FCC Issues Order on Security Reviews Ahead of U.S.-China Engagement

The Federal Communications Commission unanimously refused requests from telecommunications carriers seeking to escape regulations aimed at securing U.S. supply chains from foreign adversaries based on the location of their operations and the classification of some equipment as “commercial.”

“We reject USTelecom’s request to remove Network Operations Center (NOC) facilities from the definition of 'Domestic Communications Infrastructure,'” the FCC wrote in a final document to implement new rules for their approval of entities operating in the United States with a certain level of foreign investment or control. 

The commission voted Thursday on the order that lays out a series of questions companies with at least 5% foreign ownership interest will have to answer when applying for FCC licenses. Applicants would need to submit extensive personally identifiable information for all non-U.S. persons with access to submarine cable facilities, among other information.

USTelecom, the main trade association for the telecommunications industry, argued such information would change too quickly and prove challenging to obtain given the laws in some foreign jurisdictions. The group said NOC’s located abroad should not count as domestic critical infrastructure and therefore shouldn’t be applicable under the new rule. The FCC disagreed. 

“Although a NOC can be located outside of the United States, a foreign NOC can control an entity’s Domestic Communications Infrastructure, and is therefore appropriately included within this definition,” the agency wrote. “Information concerning an NOC located outside the United States, including information regarding the individuals and entities with access to that NOC, is critical information to assess the national security and law enforcement concerns of the foreign NOC.”

According to ex parte filings leading up to the vote, USTelecom also asked for exemptions for commercial-off-the-shelf equipment described in the rule for submarine cable licenses to apply more broadly to applications involving common carriers’ wireless and earth station licenses.

In a press conference after Thursday’s vote, FCC officials said the final order did not include any such substantive changes. 

These aspects of the FCC’s decision could have implications for other suppliers of information and communications technology, such as major cloud providers like Microsoft and other big tech companies as the U.S. promotes a tough-on-China approach to resuming trade negotiations with Beijing.

“For too long, China’s lack of adherence to global trading norms has undercut the prosperity of Americans and others around the world,” U.S. Trade Representative Katherine Tai said Monday during remarks at the Center for Strategic and International Studies. “We will use the full range of tools we have and develop new tools as needed to defend American economic interests from harmful policies and practices.”

Among the issues of contention is the security of intellectual property, which U.S. officials say China acquires through cyberattacks and by further intertwining state-supported enterprises with U.S. companies via mergers or financial investments.  

One high-profile example of the U.S. government’s efforts to curb China’s alleged intellectual property theft is the Defense Department’s Cybersecurity Maturity Model Certification initiative. Like the FCC’s rule for submarine cables, CMMC rules exclude contracts made solely for commercial-off-the-shelf, or COTS, equipment. And like telecommunications companies did with the FCC, big tech companies asked for a broader application of those exceptions.  

The Information Technology Industry Council, or ITI, which represents more than 70 major tech companies, also argued for DOD officials to void the requirement for companies that have already gotten security certifications for standards like those offered by the International Organization for Standardization, or ISO.

But certification to ISO standards can be obtained from accreditation bodies all over the world, including China, and officials like National Security Agency Cyber Director Rob Joyce and other cybersecurity professionals are highlighting the growing use of commercial equipment as a vector for cyberattacks. Renewed engagement with China is also coming after a sweeping attack on Microsoft Exchange servers, which the company ties to Beijing. 

Senior administration officials briefing reporters on plans for the renewed China talks Sunday highlighted engagement with European allies as one of the main differences between its approach and that of former President Donald Trump. They noted agreements to review and enforce limits on foreign investments, among a host of other commitments toward aligning on trade and technology policies. 

European officials have reportedly declined to associate a new U.S.-EU Trade and Technology Council with China. Bringing the U.S. and Europe closer together could arguably mean tougher enforcement of tech companies on issues such as competition and consumer protection, but according to ITI, the TTC was their idea.

