FCC to rescind ruling that said ISPs are required to secure their networks

"Carr said the vote scheduled for November 20 comes after "extensive FCC engagement with carriers" who have taken "substantial steps... to strengthen their cybersecurity defenses." The FCC's January 2025 declaratory ruling came in response to attacks by China, including the Salt Typhoon infiltration of major telecom providers such as Verizon and AT&T. The Biden-era FCC found that the Communications Assistance for Law Enforcement Act (CALEA), a 1994 law, "affirmatively requires telecommunications carriers to secure their networks from unlawful access or interception of communications.""

""The Commission has previously found that section 105 of CALEA creates an affirmative obligation for a telecommunications carrier to avoid the risk that suppliers of untrusted equipment will 'illegally activate interceptions or other forms of surveillance within the carrier's switching premises without its knowledge,' the January order said. "With this Declaratory Ruling, we clarify that telecommunications carriers' duties under section 105 of CALEA extend not only to the equipment they choose to use in their networks, but also to how they manage their networks.""

The Federal Communications Commission will vote on November 20 to repeal a January ruling that required telecommunications providers to secure their networks, acting on requests from major Internet provider lobby groups. Chairman Brendan Carr said the January order exceeded the agency's authority and was not an effective or agile cybersecurity response, and he cited extensive FCC engagement with carriers that have taken substantial cybersecurity steps. The January 2025 ruling responded to attacks attributed to China, including the Salt Typhoon infiltrations of major carriers. The Biden-era FCC interpreted CALEA section 105 as creating affirmative obligations for carriers covering equipment choices and network management, and the declaratory ruling was paired with a proposed rulemaking for stricter security requirements.

Read at Ars Technica