The FCC’s initial response to the Salt Typhoon telecoms hacking is no longer in force. In January 2025, the agency issued a ruling interpreting a federal wiretap law to require carriers to secure their networks and proposed broader cybersecurity rules. The FCC later rescinded that ruling and withdrew the proposal. Its stated direction is now collaboration with providers and targeted action under authorities it considers clear—not the broad CALEA-based duty announced in January.
What U.S. investigators said the hackers accessed
On November 13, 2024, the FBI and CISA said their investigation had identified a broad cyber-espionage campaign by actors they described as affiliated with the People’s Republic of China (PRC). They reported that the access enabled theft of customer call-record data, access to private communications for a limited number of people—primarily people involved in government or political activity—and copying of some information subject to U.S. law-enforcement requests made under court orders. The agencies said their understanding would grow as the investigation continued. FBI and CISA joint statement, November 13, 2024.
An April 2025 FBI/IC3 alert described the activity as a broad global campaign and repeated those categories of accessed or stolen information. It directed communications providers to December 2024 guidance on hardening infrastructure and asked for tips about the people behind the activity. Neither the joint statement nor the alert establishes a definitive count of affected people or organizations, and neither says that every customer’s communications were accessed. FBI/IC3 alert, April 2025.
What the FCC announced in January 2025
On January 16, 2025, FCC Chairwoman Jessica Rosenworcel announced two actions in response to Salt Typhoon: a Declaratory Ruling interpreting the Communications Assistance for Law Enforcement Act (CALEA), and a Notice of Proposed Rulemaking (NPRM) proposing additional requirements. FCC announcement, January 16, 2025.
#1 Best Overall
- Compact and Efficient Design: The FortiGate 40F is designed for small to mid-sized businesses and enterprise branch offices, featuring a compact, fanless desktop form factor that ensures quiet operation and minimizes space usage.
- Robust Connectivity Options: Equipped with 5 GE RJ45 ports, including 1 WAN port and 4 internal ports, this model provides essential connectivity and flexibility for various network configurations in a small-scale environment.
- High-Performance Security: Offers up to 1 Gbps IPS throughput and 600 Mbps threat protection throughput, using Fortinet’s purpose-built security processor technology to deliver industry-leading performance and protection for SSL encrypted traffic.
- Advanced Threat Protection: Integrated with Fortinet’s AI-powered FortiGuard Labs, the FortiGate 40F offers comprehensive cybersecurity, identifying and mitigating both known and unknown threats to maintain robust security across your network.
- Simplified Management and Deployment: Features a user-friendly management console that provides comprehensive network automation and visibility, coupled with Zero Touch Integration with Fortinet’s Security Fabric for easy deployment.
The CALEA ruling
The ruling interpreted section 105 of CALEA as requiring telecommunications carriers to secure their networks against unlawful access to or interception of communications. The FCC said that obligation applied both to network-management practices and to the equipment carriers use. The ruling described basic security practices including role-based access controls, replacing default passwords, minimum password-strength rules, multifactor authentication, and patching known vulnerabilities. It said failing to patch known vulnerabilities—or to use practices known to be necessary in response to identified exploits—could fall short of the duty. FCC 25-9, Declaratory Ruling, January 2025.
Those practices were described in the January ruling; they should not be read as a currently effective mandate imposed by that ruling, because the FCC later rescinded it.
Rank #2
- HARDWARE PLUS SECURITY SERVICES: FortiGate-60F Firewall Appliance bundled with 1 year of FortiCare Premium and FortiGuard Unified Threat Protection.
- UNIFIED THREAT PROTECTION (UTP): Secures against advanced online threats with comprehensive web filtering and anti-botnet technologies.
- OPTIMIZED FOR MEDIUM-SIZED BUSINESSES: Tailored for businesses needing robust security without the infrastructure of larger enterprises.
- RELIABLE CUSTOMER SUPPORT: FortiCare Premium ensures high-quality support and service continuity.
- EFFECTIVE PROTECTION: Employs advanced filtering technologies to safeguard against sophisticated threats.
