“I think it absolutely was inevitable.” That was the reaction of Matt Blaze, a Georgetown Law professor who studies secure systems, to news in early October 2024 that Chinese government hackers had broken into the networks of major U.S. internet providers and may have reached the systems built for court-ordered wiretaps.
Here’s what it means in plain terms. When a judge approves a wiretap, the phone or internet company has to hand over the target’s data. Federal law makes sure it can. The tools that do this sit inside the carrier’s own network, and the Wall Street Journal reported that a hacking group known as Salt Typhoon had been inside the networks of Verizon, AT&T and Lumen, which was formerly CenturyLink. Think of it like a master key cabinet in a building: it exists so the right people can open any door, which is exactly why a burglar wants it.
What was reported
The Journal wrote that the hackers “might have held access” to infrastructure used for lawful U.S. data requests “for months or longer,” citing people familiar with the matter. They also reached other tranches of more generic internet traffic. The Washington Post had run its own report the day before and called the operation “an audacious espionage operation likely aimed in part at discovering the Chinese targets of American surveillance.” Officials told the paper there were signs China’s Ministry of State Security was involved, and that an investigation by the FBI, other intelligence agencies and the Department of Homeland Security was “in its early stages.” One official said President Joe Biden had been briefed.
Not everything was settled. Both papers said it was possible, but not proven, that the wiretap systems were penetrated. “There is some indication [the lawful intercept system] was targeted,” a U.S. security official told the Post. Officials could not say whether the hackers got actual lists of federal surveillance targets, or whether those targets were part of criminal cases or national security work.
The Post’s sources described how Verizon was hit. Hackers apparently pulled some data out by reconfiguring Cisco routers, and nobody noticed the changes. Verizon reportedly set up a war room at its facility in Ashburn, Virginia, working with FBI staff and people from Microsoft and Google’s Mandiant. A spokesperson for the Chinese Embassy in Washington told the Post that U.S. intelligence and security companies were piecing together “false evidence” and spreading disinformation.
A 1994 law, a 2024 problem
The wiretap requirement comes from the Communications Assistance for Law Enforcement Act, or CALEA, passed in 1994, when cell phones were rare and the internet was young. TechCrunch noted that these systems are among the most sensitive in a provider’s network and often give a few employees nearly unfettered access to customer information.
Riana Pfefferkorn, a Stanford encryption policy expert, said the law creates “a system that was always a target for bad actors.” Signal president Meredith Whittaker put it more shortly: “There’s no way to build a backdoor that only the ‘good guys’ can use.”
The Journal’s sources considered the breach “potentially catastrophic.” Salt Typhoon is one of several related Chinese-backed units that are thought to be laying groundwork for destructive attacks in a future conflict between China and the United States, potentially over Taiwan. The Journal had first described parts of the campaign on September 26, but without naming any provider or mentioning the wiretap systems.
Sources
- Reports: China hacked Verizon and AT&T, may have accessed US wiretap systems (Ars Technica, Jon Brodkin)
- The 30-year-old internet backdoor law that came back to bite (TechCrunch, Zack Whittaker)
