Bipartisan Legislation Aims to Strengthen Telecom Defenses After Salt Typhoon Intrusions
U.S. Senators Mark Warner (D-VA) and Ted Cruz (R-TX) have introduced the Telecommunications Cybersecurity and Resilience Act, a bipartisan bill designed to improve the security posture of the nation’s telecommunications infrastructure in response to the Salt Typhoon cyber espionage campaign.
The legislation comes after Chinese government-backed hackers maintained undetected access to at least nine major U.S. telecom providers — including Verizon, AT&T, and Lumen — for several years, exploiting vulnerabilities to harvest sensitive communications data.
Bill Establishes Working Group to Develop Voluntary Best Practices
The Telecommunications Cybersecurity and Resilience Act would create a Telecommunications Cybersecurity Working Group under the National Telecommunications and Information Administration (NTIA). This group would bring together telecommunications companies, equipment suppliers, cybersecurity experts, and federal officials to develop a set of voluntary cybersecurity best practices tailored to the sector.
These best practices would be reviewed and updated every two years, or following any significant cyber incident, to ensure they remain effective against evolving threats. The working group would also be required to submit an annual report to Congress detailing its findings and progress.
Voluntary Certification Process Proposed for Telecom Companies
In addition to establishing best practices, the bill would create a voluntary certification program. Under this framework, telecom companies could undergo an independent third-party assessment to verify that they have implemented and maintained the recommended security measures.
The certification is intended to provide a measurable way for companies to demonstrate their commitment to cybersecurity resilience without imposing mandatory federal regulations.
Lawmakers Cite Salt Typhoon as Catalyst for Action
Senator Warner emphasized the severity of the Salt Typhoon intrusion, calling it "the worst telecom hack in our nation’s history" and warning that it exposed critical weaknesses in the security of U.S. communications networks.
He argued that adopting cybersecurity best practices — such as secure configurations, timely patching, behavioral monitoring for anomalies, and multi-factor authentication for administrator accounts — could have significantly impeded the hackers’ operations.
Senator Cruz echoed this sentiment, stating that securing communications networks requires an adaptive approach that keeps pace with threats posed by foreign adversaries, and that the bill promotes collaboration between government and industry to develop practical, sector-specific guidance.
Context: Previous Mandatory Rules Were Repealed
The new bill follows the recent repeal of proposed mandatory cybersecurity regulations for telecoms that had been introduced in the aftermath of the Salt Typhoon discoveries. Those earlier rules would have required carriers to implement formal risk management plans and submit annual certifications of compliance.
Democratic lawmakers, including Warner, criticized the removal of those mandates, arguing that voluntary measures without enforcement mechanisms leave critical infrastructure vulnerable to continued exploitation by sophisticated threat actors like those behind the Salt Typhoon campaign.
Investigations into the breach revealed that the attackers accessed Call Detail Records (CDRs), which contain detailed metadata about calls — including parties involved, timing, duration, and location — and in some instances intercepted audio and text communications.
The hacking campaign specifically targeted approximately 150 high-profile individuals, including then-President Donald Trump, Vice President JD Vance, staff members of former Vice President Kamala Harris, and senior officials such as Senator Chuck Schumer (D-NY).
Source: The Record