Senator Calls for Cybersecurity Audit of Law Enforcement Wireless Network

Sen. Ron Wyden, D-Ore., called Wednesday for annual cybersecurity audits for FirstNet—the high-speed communications platform designed to be used by first responders and military personnel—to identify security vulnerabilities that foreign governments, hackers or criminals could exploit.

In a letter, Wyden requested the National Security Agency and Cybersecurity and Infrastructure Security Agency “conduct or commission” annual cyber audits of FirstNet, operated by AT&T under a $92 million contract issued roughly three years ago.  

According to Wyden, a CISA official informed his office in February 2022 that well-known security weaknesses—known as SS7 and Diameter—in systems that exchange information between carrier networks may also impact FirstNet. Those vulnerabilities can be exploited by bad actors to track phones, intercept calls or text messages or deliver spyware.

“CISA’s subject matter expert told my staff that they had no confidence in the security of FirstNet, in large part because they have not seen the results of any cybersecurity audits conducted against this government-only network,” the letter states. 

Wyden added that “AT&T is unwilling, and the Department of Commerce is unable to share results” of independent security audits of FirstNet. According to the letter, Commerce’s National Telecommunications and Information Administration, or NTIA, “is bound by a non-disclosure provision in the contract it negotiated with AT&T.”

“Concealing vital cybersecurity reporting is simply unacceptable. As the lead agencies responsible for the government's cybersecurity, CISA and NSA need to have access to all relevant information regarding the cybersecurity of FirstNet, and Congress needs this information to conduct oversight,” Wyden said. “If the Department of Commerce is unable to share the results of the FirstNet audits commissioned by AT&T, CISA and NSA should conduct or commission their own annual audits and deliver the results to Congress and the FCC. If you lack the resources or authority to conduct such audits, please indicate as much, so that Congress can take the necessary steps to address this gap.”

In a statement to Nextgov, a FirstNet spokesperson said cybersecurity is a top priority for FirstNet, and said the FirstNet Authority does perform "robust and ongoing cybersecurity reviews." The FirstNet Authority's board members include permanent representation from the departments of Homeland Security and Justice, as well as the Office of Management and Budget. 

"The FirstNet Authority prioritized cybersecurity in the planning for the public safety broadband network, and it continues to be a top priority for us today. The FirstNet network is designed with a defense-in-depth strategy that goes well beyond standard commercial network security measures," the spokesperson said. "The FirstNet Authority performs robust and ongoing cybersecurity reviews of the network and will continue to work with its contractor, AT&T, as well as our public safety and federal partners, to deliver a highly secure, reliable network for America’s first responders."