, said the FCC has the right idea but he’s skeptical of its ultimate impact.

The call to “mandate they secure their networks from unlawful access is a very broad statement, and I believe the operators do this today to the best of their ability,” Kerravala said.

The FCC and national security agencies need to increase coordination and collaboration, Téral said.

Industry analysts question the outcome of the FCC’s efforts, particularly in the absence of greater support.

The agency’s efforts will deliver “little impact if insufficient resources are deployed for implementation and execution,” Téral said. “The name of the game is to stay ahead of all continuously evolving threats.”