How Chinese Hackers ‘Typhoon Salt’ Into US Telecoms – The Diplomat

Diplomat author Mercy Kuo regularly engages subject matter experts, policy practitioners, and strategic thinkers from around the globe for their diverse perspectives on US Asia policy. This conversation with Jonathan Pelson — China technology competition and national security adviser and author of “Wireless Wars: China’s Dangerous Domination of 5G and How We’re Fighting Back” (2021) — is the 438th in “The Trans-Pacific view”. Insight Series.”

Explain how the Chinese hacking group Salt Typhoon compromised the cyber systems of Verizon, AT&T and Lumen Technologies.

If anyone is wondering how a hack of our telecommunications carriers might affect their lives, consider this: New information suggests that China targeted the phones of candidates Trump and Vance and the campaign staff of Vice President Harris. The national security implications should be obvious.

This is an unusual case because of the role played by CALEA (Communication Assistance to Law Enforcement Act) and subsequent federal laws. Imagine if the federal government told every home and business in the country that they could secure their premises however they wanted – locks, video surveillance, alarms, etc. – but should create a single loophole that lets the government in undetected. This is the case in today’s communications. For all the security implemented by our service providers and their customers, the federal government is allowed, with a court order, to access the communications of any person or company in the country. And the system is deliberately designed to prevent the subject of surveillance from knowing it has been breached.

We have created a master key that unlocks all the networks of our country. I’m reminded of the phrase “Never forge a sword so powerful you won’t give it to your worst enemy.” China now has that sword.

Also of concern is that the standards for how carriers maintain the integrity of this “backdoor” aren’t where they should be, making breaches more likely.

Examine the level of damage resulting from the intrusion.

I subscribe to the “one bug” theory. If you turn on the lights and see a cockroach running under the refrigerator, it does not mean that your apartment only has one cockroach.

There is now evidence that the Salt Typhoon hack extends beyond these three companies to other service providers in the Americas and to companies in other parts of the world, including Southeast Asia. But AT&T and Verizon account for the vast majority of connectivity in the country, and Lumen is the leader in providing broadband.

Domestically, China could have accessed information about proprietary technology from US companies, a practice that has been going on for years, and this may just be another successful version of it.

But the bigger concern is that China could have collected data on who is being monitored or investigated for criminal activity or espionage; under the Foreign Intelligence Surveillance Act (FISA), the US government conducts extensive monitoring of the communications of known or suspected spies. If China had access to this program, it would represent an enormous breach in the US counterintelligence community. China would know who is being monitored, what has been learned, and (perhaps more importantly) who is still operating without the knowledge of the US intelligence and law enforcement communities.

Finally, there is the new awareness that our networks can be completely infiltrated by an adversary. I argued in “Wireless Wars” that the real danger of network compromise is not just that communications shut down, but that the services that rely on them do: factory operations, the delivery of health care, the generation and transport of electricity, all what civilization must function.

If you don’t like Google or Facebook controlling our communications, you won’t like the Chinese Communist Party.

Identify the vulnerabilities that Salt Typhoon targeted in US broadband networks.

There are two areas of vulnerability; one is the typical problem with devices or software. There are reports that part of the program included attacks on Cisco servers. This would not be surprising given the central role Cisco plays in enabling the Internet, and China has long focused on infringing Cisco’s intellectual property and breaking security protocols.

But the unique situation here involves this “backdoor” that all communications companies are required by the federal government to include in their networks. The reason is understandable; law enforcement and intelligence agencies want to be able to access private communications if they suspect a crime is being committed. Having such a concentration of activity within a single technical and legal program creates a huge opportunity for failure on a massive scale. The government tends to pursue “fail safe” systems that are critical but extremely well secured. The problem is that when this security is breached, the consequences can be catastrophic.

Analyze the effectiveness of the Assistance in Communication Act for law enforcement.

From an intelligence and enforcement perspective, the law has been very effective. What agency wouldn’t want guaranteed access to every suspect’s private communications?

But the CALEA law (and related FISA) not only requires carriers to make their communications available, it also requires carriers to ensure the confidentiality and security of intercepts; that is, it must ensure that intercepted conversations, emails and other communications are kept secure by the operator.

It’s fine to make that request, but carriers have never been perfect at securing their own networks, especially against state actors. The very creation of these back doors makes their job much harder and makes the costs of failure even higher. If a bad actor can gain access to back doors that are warranted, he has everything.

Assess how US government agencies and telecommunications can prevent future cybersecurity failures.

There are a few areas that need fixing. One key is to move away from “fail safe” and focus on “fail safe” systems. Networks must be designed so that when an unavoidable breach occurs, the damage is not catastrophic.

Of course, private carriers and equipment manufacturers need to up their game. Security has always taken a backseat to revenue and profits, which makes sense for companies that are driven to make a profit for their shareholders, but laws need to set higher standards and enforce stronger security practices. For example, let’s see “encryption by default” become the pattern.

Finally, we must recognize that no defense can protect against all state actors. A strong case can be made that the federal government needs to end its demands that carriers leave their networks open to lawful interception. Some companies, like Apple, value customer security over government access. This may frustrate government agencies, which point out that there is also a degree of anti-competitive market power that can go with such practices, but it also protects the country against the risk of a complete shutdown of all services on the network. Closing that back door would be a high price to pay in terms of counterintelligence, and it increases the risk of anti-competitive practices, but it may be necessary.