US data centers may still have a China problem: House panel warns Chinese telecom firms embedded despite FCC action

The cyber-espionage campaign known as Salt Typhoon (2024) showed how Chinese hackers could penetrate the core of America's telecommunications backbone, compromising sensitive communications and exposing weaknesses in critical network infrastructure. Now, a bipartisan House committee warns that one of the vulnerabilities highlighted by that campaign has not been fully addressed.

In its findings from an investigation released Tuesday, August 4, the House Select Committee on the Strategic Competition Between the United States and the Chinese Communist Party says Chinese state-controlled telecom companies continue to maintain a physical presence inside US internet infrastructure despite losing their federal operating licenses. According to lawmakers, the companies retained routers, interconnection agreements, and data center footholds that could serve as "trusted" pathways for future cyber operations linked to Beijing.

Chinese telecom firms still have a footprint in US networks

The bipartisan investigation focused on the US subsidiaries of China Telecom, China Mobile, and China Unicom, whose Section 214 telecommunications licenses were previously denied or revoked by the Federal Communications Commission (FCC).

According to the committee, ‘those administrative actions did not require these Chinese telecommunication providers to shut down all physical operations in the United States.’ Instead, the service providers ‘obtained or retained hardware, interconnection agreements, and data center footholds that served as their “trusted” backdoors,’ it adds.

What are the report’s findings?

The report identifies three central findings: China Telecom, China Mobile, and China Unicom's US subsidiaries are not truly independent from their parent companies in mainland China and Hong Kong.

FCC licensing actions limit what the companies can sell but do not remove their equipment, physical presence, or network relationships.

The companies continue to remain embedded in US infrastructure, creating security risks for American internet users through their integration with Chinese parent networks and supporting systems.

The committee argues this leaves a significant security gap between telecommunications licensing and modern internet infrastructure.

Why the report raises concerns about US internet infrastructure

According to the committee, the investigation uncovered anomalous internet routing activity that corresponded with the timing of notable Chinese Communist Party-sponsored cyber campaigns targeting the United States.

While the report does not claim those routing activities directly caused the attacks, it says the findings raise "profound concern" that the companies' remaining US operations "may help facilitate future malign cyber activities by the CCP in the United States."

The report comes amid heightened scrutiny of Chinese cyber operations following campaigns such as Salt Typhoon, which prompted lawmakers to launch the bipartisan investigation in 2025.

Lawmakers say FCC authority has limits

The committee argues that current FCC authority addresses telecommunications licensing but does not require companies to remove equipment or infrastructure already operating within US networks.

"This report shows the importance of continued oversight of PRC-linked telecommunications companies operating in the US," said Ranking Member Ro Khanna (D-CA).

"Particularly in light of the CCP's Typhoon campaigns, Congress should continue to address risks to Americans' data and ensure that the agencies responsible for securing our communications networks have the resources they need to respond to potential threats."

Committee Chairman John Moolenaar (R-MI) argued that stronger action is necessary. "U.S.-based subsidiaries of Chinese telecommunications companies are beholden to the CCP, and they are a threat to all of us," he said.

"They make American customers promise to censor information according to the CCP's laws, and they poison the domestic cyber infrastructure we rely on. All of this leaves us vulnerable to a new wave of state-sponsored cyberattacks from our nation's biggest adversary. The CCP does not allow U.S. telecom companies into China. We must cut these subsidiaries out of our domestic infrastructure to protect the American people."

Investigation followed Salt Typhoon concerns

The investigation stems from a bipartisan hearing held in March 2025 titled End the Typhoons: How to Deter Beijing's Cyber Actions and Enhance America's Lackluster Cyber Defenses. Following concerns surrounding the Salt Typhoon compromise of US telecommunications infrastructure, lawmakers launched an investigation into China Telecom, China Mobile, and China Unicom.

According to the committee, all three companies declined to cooperate voluntarily, prompting congressional subpoenas and bipartisan transcribed interviews with company personnel.

Recommendation to close the infrastructure gap

The report concludes that Congress should move beyond telecom licensing and establish broader legal authority to identify, monitor, restrict, and, where necessary, remove foreign state-controlled communications infrastructure that poses national security risks.

Among its recommendations are expanding FCC authority to deny blanket authorizations and restrict domestic interconnection, creating statutory authority over retained foreign adversaries infrastructure, broadening Team Telecom and ICTS oversight, funding targeted "rip-and-replace" programs, strengthening internet routing-security enforcement, and requiring logging and monitoring until covered infrastructure is removed or mitigated.

Proposed ban on Chinese datacenter components

The report's release also coincides with reports that the FCC is preparing a ruling that would ban the import of Chinese-made optical transceivers, critical networking components used in data centers to convert electrical signals into light for high-speed fiber-optic transmission and vice versa. According to a Reuters report of August 4, the FCC aims to publish the rule in time for it to take effect before the end of the year, although the proposal could still be modified or shelved before it is finalized.