The United States has launched its first official response to a significant cyberattack by China on American telecommunications networks, underscoring the escalating cyber tensions between the two global powers. The Biden administration’s recent move to target China Telecom Americas highlights both the severity of the breach and the growing risks to national security posed by such incursions.

The Hack: A Threat to Critical Infrastructure

Earlier this year, the Chinese state-backed hacking group known as Salt Typhoon orchestrated a sophisticated attack on U.S. telecom companies, including Verizon, AT&T, and Lumen Technologies. According to U.S. officials, this breach exposed sensitive data, including a comprehensive list of phone numbers monitored by the Justice Department’s “lawful intercept” system. This system places wiretaps on individuals suspected of criminal activity or espionage under court authorization. While there is no direct evidence that the hackers intercepted calls, they likely combined phone numbers with geolocation data, creating a detailed intelligence roadmap.

“The penetration almost certainly gave China a road map to discover which of China’s spies the United States has identified and which it has missed,” one senior official noted. Such a breach could allow China to thwart American counterintelligence efforts and potentially compromise ongoing investigations. The implications extend beyond this single incident, painting a troubling picture of vulnerabilities in critical American infrastructure.

The breach also exposed parts of the phone network that could have allowed access to voice calls made over unencrypted lines. These vulnerabilities potentially included calls made by high-ranking officials, such as President Trump and Vice President-elect JD Vance. However, investigators remain uncertain about whether the hackers exploited this access.

This cyberattack is part of a broader pattern of Chinese incursions into American critical infrastructure, including water treatment facilities and the power grid. Taken together, these efforts represent some of the most severe assaults on U.S. infrastructure in the digital age. General Timothy D. Haugh, the director of the National Security Agency and commander of U.S. Cyber Command, commented, “If I look at today, the PRC is not deterred.”

National Security Implications

The breach raises alarming questions about the security of America’s digital and physical infrastructure. Telecommunications networks are integral to both civilian and government operations. They underpin communication for everything from law enforcement to military activities. A successful infiltration, as demonstrated by Salt Typhoon, not only threatens data integrity but also jeopardizes national security by potentially exposing vulnerabilities in surveillance techniques and operations.

Moreover, the breach underscores the risks posed by foreign entities operating within critical U.S. infrastructure. China Telecom Americas, a subsidiary of one of China’s largest communications firms, has long been scrutinized for its ties to Beijing. The Federal Communications Commission (FCC) had already revoked its license to provide phone services in 2021, citing its susceptibility to exploitation by the Chinese government. However, the company retained access to network nodes that allowed it to “peer in” to internet and phone traffic. This access has now come under renewed scrutiny.

Anne Neuberger, the deputy national security adviser for cyber and emerging technologies, explained, “We’ve been taking a hard look at where Chinese technologies are in the United States and asking ourselves the question of, is this an acceptable level of risk? For a number of years, these companies have operated networks and cloud service businesses in the U.S., which involved network equipment that’s co-located with our internet infrastructure. And while in the past we may have viewed this as an acceptable level of risk, that is no longer the case.”

U.S. Retaliation: Symbolic or Substantive?

In response, the Commerce Department issued a preliminary finding last week that China Telecom’s presence in American networks constitutes a national security risk. The company has 30 days to respond before further action is taken. This move, while significant, is largely symbolic. The FCC had already limited the company’s operations, and the financial impact on China Telecom is expected to be minimal.

“The action to block China Telecom from most of its business in the United States did not prevent Volt Typhoon—China’s placement of malicious code in the electric grid and water and gas pipeline networks—or Salt Typhoon,” noted administration officials. The inability to prevent such cyberattacks raises questions about the effectiveness of these measures and the broader U.S. cybersecurity strategy.

The Biden administration’s actions may also signal the beginning of a broader retaliatory strategy. Options on the table include banning Chinese companies from using U.S.-based cloud services and restricting the sale of Chinese-made telecommunications hardware. However, the reliance on Chinese-manufactured equipment complicates these measures, potentially blunting their impact.

The Road Ahead: Escalating Cyber Confrontation

The United States’ response to the hack highlights a critical shift in its cybersecurity posture. General Haugh acknowledged that China remains undeterred in its cyber activities. Incoming officials, such as Representative Mike Waltz, the designated national security adviser for the Trump administration, have signaled a more aggressive stance, advocating for offensive cyber operations to impose “higher costs and consequences” on adversaries.

Waltz argued, “We need to start going on offense and start imposing, I think, higher costs and consequences to private actors and nation-state actors that continue to steal our data, that continue to spy on us, and that, even worse, with the Volt Typhoon penetration, that are literally putting cyber time bombs on our infrastructure, our water systems, our grids, even our ports.”

This shift comes amid growing bipartisan agreement that naming and shaming attackers is insufficient. Lawmakers like Representative Jim Himes have called for proactive measures, including counter-hacking efforts. “We’re not just going to name and shame,” Himes said. “We are going to go into their networks and give as good as we got.” However, such actions carry risks of further escalation, with each side pushing the boundaries of acceptable behavior in cyberspace.

Conclusion

The Salt Typhoon hack is a wake-up call for the United States, exposing critical vulnerabilities in its telecommunications networks and raising the stakes in its cyber rivalry with China. While the Biden administration’s initial response may have limited immediate impact, it sets the stage for a more robust cybersecurity strategy. As the United States grapples with the fallout from this breach, it must balance retaliation with the need to protect its own infrastructure and avoid an unrestrained cyber arms race.

ACZ Editor: The fact that China was able to install such equipment in the first place is a national embarrassment of stupidity. The horse has left the barn, the ship has sailed. Our response is unbelievably weak and the cleanup (in the unlikely event that we generate the will to actually clean up the problem) will be difficult, expensive and take a long time.