FCC To Rescind Ruling That Said ISPs Are Required To Secure Their Networks

The FCC plans to repeal a Biden-era ruling that required ISPs to secure their networks under the Communications Assistance for Law Enforcement Act, instead relying on voluntary cybersecurity commitments from telecom providers. FCC Chairman Brendan Carr said the ruling 'exceeded the agency's authority and did not present an effective or agile response to the relevant cybersecurity threats.' Carr said the vote scheduled for November 20 comes after 'extensive FCC engagement with carriers' who have taken 'substantial steps... to strengthen their cybersecurity defenses.' Ars Technica reports: The FCC's January 2025 declaratory ruling came in response to attacks by China, including the Salt Typhoon infiltration of major telecom providers such as Verizon and AT&T. The Biden-era FCC found that the Communications Assistance for Law Enforcement Act (CALEA), a 1994 law, 'affirmatively requires telecommunications carriers to secure their networks from unlawful access or interception of communications.'

'The Commission has previously found that section 105 of CALEA creates an affirmative obligation for a telecommunications carrier to avoid the risk that suppliers of untrusted equipment will 'illegally activate interceptions or other forms of surveillance within the carrier's switching premises without its knowledge,'' the January order said. 'With this Declaratory Ruling, we clarify that telecommunications carriers' duties under section 105 of CALEA extend not only to the equipment they choose to use in their networks, but also to how they manage their networks.' A draft of the order that will be voted on in November can be found here (PDF).

Read more of this story at Slashdot.