The proposed rulemaking
The NPRM sought comment on requirements such as cybersecurity and supply-chain risk-management plans, along with reasonable measures to protect the confidentiality, integrity, and availability of systems and services that could affect communications service. It did not become an operative rule. The FCC’s later order says the NPRM was never published in the Federal Register, so no comment period began, and that the agency withdrew it. FCC 25-9, January 2025; FCC reconsideration order.
Why the FCC rescinded the ruling and withdrew the proposal
In a later reconsideration order, the FCC rescinded FCC 25-9 and withdrew its NPRM. The Commission’s explanation was that the January ruling read CALEA section 105 too broadly and asserted enforceable duties without first adopting implementing rules. It also argued that the ruling treated networks too broadly, left carriers with vague obligations, and imposed inflexible requirements without accounting for providers’ differing risks, size, or organizational posture. These are the FCC’s stated legal and policy reasons for reversing course, not an independently adjudicated holding. FCC reconsideration order.
Rank #3
- 【Up to 1100 Mbps VPN Speed 】 Hardware-accelerated WireGuard and OpenVPN-DCO deliver up to 1100 Mbps VPN throughput, over 3× faster than Brume 2 for smooth remote access and file transfers.
- 【Three 2.5G Ports & Multi-WAN】Tri-port 2.5GbE design with flexible WAN LAN configuration supports multi-gigabit wired setups, dual-ISP Multi-WAN and failover to keep home and SOHO networks online.
- 【Stealth VPN Obfuscation】VPN obfuscation disguises VPN traffic as regular HTTPS, helping you evade blocking, bypass restrictive networks and maintain stable, private connections.
- 【DPI protection】Deep Packet Inspection with visual dashboards blocks adult/gambling/malicious sites, while SQM and QoS prioritize gaming, calls, and video when bandwidth is tight
- 【OpenWrt & USB 3.0 Expansion】OpenWrt with 1GB DDR4 and 8GB eMMC lets you install plugins and build VPN, ad-blocking or NAS, while USB 3.0 Type‑C connects high-speed storage or 4G/5G dongles
The reversal means the January ruling itself is not a current FCC requirement. It does not mean the FCC declared telecom cybersecurity unimportant or that all other cybersecurity obligations disappeared; the order describes a different approach, using collaboration and measures under authorities the Commission considers clear.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How the FCC says it will pursue telecom security instead
The later order favored coordination with providers and other federal agencies, along with targeted regulation where the FCC said its authority was clear. It cited threat-information sharing and provider steps described by industry petitioners, including faster patching, access-control updates, reviews of remote-access configurations, threat hunting, disabling unnecessary outbound connections, and stronger obligations for third-party vendors. The order discusses these as commitments and representations by industry petitioners, not as a universal new FCC rule applying to every carrier. FCC reconsideration order.
Rank #4
- Runs UniFi Network for full-stack network management
- Manages 30+ UniFi Network devices and 300+ clients
- 1 Gbps routing with IDS/IPS
- Multi-WAN load balancing
- 0.96" LCM status display
The FCC also pointed to separate measures: cybersecurity risk-management plans for submarine-cable licensees and rules concerning foreign-adversary-controlled test laboratories in the equipment-authorization program. These are distinct proceedings, not replacements enacted by the rescinded Salt Typhoon ruling. FCC reconsideration order.
Quick Recap
January’s approach versus the FCC’s later position
| Issue | January 2025 actions | Later FCC position |
|---|---|---|
| Legal mechanism | Interpretation of CALEA section 105, plus a proposed rulemaking. | Ruling rescinded and NPRM withdrawn; the FCC favored collaboration and targeted action under other authorities. |
| Scope | Broad security duty described for carriers, with additional proposed cybersecurity and supply-chain planning requirements. | Commission said measures should be targeted and tailored to authority, risk, and provider circumstances. |
| Procedural status | Declaratory Ruling issued; NPRM did not start a comment period because it was not published in the Federal Register. | FCC rescinded the ruling and withdrew the NPRM. |
| Accountability | The ruling described an enforceable duty; the NPRM proposed additional requirements but did not become a rule. | Order cited coordination and provider-reported measures, as well as separate targeted proceedings. |
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →
