Chinese telcos Salt Typhoon is the connection a bipartisan House Select Committee on China examined in a report released Aug. 4. Its finding is narrower than the rhetoric around it: China Mobile, China Telecom and China Unicom kept equipment, data-center space and network relationships in the United States after the Federal Communications Commission curtailed parts of their telecom operations, according to the committee.
The panel says that leftover footprint presents a security risk because the firms’ U.S. subsidiaries remain tied to Chinese parent companies. But the report does not establish that the companies carried out the Salt Typhoon intrusion, nor does it say China Mobile employees knew about or participated in it.
From 2019 through 2022, the FCC denied China Mobile USA’s application for international service and revoked authorizations held by China Telecom Americas and China Unicom Americas, according to Nextgov’s account of the investigation. Those decisions restricted services the companies could provide. They did not order them to pull equipment, depart data centers or terminate private network connections, the committee found.
What did the House find about Chinese telcos and Salt Typhoon?
The committee says the companies continued operating around the edges of the Section 214 authorization system through enterprise-networking, internet-transit and related services. It argues that equipment, colocated infrastructure and interconnection agreements can leave routes through which traffic could be observed, redirected or used to keep malicious systems reachable. Those are risk assessments from a congressional investigation, not findings that such conduct occurred.
The Salt Typhoon evidence is also conditional. Reviewing routing records from Sept. 22 through 25, 2024, the committee identified 58 groups of internet addresses that the Cybersecurity and Infrastructure Security Agency had associated with Salt Typhoon servers. It said China Mobile International’s network appeared on paths to those addresses at least 192 times.
Routing through a network does not by itself demonstrate control of the endpoint or awareness of the traffic. The committee explicitly said its data did not definitively connect China Mobile to the campaign and made no allegation that China Mobile USA staff took part. The Record likewise reported that the panel stopped short of saying China Mobile directly participated.
Salt Typhoon was a Chinese state-sponsored intrusion into U.S. telecommunications companies reported in October 2024 and subsequently confirmed by the U.S. government, according to the Congressional Research Service. As of its January 2025 brief, public disclosures had not identified the attack methods or the particular systems and data targeted.
What would the committee change?
The panel wants Congress to give regulators a broader tool kit aimed at infrastructure that outlives a service-license revocation. Its recommendations include:
- putting FCC authority over blanket authorizations and domestic interconnection into statute;
- creating authority over retained infrastructure controlled by foreign adversaries;
- expanding Team Telecom and Information and Communications Technology Services oversight of private commercial arrangements;
- requiring company-specific FCC Covered List determinations, funding targeted removal and replacement of equipment, and requiring temporary logging and monitoring; and
- funding internet-routing security enforcement and technical staffing in federal agencies.
China Mobile, China Telecom and China Unicom did not respond to detailed requests for comment, Nextgov reported. A spokesperson for China’s embassy in Washington said Beijing opposed what it called a U.S. overextension of national-security grounds against Chinese companies and would protect their lawful interests.
This story draws on original reporting from The Record.
