Salt Typhoon Reached US Carriers Through CALEA Lawful-Intercept Systems

US officials confirmed that the intrusion set tracked as Salt Typhoon reached the systems of at least nine major carriers, including AT&T, Verizon and T-Mobile. Reporting establishes that the campaign exploited systems built to satisfy the Communications Assistance for Law Enforcement Act — the statutory wiretap capability every US carrier is required to maintain — and reached metadata associated with more than a million users, along with the communications of individuals connected to the 2024 presidential campaigns.

CALEA requires carriers to build and maintain a facility that can intercept any subscriber’s communications on lawful request. That facility must be reliable, comprehensive, and reachable by authorised parties.

It is therefore, by construction, a single point in the network with access to everything and an authentication boundary. There is no version of this requirement that does not produce that object. The vulnerability was not a defect in the implementation; it was the specification.

For thirty years the debate over lawful access has run on a hypothetical: cryptographers argue that a mechanism permitting authorised interception necessarily creates a target, and policymakers respond that a sufficiently well-engineered mechanism can be secured.

That debate now has an empirical entry. The mechanism was built by the best-resourced carriers in the world under statutory obligation and federal oversight, and a foreign intelligence service used it against the political system that mandated it.

This desk records that as a finding rather than a position. It does not establish that lawful access is never worth its cost — that is a judgement about competing goods. It does establish that the security cost is real, has been paid, and can no longer be treated as speculative.

More than a million users’ metadata is not a lesser outcome than content. Who called whom, when, from where, for how long, is the material from which relationships, movements, hierarchies and patterns of life are reconstructed.

Content requires reading. Metadata can be processed at scale, joined across sources, and searched — the argument this desk filed at 26-0326 and 26-0318 about utility and telematics data, here at national scale and in the hands of a foreign state.