Warner and Cruz's Salt Typhoon bill keeps telecom security voluntary for carriers
Sens. Mark Warner and Ted Cruz filed a bill giving NTIA 18 months to write voluntary telecom security practices, with an optional third-party certification. Adopting them stays each carrier's choice, nearly a year after the mandatory post-breach rules were scrapped.
The Watch · Security desk
What happened
- Sens. Mark Warner (D-VA) and Ted Cruz (R-TX) introduced the Telecommunications Cybersecurity and Resilience Act on Thursday in response to the Salt Typhoon intrusions.
- The bill sets up a working group inside NTIA, made up of carriers, suppliers, security experts and federal officials, to write voluntary best practices for the telecom sector.
- Nearly a year earlier, Republican officials scrapped post-Salt Typhoon rules that would have required carriers to secure their networks and certify a risk management plan every year.
Why it matters
- Who's exposed exposure Federal officials say Salt Typhoon is still a threat. During the drafting window and after it, each carrier's defenses against the group are whatever that carrier chooses to deploy.
- What doesn't add up contradiction When the mandatory rules were scrapped, Warner warned that voluntary codes with no penalties would let the Chinese government keep hacking unabated. The bill he now co-sponsors is voluntary.
- Who has to decide decision Enforcement falls to enterprise and government buyers of carrier service. Any buyer that wants proof a carrier follows the practices will have to ask it for the certificate.
Next story · Invest · Oct 8
SpaceX agrees to buy Grain Management's 800 MHz band to push Starlink Mobile through wallsConfirmed26 publishers
The controls that would have raised Salt Typhoon's costs are already written down, and carriers can deploy them today. Biden administration officials reported that the campaign would have been "far riskier, harder and costlier for the Chinese" if carriers had kept minimum practices: secure configurations, up-to-date patching, network architecture that monitors for anomalous behavior, and multi-factor authentication on administrator accounts [18].
The campaign ran for years. Chinese government-backed hackers held access to at least nine US carriers, including Verizon, AT&T and Lumen [8]. They took call detail records, which show whom a person spoke to, when, for how long and where they were. In some cases they intercepted audio and text [9]. According to The Record, the hackers reportedly focused on 150 high-profile targets, including President Donald Trump and Vice President JD Vance [10].
Salt Typhoon became public nearly two years ago [13]. The bill's clock starts only at enactment. The working group would have 18 months from passage to publish its practices [3], then review them every two years or after a major incident [4]. If the group uses its full window, the first scheduled revision lands 42 months after the bill becomes law [20]. According to the legislative text CyberScoop quoted, the practices would "focus solely on identifying, responding to, mitigating, preventing, and remediating cybersecurity incidents and vulnerabilities" and follow existing federal risk management frameworks [16]. The group would also report to Congress each year [11].
Both sponsors leave adoption to the carriers. "If telecommunications companies adopt cybersecurity best practices, our networks can be more resilient," Warner said [14]. He also said: "This bipartisan legislation is a good start in protecting our nation and strengthening the communications networks Americans rely on every day" [17]. Cruz chairs the Senate Commerce panel. Warner is the top Democrat on the Intelligence Committee [12]. "This sensible bill brings government and industry together to develop voluntary, telecom-specific cybersecurity best practices rather than adopting rigid federal mandates that quickly become outdated," Cruz said [15].
The certification is the one output an outsider could check. An independent assessor would certify that a company had implemented and maintained the practices, but only for companies that choose to seek it [5]. Published descriptions of the bill include no penalty for a carrier that turns down the practices or the assessment [1].
What to watch
- Whether the Senate Commerce panel Cruz chairs moves the bill, and whether amendments tie the certification to federal procurement or add penalties.
- Whether any breached carrier, including Verizon, AT&T or Lumen, commits to seeking the third-party certification once the practices exist.
