US Unveils Sweeping Cybersecurity Measures Over Alleged China-backed Salt Typhoon Campaign

US President Joe Biden's administration on Friday announced sweeping cybersecurity measures following revelations about Salt Typhoon, an alleged China-backed hacking campaign that infiltrated major US telecommunications companies.

The new steps include mandatory federal regulations for telecoms cybersecurity, enhanced guidance for securing networks and strengthened requirements for healthcare data protection.

Deputy national security adviser Anne Neuberger stressed a need for urgent reforms to prevent future breaches.

"We wouldn't leave our homes or offices unlocked, yet our critical infrastructure often lacks the basic cybersecurity practices necessary to make it more defensible," she said.

The US intelligence community believes Salt Typhoon has been active since 2022 and exploited vulnerabilities in telecom infrastructure to access sensitive data, including geolocation, phone call records and text messages.

To date, nine telecoms companies have been identified as targets. Neuberger cited one case in which a single administrator account controlled access to more than 100,000 routers, giving hackers unfettered control.

While the exact number of affected customers is not yet known, investigations thus far have shown that "a large number of individuals were geolocated in the Washington, DC and Virginia area", she said.

The goal was to identify which phones were linked to government targets and then conduct espionage and intelligence gathering on text messages and calls.

"But they were very careful about their techniques," Neuberger explained. "They erase logs. In many cases, companies were also not keeping adequate logs. So there are details that we will never know regarding the scope and scale of this."

"That's why we're looking forward and saying, 'let's lock down our infrastructure', and frankly, let's hold the Chinese accountable for this."

The Chinese embassy in Washington on Friday pushed back against the allegations of a hacking campaign, with spokesperson Liu Pengyu calling them "smear attacks" made without evidence.

Liu referenced Chinese President Xi Jinping's direct denial of cyberattack claims during his meeting with Biden in Lima during the APEC summit, asserting that "China is itself a target of international cyber intrusions."

The embassy statement alluded to technical challenges in attributing cyber incidents, urging "relevant parties" to take a more "professional and responsible attitude" when making such accusations.

"The US needs to stop using cybersecurity to smear and slander China and stop spreading all kinds of disinformation about the so-called Chinese hacking threats," Liu said.

Meanwhile, the Federal Communications Commission, a US government agency, has proposed regulations requiring telecom companies to adopt minimum cybersecurity standards. The rules, set for a vote by mid-January, aim to close long-standing gaps.

"Without defensible networks, attackers will continue to exploit weaknesses, threatening national security and public trust," Neuberger said.

Updated technical guidance has also been released to help telecom providers harden their defences, focusing on network segmentation and configuration management to limit the impact of breaches.

"By segmenting the network, even if attackers gain access, their movement can be controlled and contained," she added.

Beyond telecommunications, the US Department of Health and Human Services plans to revise the Health Insurance Portability and Accountability Act Security Rule for the first time since 2013.

Established in 1996, HIPAA sets nationwide standards for protecting patients' medical information. The law requires healthcare providers, insurance companies and their business partners to safeguard both paper and electronic health records while laying forth strict rules about how this sensitive data can be shared.

The updates will require entities handling healthcare data to implement encryption and stronger monitoring systems.

In highlighting the urgency of the revision, Neuberger cited a 1,002 per cent increase in Americans affected by healthcare data breaches over the past five years.

"The cost of not acting is not only high but endangers critical infrastructure and patient safety," she said. Recent breaches have cost organisations hundreds of millions of dollars in recovery expenses, Neuberger added.