In October 2024, the Wall Street Journal reported that Chinese government hackers had breached multiple major US telecommunications companies, including Verizon, AT&T, and Lumen (formerly CenturyLink). The breach was attributed to a threat actor tracked as "Salt Typhoon" - a Chinese Ministry of State Security (MSS) affiliated group. The hackers had accessed the companies' systems for months or potentially years. But this was not a breach of customer data in the conventional sense. Salt Typhoon had accessed the systems that US carriers use to comply with federal law enforcement wiretap orders - the same infrastructure used by the FBI and other agencies to conduct court-authorized surveillance of criminal suspects.

The implications were immediate and severe. Chinese intelligence had potentially accessed ongoing federal wiretap targets, including investigations unrelated to China. The FBI itself may have been compromised in this way. The attackers could see who the FBI was surveilling, read the content of intercepted communications, and potentially identify intelligence sources and methods. Senator Mark Warner, chairman of the Senate Intelligence Committee, described the breach as "the worst telecom hack in our nation's history" and "far worse than people realize."

CALEA and the Built-In Wiretap Infrastructure

The breach's severity stems from its specific target: the infrastructure mandated by the Communications Assistance for Law Enforcement Act (CALEA), passed by Congress in 1994. CALEA requires telecommunications carriers to build their systems with lawful interception capability - essentially, a built-in wiretap interface that allows law enforcement to access call content and metadata when presented with a court order. Every major US carrier must maintain this capability. The carriers build specific systems to manage law enforcement requests and provide access.

Salt Typhoon accessed these CALEA-compliance systems. This gave them the ability to see which accounts were subject to active law enforcement wiretaps, potentially read the content of intercepted communications, and access metadata about interception targets. This is not a theoretical risk - it means Chinese intelligence had visibility into US law enforcement's active surveillance operations, including potentially surveillance of Chinese government agents and assets in the United States.

Security researchers and civil liberties organizations had warned for decades that mandated wiretap infrastructure created a systemic vulnerability: any access mechanism designed for law enforcement is also a potential access point for adversaries. The CALEA architecture concentrates lawful interception capability into specific, network-accessible systems. If those systems are compromised, the attacker inherits law enforcement's access. This theoretical risk materialized in the Salt Typhoon breach.

[TECHNICAL NOTE]
Salt Typhoon's techniques in the telecom breaches appeared to involve exploiting vulnerabilities in network edge equipment - specifically, Cisco network devices including routers and switches. Cisco issued security advisories in late 2024 related to vulnerabilities being actively exploited by state-sponsored actors; Salt Typhoon exploited IOS XE vulnerabilities (CVE-2023-20198 and CVE-2023-20273) to gain initial foothold on carrier infrastructure. From network infrastructure access, the attackers moved to the management planes of carrier networks, ultimately reaching the systems used for lawful intercept processing. The group also accessed systems containing records of calls to and from specific phone numbers - call records and metadata - without necessarily accessing the content of those calls, providing a broader intelligence picture of communication patterns. The duration of access was significant: the FBI and CISA believed Salt Typhoon had maintained persistent access to some carrier networks for 18 months or more before detection.

Presidential Campaign Targeting

Beyond the law enforcement wiretap access, Salt Typhoon also targeted specific political figures. The breach included access to the phones and communications associated with the 2024 presidential campaigns of Donald Trump and Kamala Harris, along with Senate Majority Leader Chuck Schumer, Senate Majority Leader Mitch McConnell, and other senior political figures. These were not mass surveillance actions - they were targeted collection against specific individuals of intelligence value to China. Trump campaign associates Rudy Giuliani and others had their communications intercepted.

The targeting of presidential campaigns brought the breach into direct contact with US electoral security concerns. The FBI briefed both campaigns after identifying the targeting. The specific intelligence value to China included understanding the positions likely future US administrations would take on China policy, Taiwan, trade, and other bilateral issues.

The response from US officials included public warnings to Americans to use end-to-end encrypted communications - specifically, apps like Signal - rather than standard phone calls and SMS messages. This was a remarkable public acknowledgment: US government officials were explicitly recommending that Americans use encrypted messaging to protect themselves from a Chinese intelligence operation that had penetrated US carrier infrastructure. The FBI and CISA published guidance in December 2024 recommending encrypted messaging for sensitive communications.

[WARNING]
Salt Typhoon is part of a broader pattern of Chinese state-sponsored intrusions into US critical infrastructure attributed to Typhoon-named groups. Volt Typhoon (a separate group) conducted persistent pre-positioning operations against US critical infrastructure including water utilities, power grids, and transportation systems - positioning for potential disruptive attacks in the event of a conflict over Taiwan, not intelligence collection. Salt Typhoon was intelligence-collection focused. Flax Typhoon targeted Taiwan-focused organizations and Taiwanese critical infrastructure. The pattern suggests a mature, multifaceted Chinese cyber strategy: pre-positioning (Volt Typhoon) for potential wartime disruption; intelligence collection (Salt Typhoon) for strategic awareness; and targeted espionage (various other groups) against defense contractors, think tanks, and policy organizations. The scale of Chinese cyber operations against US infrastructure prompted Congress to consider legislation requiring vendors to notify CISA of critical network access and mandating stronger security for CALEA-compliance systems specifically.

The Encryption Debate Redux

The Salt Typhoon breach reignited a debate that had been ongoing since the 1990s Clipper Chip controversy: whether governments should have mandated access to encrypted communications. Law enforcement and intelligence agencies in the US, UK, Australia, and other "Five Eyes" countries have periodically argued for "lawful access" requirements that would require tech companies to build backdoors into encrypted messaging systems. End-to-end encrypted apps like Signal, WhatsApp, and iMessage specifically do not maintain the ability to decrypt messages on behalf of law enforcement.

The Salt Typhoon breach was a concrete demonstration of why mandated backdoors are dangerous. CALEA required carriers to build lawful access infrastructure. That infrastructure was compromised by China. Cryptographers and security researchers who argued against mandatory backdoors - arguing that any access mechanism for law enforcement would eventually be discovered and used by adversaries - had their position validated by Salt Typhoon. The breach accelerated the US government's own recommendation that citizens use end-to-end encrypted apps that cannot be accessed via CALEA-style infrastructure.

[IOC]
Salt Typhoon (also tracked as Earth Estries, GhostEmperor, FamousSparrow by different vendors) targeting indicators: the group has used a custom backdoor called "GhostSpider" and previously used "Demodex" rootkit (kernel-mode persistence on Windows). Initial access in telecom breaches via Cisco IOS XE vulnerabilities (CVE-2023-20198: privilege escalation; CVE-2023-20273: command injection). Salt Typhoon has also used living-off-the-land techniques on carrier infrastructure: using built-in network device capabilities rather than introducing new malware binaries. The group maintained persistence via modified Cisco configuration files and accessed CALEA systems via legitimate administrative credentials after establishing initial foothold. Detection on carrier network infrastructure requires analysis of configuration changes, unusual administrative session patterns, and traffic to unexpected external IPs from management interfaces. Cisco issued patch guidance and detection tools; carriers were instructed to audit all administrative credentials and session logs. FBI/CISA advisory "Enhanced Visibility and Hardening Guidance for Communications Infrastructure" published December 3, 2024.