Cybersecurity Policy Report, FCC Urged to Reverse CALEA Cybersecurity Action, (Feb 20, 2025)

By Lynn Stanton

CTIA, NCTA, and USTelecom have asked the FCC to reconsider the cybersecurity declaratory ruling adopted last month on a party-line basis near the end of then Chairwoman Jessica Rosenworcel’s tenure.

The declaratory ruling held that section 105 of the Communications Assistance for Law Enforcement Act (CALEA) of 1994 “affirmatively requires telecommunications carriers to secure their networks from unlawful access or interception of communications” (CPR, Jan. 17).

The declaratory ruling in PS docket 22-329 cited the Chinese cyber espionage attack on U.S. carriers known as Salt Typhoon in explaining the need for its action, as well as the Flax Typhoon attack on routers and other consumer devices.

In their petition for reconsideration posted yesterday in the FCC’s electronic comment filing system, CTIA, NCTA, and USTelecom said their members “were early adopters of cybersecurity risk management practices, collaborate on these issues with government agencies, and participate in public-private partnerships. These partnerships facilitate the sharing of critical information about potential cyber vulnerabilities and help keep our nation’s networks and services secure and resilient.”

The declaratory ruling, “adopted in the waning days of the prior administration without any opportunity for public comment, supplants this longstanding collaborative approach. It adopts an ‘uncoordinated[] and counterproductive’ policy based on an expansive reading of the Communications Assistance for Law Enforcement Act (‘CALEA’) that imposes onerous network-wide duties on covered entities,” they said, quoting from then Commissioner, now Chairman, Brendan Carr’s dissenting statement on the FCC’s action.

“This interpretation is wholly inconsistent with CALEA’s text, structure, and purpose. Congress did not intend for CALEA to evolve into a general cybersecurity statute over three decades after its enactment. Instead, the plain meaning of CALEA merely ensures that providers have the ‘assistance capability’ necessary to allow law enforcement to conduct lawful interceptions of communications,” they said.

The trade groups said, “The Declaratory Ruling acknowledges that ‘CALEA was intended to preserve the ability of law enforcement agencies to conduct electronic surveillance.’ But the FCC turns this limited statutory purpose on its head by reading Section 105 as a font of unbounded rulemaking authority. It stretches the statute beyond the supervision of officers and employees facilitating lawful intercepts to imposing an affirmative duty to ‘prevent all incidents of unauthorized interception of communications. …’”

“The FCC has not only exceeded its authority—it has produced unreasoned and unsupported conclusions that cannot survive arbitrary and capricious review under the Administrative Procedure Act. The Associations respectfully request that the FCC reconsider and rescind the Declaratory Ruling,” they said.

News: FederalLegislation DataSecurity