John Doyle: The FCC’s New ID Rule is a Gift to America’s Adversaries
The FCC's proposed ID collection rule would build the exact database Chinese hackers are already inside U.S. telecom networks looking for.
In August 2024, Ping Li, a long-time Verizon employee, pleaded guilty to sending the name, residential address, and other biographical information of Chinese dissidents and other targets of interest to the Chinese government. This case reinforced longstanding concerns about Chinese espionage targeting US telecoms, and the intelligence value of personal information held by them.
The personal information shared by Li with his Beijing handlers, incidentally, is the same that a new proposed FCC rule would require US telecom providers to collect from all of their customers. The goal of the rule is to combat spam by imposing more rigorous “know-your-customer” requirements, like obligating phone companies to get and store copies of their customers’ government-issued ID for four years in order to deter spammers and make it easier to hold criminal actors accountable.
However, an unintended side effect of this rule would be to further enrich a comprehensive, whole-of-population dataset–one that our adversaries have already infiltrated.
Mere months after Li’s arrest, reports emerged that Salt Typhoon, a Chinese government-sponsored hacking group, compromised all of the major U.S. telecom carriers and targeted the phones of then-presidential candidate Donald Trump and running mate JD Vance, as well as staff of the Kamala Harris campaign. Salt Typhoon also infiltrated federal wiretap systems, giving Beijing an extraordinary view of who the US government was investigating.
We’ve known for years that Chinese security agencies viewed US telecoms as a prime target (that was part of what motivated me to found a security-focused telecom carrier), and it’s no wonder why–almost every adult in the United States carries a smartphone with them, which leaves a metadata trail of everywhere we’ve ever been, and every friend or bank or medical office we’ve ever called or texted, going back years and years. Telecom security, meanwhile, is stuck in the Dark Ages, a Byzantine mishmash of decades of mergers and acquisitions. Access to poorly guarded telecom data allows Beijing to stake out “intelligence high ground.”
The FCC reasons that banks also require an ID for you to open an account–so why not adopt the same rules for phone numbers, which can be abused by bad actors in the same way a terrorist or drug trafficker could leverage access to the financial system?
But this comparison breaks down when you examine the differences in how bank accounts and phone numbers are used and the incentives their providers have for keeping them secure. Banks can observe your activity at specific points in time, whereas the nature of cell phone service requires passive collection of data at all times, even when you’re not actively using it, making the personal privacy and surveillance implications of phone data far more consequential. Banks also shoulder direct financial liability for a data breach that results in stolen customer funds, whereas the major telecom carriers have managed to breach an astounding 400 million individual records in the last five years, with nary a blink of an eye by markets or regulators.
To put it plainly, our telecom networks are sitting ducks, China is still in them (the FBI calls the Salt Typhoon hack “still very much ongoing”), and the new FCC rule proposes to permanently link telecoms’ comprehensive behavioral data with real identities. Aggregating subscriber identities into centralized databases creates "digital crown jewels" that allow Beijing and others to replace complex intelligence gathering and correlation with simple, high-impact queries.
Beyond national security, the rule threatens the safety of individual citizens. At least half a dozen domestic violence organizations have submitted comments to the FCC, noting that survivors often can’t produce the identity documents or stable physical addresses that the rule demands, and that creating long-lived repositories of survivors’ information puts them in further danger at the hands of abusers and stalkers.
The ACLU and Electronic Frontier Foundation have noted that anonymous phone lines give people the courage to reach out to suicide, sexual assault, and addiction-recovery resources, and argue that the rule would build a database of personal information that would become “too lucrative for cybercriminals to ignore.”
There’s no evidence that stricter KYC rules mitigate spam (the correlation between countries’ know-your-customer rules and their spam intensity is zero), while there’s ample recent, real-world proof that any information that your mobile carrier collects can be breached. Even Taylor Swift has seen that if you tie your identity to your phone service, someone–like this Verizon employee–may try to access your data.
Americans, unlike residents of many other countries, have long had the option of being able to sign up for a phone line without presenting personal information or an ID. This option to communicate without being catalogued helps rather than harms our safety and security. We should defend this right both as a feature of a free society and as an imperative for national security.
John Doyle is CEO and founder of Cape, a privacy-first mobile carrier, and former head of Palantir’s national security business and an Army Green Beret veteran. He’s previously written op-eds for The Hill, Fast Company, and the Federal News Network. He’s testified before Congress on telecom and national security, and been an expert commentator for The Washington Post, 404 Media, Nasdaq, Cybernews, and more. This Expert Opinion is exclusive to Broadband Breakfast.
Broadband Breakfast accepts commentary from informed observers of the broadband scene. Please send pieces to commentary@breakfast.media. The views expressed in Expert Opinion pieces do not necessarily reflect the views of Broadband Breakfast and Breakfast Media LLC.