- New federal advisories on Salt Typhoon activity inside US carrier networks during the 18-month drafting window.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence72
- Adoption
- Not scored
- Hype gap0
- Incentives30
- Confidence68
Perspective Coverage
3 publishers- Builder
- Builder 18%
- Operator
- Operator 57%
- Investor
- Investor 25%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Sens. Mark Warner (D-VA) and Ted Cruz (R-TX) introduced the Telecommunications Cybersecurity and Resilience Act on Thursday, citing the Salt Typhoon attacks; the bill would create voluntary cybersecurity best practices for the telecommunications industry and an optional certification companies could obtain.
- [2]
The bill creates a Telecommunications Cybersecurity Working Group within NTIA that would bring together telecoms, suppliers, cybersecurity experts and federal officials to create voluntary best practices.
- [3]
The working group would develop voluntary industry-wide best practices within 18 months of passage of the bill.
- [4]
The best practices would be reviewed for updates every two years or after major incidents.
- [5]
The working group would create a voluntary certification process in which an independent third-party assessor certifies that a company has implemented and maintained the best practices; companies could choose to use it.
- [6]
Nearly one year before the bill's introduction, Republican officials scrapped telecom regulations passed after Salt Typhoon; those rules would have mandated that telecoms better secure their networks and submit annual certifications attesting to the creation of a cybersecurity risk management plan.
- [7]
Warner and other Democratic officials criticized the removal of the rules, warning that voluntary codes with no penalties would allow the Chinese government to continue its hacking campaigns unabated.
- [8]
Chinese government-backed hackers gained broad, years-long access to at least nine US telecommunications giants, including Verizon, AT&T and Lumen.
- [9]
The intruders gained access to Call Detail Records, showing whom a person spoke to, when, for how long and where they were; in some cases they intercepted audio and text.
- [10]
The hackers reportedly focused on gathering information about 150 high-profile targets including President Donald Trump and Vice President JD Vance.
- [11]
The working group would send an annual report to Congress about its work.
- [12]
Warner is the top Democrat on the Intelligence Committee; Cruz is the GOP chairman of the Senate Commerce panel.
- [13]
The bill comes nearly two years after the Salt Typhoon campaign was made public.
- [14]
"If telecommunications companies adopt cybersecurity best practices, our networks can be more resilient." (Warner)
- [15]
"This sensible bill brings government and industry together to develop voluntary, telecom-specific cybersecurity best practices rather than adopting rigid federal mandates that quickly become outdated." (Cruz)
- [16]
According to the legislation, the best practices would "focus solely on identifying, responding to, mitigating, preventing, and remediating cybersecurity incidents and vulnerabilities" and be in line with existing federal cybersecurity risk management frameworks.
- [17]
"This bipartisan legislation is a good start in protecting our nation and strengthening the communications networks Americans rely on every day." (Warner)
- [18]
Reports from Biden administration officials said the Salt Typhoon campaign would have been "far riskier, harder and costlier for the Chinese" if telecoms had minimum practices such as secure configurations, up-to-date patching, architecting to monitor for anomalous behavior, and managing administrator accounts with multi-factor authentication.
- [19]
Federal officials have repeatedly warned that Salt Typhoon remains a threat to this day.
- [20]
If the working group uses its full 18-month drafting window and no major incident triggers an earlier review, the first scheduled two-year review of the practices falls 42 months after enactment.
Sources
3 independent publishers whose own reporting we read for this story.
- cyberscoop.comBipartisan Senate leaders introduce bill to bolster telecom cybersecurity in response to Salt Typhoon hacks
1 article · September 24, 2026
- scworld.comSenate leaders introduce bill for voluntary telecom cybersecurity practices
1 article · September 25, 2026
- therecord.mediaLawmakers introduce bill for voluntary telecom cyber rules after Salt Typhoon hacks
1 article · September 24, 2026
Topics and entities
Topics
- Telecommunications cybersecurity
- US cybersecurity legislation
Entities
- US Federal Communications Commission
- National Telecommunications and Information Administration
- Telecommunications Cybersecurity and Resilience Act
- AT&T
- Mark Warner
- Ted Cruz
- Salt Typhoon
- Lumen
- Verizon