Lawful intercept exists because democracies decided that surveillance should be possible, auditable and bounded. Carriers are required to build the capability. The system that results is a directory of exactly whom the state is interested in, maintained by a commercial company, and it is a target of obvious value to a foreign service.
US agencies have issued joint advisory guidance on the activity tracked as Salt Typhoon, a state-sponsored group assessed as affiliated with the People’s Republic of China. Reporting on the campaign describes intrusions at more than 600 organisations across some 80 countries since 2019, with a heavy concentration in telecommunications, and access to at least nine major American carriers.
The Metadata Is The Intelligence
The instinctive question is whether calls were listened to. It is close to the least important one. Communications metadata — who contacted whom, when, from where, for how long — supports inference at a scale content never does, and it does not require translation, transcription or analyst time.
Access to intercept infrastructure adds a second layer that has nothing to do with content either. It reveals the targets of an investigation, and therefore what a government knows, suspects and has not yet acted on. That is counterintelligence material of the first order.
Why Eviction Takes Years
Carrier networks are decades of accumulated equipment from many vendors, some of it beyond support and much of it impossible to take out of service without a customer-visible outage. An intruder who has been present since 2019 has had time to establish access that survives the obvious remediation steps.
That is the shape of every long eviction we have covered: the cleanup is not gated on detection or on skill, but on maintenance windows in networks that were built never to have one.
We grade this high. The scope figures come from published advisory and reporting rather than a vendor cluster name alone, and the attribution language follows the agencies’ own.
Compiled from published advisory material and public reporting, listed below. We name a government only where the agencies do, and we reproduce their assessment language rather than sharpening it. We have not reviewed carrier telemetry. Corrections: corrections@forensicpost.com.