FCC reverses network-cybersecurity declaratory ruling adopted in January, days before the transition to the Trump administration’s FCC
By Donny Jackson, Editor, Urgent Communications
FCC commissioners recently voted 2-1 along to party lines to “correct course” by reversing network-cybersecurity initiatives that were approved in January and were among some of the final actions taken by the commission under the Biden administration.
FCC Chair Brendan Carr said the reversal is an appropriate action, as opposed to the “rushed and eleventh-hour approach to cybersecurity” that was included in the declaratory ruling adopted on Jan. 15, when then-FCC Chair Jessica Rosenworcel was in her final days leading the commission.
Issued in the wake of the massive China-sponsored Salt Typhoon compromise of at least eight US telecom carriers, the FCC ruling cited the Communications Assistance for Law Enforcement Act (CALEA) as legal justification for requiring carriers to take specific steps that were designed to mitigate such cyberattacks in the future. But Carr said he opposed the declaratory ruling—and the accompanying notice of proposed rulemaking (NPRM) that was withdrawn as part of the reversal—on legal and practical grounds.
“The declaratory ruling that we reconsider today was neither lawful nor effective,” Carr said during the commission’s Nov. 20 open meeting, which was webcast. “It was unlawful, because the FCC purported to read a statute that required telecommunications carriers to allow lawful wiretaps [CALEA] within a certain portion of their network as a provision that required carriers to adopt specific network management practices in every portion of their network.
“It was ineffective, because it neither responded to the nature of the relevant cybersecurity threats nor was it consistent with the agile and collaborative approach to cybersecurity that has proven successful … Biden-era cyber officials said at the time [when the declaratory ruling was adopted in January] that the FCC’s decision wouldn’t just be merely ineffective—it would be counterproductive.”
FCC Commissioner Olivia Trusty—like Carr, a Republican appointee to the commission—joined Carr in reversing the declaratory ruling issued in January and echoed his legal justifications.
“The Declaratory Ruling adopted earlier this year misconstrued the scope of the Communications Assistance for Law Enforcement Act [CALEA] and, in doing so, risked creating confusion rather than clarity about the obligations of service providers,” Trusty said during the Nov. 20 meeting. “By rescinding that ruling and withdrawing the related Notice of Proposed Rulemaking, we affirm our commitment to act within the bounds of our statutory authority and to pursue cybersecurity protections that are both targeted and enforceable.”
But Democrat FCC Commissioner Anna Gomez opposed the reversing the January declaratory ruling, stating the legal objections raised by Carr and Trusty are not valid.
“The majority bases its decision on the assertion that the previous FCC action was unlawful,” Gomez said during the Nov. 20 meeting. “That is a statutory interpretation that does not stand to scrutiny. CALEA places an affirmative cybersecurity obligation on carriers, and the Communications Act gives the FCC authority to implement that obligation.
“In fact, I have noticed that many of the things the other side disagrees with tend to be simply labeled as ‘unlawful.’ Our recently upheld data-breach notification rules are one clear example. You may disagree with the policy choice, but that disagreement does not erase that statutory authority. And I worry that this capricious attempt to label this tool as unlawful will hamstring this agency when it is inevitably called upon to respond to the next hack.”
Indeed, Gomez noted that reversal of the January declaratory ruling could leave the US more vulnerable to another carrier hack.
“Sadly, the Commission today reverses the only meaningful effort this agency has advanced in response to that attack,” Gomez said. “The January declaratory ruling and notice of proposed rulemaking were adopted, because immediate action was needed at that time. They sought to create accountability, establish clear cybersecurity obligations, and put in place an enforceable framework to harden networks before the next breach.
“By rescinding those efforts—and offering nothing in their place—the FCC leaves the country less safe at the very moment when these threats are increasing.”
In particular, Gomez expressed concern that the reversal of the January declaratory ruling means the FCC is relying too heavily on industry collaboration to address cybersecurity vulnerabilities, rather than holding carriers accountable via regulation.
“None of the actions cited in this item—like our work to secure undersea cables or the creation of an internal national security brainstorming group—would have prevented that [Salt Typhoon] attack,” Gomez said. “And nothing in this item would prevent the next one.
“And the problem does not stop there. Ten months into this [presidential] administration, this FCC has still not put forward a single actionable solution to address the growing cybersecurity threat to our communications networks. Not one concrete proposal. Not one protection standard. Not one accountability mechanism. Today’s decision is not a cybersecurity strategy. It is a hope and a dream.”
Carr cited several actions taken by the FCC that are designed to help make US communications networks more security—notably, the establishment of a new Council on National Security, which is expected to enhance coordination within the FCC and across the intelligence community.
“The FCC has worked directly with carriers who have agreed to make extensive, coordinated efforts to harden their networks against a range of cyber intrusions,” Carr said. “These have included accelerated patching of outdated or vulnerable equipment, updating and reviewing access controls, disabling unnecessary outbound connections, improving their threat-hunting efforts, and increasing cybersecurity information sharing.
“All of these actions have been well within FCC legal authority and are helping to mitigate network vulnerabilities. In contrast, the declaratory ruling that we reconsider today was neither lawful nor effective.”
