Diplomat author Mercy Kuo regularly engages subject matter experts, policy practitioners, and strategic thinkers from around the world for their diverse perspectives on U.S. Asia policy. This conversation with Jonathan Pelson – advisor on technology competition with China and national security and author of “Wireless Wars: China’s Dangerous Domination of 5G and How We’re Fighting Back” (2021) – is the 438th in “The Trans- Pacific View.” Insight Series.

Explain how the Chinese hacking group Salt Typhoon compromised the cyber systems of Verizon, AT&T, and Lumen Technologies.

If anyone is wondering how a hack of our telecommunications carriers could affect their lives, consider this: New intelligence suggests China targeted the phones of candidates Trump and Vance, as well as the vice president’s campaign staff Harris. The national security implications should be obvious.

This is an unusual case, due to the role played by CALEA (Communications Assistance for Law Enforcement Act) and its successor federal laws. Imagine if the federal government told every home and business in the country that they could secure their premises as well as they wanted – deadbolts, video surveillance, alarms, etc. – but that it needed to create a unique workaround option that would allow the government to enter unnoticed. This is the case today in communications. Despite all the security deployed by our service providers and their customers, the federal government is authorized, by court order, to access the communications of any person or business in the country. And the system is deliberately designed to prevent the subject of this surveillance from knowing that they have been violated.

We have created a master key that opens all the networks in our country. I remember the phrase: “Never forge a sword so powerful that you would not give it to your worst enemy.” » China now has this sword.

It’s also concerning that the standards for how carriers maintain the integrity of this “backdoor” are not where they should be, making violations more likely.

Examine the level of damage resulting from penetration.

I subscribe to the “one cockroach” theory. If you turn on the lights and see a cockroach running under the refrigerator, that doesn’t mean your apartment only has one cockroach.

There is now evidence that the Salt Typhoon hack extends beyond these three companies, to other U.S. service providers and companies in other parts of the world, including Southeast Asia. But AT&T and Verizon account for the vast majority of the nation’s connectivity, and Lumen is the leader in providing broadband service.

Domestically, China may have been able to access information about proprietary technologies from American companies, a practice that has been going on for years, and this may well be just another, more successful version of this practical.

But the bigger concern is that China could have collected data on people under surveillance or investigation for criminal activity or espionage; Under the Foreign Intelligence Surveillance Act (FISA), the U.S. government conducts extensive surveillance of the communications of known or suspected spies. If China had access to this program, it would represent a huge breach for the American counterintelligence community. China would know who was being monitored, what had been learned, and (perhaps most importantly) who was still operating without the knowledge of the U.S. intelligence and law enforcement communities.

Finally, there is a new awareness that our networks can be completely infiltrated by an adversary. I argued in “Wireless Wars” that the real danger of network compromise lies not only in the breakdown of communications, but also in the services that depend on it: the operation of factories, the provision of medical care, production and transportation of electricity, everything that civilization must function.

If you don’t like Google or Facebook controlling our communications, you won’t like the Chinese Communist Party doing it.

Identify vulnerabilities targeted by Salt Typhoon in US broadband networks.

There are two areas of vulnerability; one is the typical problem with devices or software. Part of the program reportedly included attacks on Cisco servers. This would not be surprising, given the central role Cisco plays in creating the Internet, and China has long worked to violate Cisco’s intellectual property and decipher its security protocols.

But the unique situation here concerns this “back door” that all communications companies are required by the federal government to include in their networks. The rationale is understandable; Law enforcement and intelligence agencies want to be able to access private communications if they suspect a crime is being committed. The existence of such a concentration of activities under a single technical and legal program creates an enormous opportunity for failure on a large scale. The government tends to favor “fail-safe” systems that are essential but extremely well-secured. The problem is that when this security is breached, you can have catastrophic consequences.

Analyze the effectiveness of the Law Enforcement Communications Assistance Act.

From an intelligence and law enforcement perspective, the law has proven to be very effective. What agency wouldn’t want to guarantee access to every suspect’s private communications?

But the CALEA Act (and associated FISA) not only requires operators to make their communications available, it also requires operators to ensure the confidentiality and security of interceptions; that is, they must ensure that intercepted conversations, emails and other communications are kept secure by the carrier.

It’s all well and good to make this requirement, but operators have never been perfect at securing their own networks, particularly against state actors. The very creation of these backdoors makes their job much more difficult and makes the costs of failure even higher. If a bad actor can access the obligatory backdoors, they have everything.

Evaluate how U.S. government agencies and telecommunications can prevent future cybersecurity breaches.

There are a few areas that need to be addressed. One key is to move away from “fail safe” systems and focus on “fail safe” systems. Networks must be designed so that damage is not catastrophic when an unavoidable breach occurs.

Of course, private carriers and OEMs need to up their game. Safety has always been secondary to revenue and profits, which makes sense for companies wanting shareholder returns, but laws need to set standards. higher standards and enforce stricter safety practices. For example, let’s see “encryption by default” become the model.

Finally, we must recognize that no defense can protect against all state actors. A strong argument can be made that the federal government needs to stop requiring carriers to leave their networks open to lawful interception. Some companies, like Apple, prioritize customer security over government access. This may frustrate government agencies, which point out that a certain degree of anticompetitive market power can accompany such practices, but it also protects the country from the risk of a complete shutdown of all network services. Closing this backdoor would be a high price to pay in terms of counterintelligence, and it would increase the risk of anticompetitive practices, but it might be necessary.