A bipartisan pair of senators has introduced a bill that would create voluntary cybersecurity best practices for the U.S. telecommunications industry, along with an optional certification program. The Telecommunications Cybersecurity and Resilience Act, sponsored by Sens. Mark Warner (D-VA) and Ted Cruz (R-TX), would establish a working group within the National Telecommunications and Information Administration to develop the guidelines.
The legislation is a direct response to the Salt Typhoon intrusions, which the article describes as the worst telecom hack in U.S. history. Chinese government-backed hackers gained broad access to at least nine major carriers, including Verizon, AT&T and Lumen, and stole call detail records and, in some cases, intercepted audio and text. The attackers reportedly targeted around 150 high-profile individuals, including President Donald Trump, Vice President JD Vance, and other senior officials.
The bill arrives about a year after Republican lawmakers and regulators scrapped mandatory telecom security rules that had been introduced after the hacks. Those rules would have required companies to secure their networks and file annual certifications. Warner and other Democrats have argued that voluntary measures without penalties will leave networks vulnerable, while Cruz said the new approach avoids rigid federal mandates that quickly become outdated.
Under the proposed bill, the working group would include telecoms, suppliers, cybersecurity experts and federal officials. The best practices would be reviewed every two years and updated after major incidents, and the group would send an annual report to Congress. A voluntary certification process would let companies have an independent third party verify that they have implemented the practices.