Sen. Kelly Says CCP Still Has Access to US Telecom Networks

‘They’re still there, and we have yet to figure out a way to kick them off,’ he said.

Sen. Mark Kelly (D-Ariz.) speaks with reporters while waiting to catch the Senate subway to the Hart Senate Office Building from the U.S. Capitol on July 25, 2024. Kent Nishimura/Getty Images

Sen. Mark Kelly (D-Ariz.) told attendees of the McCain Institute’s Sedona Forum on May 3 that the Chinese Communist Party (CCP) still has access to the nine U.S. telecommunication companies that were hacked in December 2024 during the Salt Typhoon cyberintrusion coordinated by the Chinese Ministry of State Security.

“They did it in such a way that it was very hard for us to detect that they were there and not done through the typical way that you would do something with malware,” he said during a panel discussion.

“It was done through access to routers and using a lot of sophisticated techniques, and it was ... the Chinese Ministry of State Security that coordinated this operation. They’re still there, and we have yet to figure out a way to kick them off.”

The FBI and the Cybersecurity and Infrastructure Security Agency (CISA) identified the hacks in October 2024 and began an investigation.

In a joint statement issued on Nov. 13, 2024, the agencies revealed that the hackers had compromised the networks of multiple telecom companies and stolen customer call records and private communications from “a limited number of individuals who are primarily involved in government or political activity.”

CISA Executive Assistant Director for Cybersecurity Jeff Greene said on Dec. 3, 2024, that he did not have a timeline on when CCP-backed hackers could be purged from U.S. telecom networks.

“It would be impossible for us to predict when we'll have full eviction,” Greene said at the time.

On Dec. 4, 2024, the Biden administration revealed that at least eight U.S. telecommunication companies had been compromised by the Chinese state-sponsored hackers. The administration stated that it believed that the threat group Salt Typhoon had hacked into the communications of senior U.S. government officials.

By Dec. 27, 2024, the number of compromised telecommunication companies had increased to nine.

Kelly, who sits on the Senate Select Committee on Intelligence, told the audience at the Sedona Forum panel that rebuilding U.S. telecom infrastructure in order to prevent hackers from gaining access continues to be a topic of conversation among his fellow committee members.

One of the issues with the nation’s current telecommunications infrastructure is how organically it developed over time.

“Somebody built a system, somebody improved that system,” Kelly said. ”They added technology to it, and today we have this collaged-together [system] of multiple companies using different kinds of equipment that are easily accessible from our adversaries.

“They’re able to, if they know who you are, know your phone number, and [if] they want to get access to some of your information, they today can probably do that, including voice calls.”

The Volt Typhoon threat group has been targeting U.S. critical infrastructure since 2021, and CISA has confirmed that these hackers maintained “access and footholds within some victim IT environments for at least five years.”

Volt Typhoon was reported to be dismantled in January 2024, but Kelly said the Ministry of State Security still has “access into some of these systems” and emphasized the security risks such infiltration poses to the nation’s ability to mobilize against communist China.

He and his fellow panelists—Sue Gordon, former principal deputy director of national intelligence, and Frances Fragos Townsend, assistant for counterterrorism and homeland security under former President George W. Bush—stressed the need for the federal government to lead the way in developing the necessary cybersecurity. They also said there is still no clear definition of when a cyberattack is considered an act of war.

The senator advised the crowd on how to proceed with their telecommunications.

“If you’re in any kind of sensitive position, just be aware that there are folks that are gathering information on you that want to know who all your connections are,” he said, noting that foreign adversaries may even have access to the cellphones of some Sedona Forum attendees.

“There are ways to kick them off. The easiest way is [by] keeping your software up to date and turning the phone off.”

Frank Fang contributed to this report.