“ITI proposed and supported the creation of the TTC,” Robert Strayer, ITI’s executive vice president for policy, said after the council’s first meeting Wednesday. “We commend the U.S. and EU for achieving this significant milestone and appreciated the opportunity to participate in the inaugural meeting today.” 

A press release from ITI in reaction to the council’s commitments pointed to the group’s efforts in January to form the council and its short-term goals for the forum. One such goal was for the U.S. and EU to “establish a commitment to base regulatory or procurement requirements on international, industry-driven, voluntary technical standards.”

“This will be especially important to facilitate forward-looking international regulatory compatibility in areas where governments necessarily depend on technical standards to fully realize the benefits of and inform approaches to new technology (e.g., artificial intelligence, cybersecurity, data portability, IoT products, sustainability and climate),” the association said.

According to the White House, the council “identified a shared interest in using voluntary and multi-stakeholder initiatives to complement regulatory approaches in some areas” related to data governance and technology platforms, including on the role of cloud infrastructure and services.

But White House officials on the Sunday call stressed the administration’s focus on securing the supply chain from foreign influence, and Europe’s commitment to similar efforts, including through joint principles for investment screening and export controls.

“We've been robustly screening Chinese direct investments in the U.S. via the [Committee for Foreign Investment in the United States] process,” one senior administration official said.

The FCC’s decision Thursday cited agreement with a committee made up of representatives from the departments of Homeland Security, Justice, Defense and others, including the intelligence agencies, that also make up CFIUS. That body—commonly referred to as Team Telecom when informing FCC decisions—will have the last word domestically on how to manage supply chain security by controlling foreign investments.

“The Committee staff …  [stated] that submarine cables are U.S. critical infrastructure and that applicants should provide PII and other details about non-U.S. individuals with access to either U.S. or foreign facilities (e.g., cable landing stations, Network Operations Centers, etc.) related to the submarine cable as it is necessary for the Committee’s national security and law enforcement analysis. We agree,” the FCC wrote. “We also agree with Committee staff that submarine cable operators should have in place access control policies for these critical facilities that will enable them to provide details concerning the individuals with access to their facilities, whether they are located in the United States or in a foreign country.”

For some, those concerns should also apply in the case of certain providers of commercial-off-the-shelf services, regardless of foreign ownership.

“Look, companies build software. It's incredibly complex. There are millions of lines of code. Mistakes are made. That happens, it's expected. But when it happens 100 times a month, and when it happens critically, where 70% of the mistakes are critical and we ... are watching those critical vulnerabilities being exploited, over and over and over and over again by adversaries, that's shocking to me,” a former FBI official told Nextgov regarding attacks via Microsoft products.

“This technology is spread throughout the entire world, throughout the U.S. government, it’s constantly being exploited and nobody's saying anything about it,” the former FBI official said. “I don't understand.”

The former official pointed to the hundreds of Microsoft engineers physically based in China and expressed disbelief that U.S. officials aren’t making more of a connection to the security risk that implies. Microsoft is hardly the only major company with such connections to China, but former DHS official Paul Rosenzweig recently amplified concerns around Microsoft in particular, due to what he called a monoculture risk within the federal government. 

CFIUS’ deliberations on related issues could also form precedent for other government bodies—such as the Federal Acquisition Security Council led by the Office of Management and Budget and DHS—which is trying to determine how to more comprehensively secure the supply chain for information and communications technology.

It could be a while before it’s clear whether the new U.S.-EU TTC will succeed in bringing the U.S. and EU together where previous iterations of the forum have failed. For now, action from a united commission suggests cloud providers, along with the rest of the information and communications technology ecosystem, can soon expect to hear more from the FCC. 

“Our work here is obviously far from over,” Brendan Carr, the FCC’s senior Republican, said before the commission’s vote. “We need to close the loophole in our equipment authorization process to ensure that equipment from entities that pose a national security risk will no longer be eligible for FCC approval, and we need to continue our review of all threats to the security of our communications infrastructure, whether those threats come from carriers or service providers, hardware or software.”