U.S. House Committee Demands DHS Records on Chinese Telecom Hacking Incidents

Lawmakers Seek Transparency on Salt Typhoon and Volt Typhoon Responses / Reuters

The U.S. House Committee on Homeland Security has formally requested detailed records from the Department of Homeland Security (DHS) regarding the federal government’s response to two significant Chinese telecom hacking incidents, Salt Typhoon and Volt Typhoon. Led by Chair Mark Green, alongside subcommittee chairs Andrew Garbarino and Josh Brecheen, the committee is pressing DHS Secretary Kristi Noem to provide comprehensive documentation by March 31, 2025. This request stems from growing concerns over national security vulnerabilities exposed by these cyberattacks, which have been labeled as some of the most severe in U.S. history. The lawmakers are particularly focused on understanding when DHS first became aware of these threats, the extent of damages caused, and the timeline of actions taken in collaboration with other agencies, industry stakeholders, and affected parties. The urgency of this inquiry reflects the critical nature of the breaches, which have compromised telecommunications networks and critical infrastructure, raising alarms about privacy breaches and potential espionage targeting American citizens and officials.

Salt Typhoon, widely regarded as the largest telecommunications hack in U.S. history, has sent shockwaves through the intelligence community due to its unprecedented scope and impact. Reports indicate that Chinese hackers, allegedly linked to state-sponsored groups, infiltrated the systems of major telecom providers such as Verizon and AT&T, gaining access to a vast trove of Americans’ call logs and, in some instances, intercepting conversations involving prominent politicians and government figures. This breach, first publicly acknowledged in late 2024, exploited vulnerabilities in core broadband networks, particularly Cisco routers, which handle a significant portion of internet traffic. Experts suggest that the hackers also targeted telecom research at U.S. universities, compromising over 1,000 Cisco devices worldwide, with half located in the U.S., South America, and India. The incident’s severity is compounded by its penetration of systems used for lawful wiretapping, potentially exposing sensitive national security operations to foreign adversaries. Verizon and AT&T have since declared their networks secure as of December 2024, but the full ramifications of Salt Typhoon remain under scrutiny, with the House Committee criticizing the Biden administration for delayed disclosure until after media reports surfaced.

In contrast, Volt Typhoon represents a longer-term, insidious threat to U.S. critical infrastructure, with activities traced back to at least mid-2021. This Chinese hacking group, known by aliases such as Vanguard Panda and Bronze Silhouette, has focused on infiltrating sectors like energy, water, transportation, and telecommunications, aiming to preposition for disruptive cyberattacks during potential geopolitical conflicts. Unlike Salt Typhoon’s broad telecom assault, Volt Typhoon employs “living off the land” techniques, leveraging built-in network tools to evade detection while dwelling in systems for extended periods. A striking example is its nearly 10-month presence in a Massachusetts utility’s operational technology systems, where it stole critical data with the intent to disrupt services. The FBI claimed a victory in January 2024 by dismantling Volt Typhoon’s operations targeting hundreds of routers, yet warnings from the Cybersecurity and Infrastructure Security Agency (CISA) and international partners in March 2024 indicate the group’s persistence, underscoring the ongoing challenge of countering this sophisticated threat.

The federal government’s response to these Chinese telecom hacking incidents has involved multiple agencies, with DHS playing a central role through CISA and coordination with the FBI. For Salt Typhoon, CISA’s early detection of the breach on federal networks provided a critical head start, enabling law enforcement to investigate virtual private servers and gather intelligence on the hackers’ tactics. The DHS Cyber Safety Review Board has also launched an examination of Salt Typhoon to recommend improvements, while the FBI and CISA have assisted affected telecom companies in securing their networks. On the Volt Typhoon front, the FBI’s router takedown was a notable action, but CISA’s subsequent advisories, supported by the Five Eyes intelligence alliance, highlight the group’s continued efforts to exploit vulnerabilities in IT networks. The House Committee’s request for detailed records seeks to illuminate these efforts, addressing lawmakers’ frustration over the lack of transparency and the apparent lag in public disclosure, particularly regarding Salt Typhoon.

Beyond the immediate security concerns, these incidents highlight broader implications for U.S. cybersecurity policy and international relations. The breaches expose vulnerabilities in telecommunications infrastructure, a backbone of modern communication, and critical systems that sustain daily life. Salt Typhoon’s access to wiretapping systems raises questions about the integrity of privacy protections, while Volt Typhoon’s focus on infrastructure suggests a strategic intent to undermine U.S. resilience in future conflicts. China’s official denials, labeling the accusations as “unfounded smears,” add a diplomatic layer to the issue, with Beijing accusing the U.S. of fabricating claims to mask its own cyber operations. This back-and-forth underscores the escalating cyber rivalry between the two nations, with the U.S. House Committee’s investigation poised to shape future legislative and defensive strategies.

The lawmakers’ demand for records by March 31, 2025, is a pivotal step toward accountability and preparedness. They seek a granular understanding of how DHS and its partners responded once the threats were detected, including interactions with industry stakeholders and victims. This transparency is vital not only for assessing past actions but also for fortifying defenses against ongoing and future Chinese telecom hacking campaigns. The persistence of Volt Typhoon, despite earlier interventions, and the staggering scale of Salt Typhoon underscore the need for robust cybersecurity measures, enhanced public-private collaboration, and possibly new legislation like the Strengthening Cyber Resilience Against State-Sponsored Threats Act, recently passed by the committee. As the U.S. grapples with these sophisticated threats, the forthcoming DHS records could reveal critical insights into the nation’s ability to safeguard its digital frontiers against an increasingly assertive adversary.