Salt Typhoon and the Carrier You Can't Fully Trust
On November 13, the FBI and CISA confirmed what had been reported in pieces since early autumn. Actors affiliated with the People’s Republic of China had compromised networks at multiple U.S. telecommunications providers. The joint statement described three kinds of access: theft of customer call records, compromise of the private communications of a limited number of people in government and political activity, and copying of information subject to U.S. law enforcement requests under court order. The industry has been calling the activity Salt Typhoon.
Most enterprises will never be the direct target of an operation like this. Many of them are still affected by it, because their executives, legal teams and deal teams use the same carriers, the same voice and SMS networks, and in many cases the same assumption: that the carrier’s network is a safe place for sensitive conversations.
What the access means in practice
Call detail records show who talked to whom, when and for how long. For an intelligence service, that metadata is often more useful than content. It maps relationships, shows when a negotiation heats up, and identifies who in an organization is worth targeting next.
The lawful-intercept angle is the part that should change how security leaders think. Systems built so that carriers can comply with court orders are, by design, positioned to see communications. When those systems are reachable by an adversary, the carrier’s own compliance infrastructure becomes a collection platform.
None of this requires the adversary to touch an enterprise network. That’s why it rarely appears in an enterprise risk register.
Three questions worth asking this quarter
Which conversations rely on carrier-grade privacy? Most organizations have never inventoried this. Start with the groups that handle material non-public information: M&A, legal, executive leadership, investor relations, and anyone negotiating with a government. Find out how they talk when it matters. In many organizations the answer is a mobile phone call or a text message, because it’s quick.
Where does SMS still carry security weight? One-time codes sent by text message travel over the same networks. Account recovery flows that fall back to SMS deserve a look, especially for administrators and finance staff. Phishing-resistant authentication (FIDO2 security keys or platform passkeys) removes the carrier from the authentication path entirely.
Do sensitive groups have an approved, encrypted alternative they actually use? End-to-end encrypted messaging and calling tools exist and are easy to deploy. The gap is usually adoption and policy: retention requirements, records obligations, and whether the approved tool is on the device people carry. Legal and compliance need to be part of this decision early, because retention rules apply to the conversations that most need protection.
Network equipment is the common thread
The intrusions reportedly involved compromise of carrier network infrastructure, including routers. That pattern isn’t limited to telecommunications. Over the past year, the most damaging initial access across sectors has come through internet-facing network and security appliances: VPN concentrators, firewalls and management interfaces.
Enterprises should apply the same scrutiny to their own edge that they now hope carriers are applying to theirs:
- Keep an accurate inventory of every internet-facing management interface, and close the ones that don’t need to be reachable.
- Forward appliance logs somewhere the appliance can’t alter them.
- Treat firmware updates on edge devices with the urgency usually reserved for domain controllers.
- Check configuration integrity on a regular schedule as well as after advisories.
A reasonable posture going forward
Carriers will spend the coming months on remediation, and public reporting will continue. Enterprises don’t need to wait for that work to finish. The adjustments above are modest and mostly involve deciding which communications deserve protection that doesn’t depend on the network operator.
We’ll update this note as federal guidance for communications infrastructure is published.