Congress says regulatory gaps let Chinese hackers into US telecom networks

A congressional investigation has found that regulatory blind spots in how US telecommunications companies connect to data centers and related infrastructure may have created an entry point exploited by the Chinese hacking group Salt Typhoon.

Bloomberg reported Tuesday, citing a report released by the House Select Committee on China, that persistent connection pathways existed within US telecom networks leading to equipment or data centers potentially linked to three Chinese state-owned carriers banned from operating in the United States.

The investigation found that despite the Federal Communications Commission barring China Telecom, China Mobile and China Unicom from directly connecting to US communications networks, the three companies continued to maintain physical footholds inside the country by exploiting gaps in the regulations.

The committee said the FCC never required those companies to remove their equipment from third-party data centers, nor did it impose any obligation on them to stop providing internet management services from those facilities.

"Even after federal regulators determined that these Chinese state-owned carriers were vulnerable to the influence of the Chinese government and stripped them of their authorization to provide telecommunications services in the United States, they remained deeply embedded in the American internet ecosystem," the report said.

US intelligence agencies announced last year that Salt Typhoon had infiltrated the systems of multiple American telecom companies and conducted a broad cyber-espionage campaign targeting the phones of politicians, including then-presidential candidate Donald Trump.

The hackers gained access to the networks by exploiting vulnerabilities in infrastructure including communications equipment made by US cybersecurity firm Fortinet and routers from networking company Cisco Systems.

The committee's report described Salt Typhoon's attack as "an attempt to undermine the fundamental architecture of carrier networks."

At the heart of the problem are what the report calls "secondary connections" — indirect links that tie telecoms to a broader information ecosystem while falling outside the jurisdiction of federal regulators.

The report, the product of more than a year of investigation by the committee, concluded that US telecom companies were unaware of the cybersecurity risks posed by these connections.

Bloomberg noted that the findings are significant because the relationship between telecoms and data centers is not subject to direct government regulation.

The US government currently prohibits only the use of network equipment made by certain Chinese companies within carriers' own domestic networks. Washington has already committed billions of dollars to projects aimed at removing components from Chinese manufacturers, including Huawei.

According to a person familiar with the matter, the FCC is preparing an order that would ban the use of Chinese-made data center components in response to these concerns.