The U.S. Federal Communications Commission unanimously voted to adopt a notice of proposed rulemaking that would prohibit all future authorizations for equipment purchased from companies deemed a national security risk.

At the agency's June 17 open commission meeting, policymakers examined a loophole that allows equipment on a "covered" list promulgated by the commission to continue operating in the U.S. The FCC in 2020 formally designated Huawei Technologies Co. Ltd. and ZTE Corp. as national security threats in a move that prohibits the use of an agency subsidy fund to buy or support equipment or services provided by the companies. Although the order blocked U.S. companies from using federal funds to buy equipment from Huawei, ZTE and others, it did not limit purchases made with private funding.

In prepared remarks, Democrat Commissioner Geoffrey Starks said that foreign equipment devices submitted for FCC certification should include a “responsible party” within the United States that ensures compliance with equipment rules.

"If your equipment harms Americans, the FCC needs to be able to find you and hold you accountable," the remarks said. "These changes will hopefully increase transparency and prevent future bad actors from using their foreign status to avoid any FCC accountability."

As part of the $900 billion coronavirus relief package Congress passed in December 2020, $1.9 billion was allocated to remove Huawei and ZTE's equipment from U.S. telecom carriers' networks. In December 2018, the Rural Wireless Association, a trade association that represents U.S. rural wireless carriers, estimated that at least 25% of its carrier members used equipment from Chinese suppliers.

Republican Commissioner Brendan Carr during the proceedings told a story to fellow Commissioners about a recent visit to Malmstrom Air Force Base in Montana, where cell towers around the missile fields run on Huawei equipment.

"By now, I scarcely need to explain why the presence of Chinese-state backed communications equipment operating near American missile silos is concerning," Carr said. "Indeed, it is easy to understand that the Chinese government would value direct access to our telecom networks for reasons contrary to our security interests and our democratic values."

Asked during a press conference whether operators with Huawei or ZTE equipment in their networks could be held liable for any breaches or other security incidents, Carr said his "hope is that it’s not going to come to that."

He continued: "A lot of these carriers, including the ones I met with in rural Montana, act in good faith. They purchased this equipment years ago. In some instances, the impression I got was that they had discussions with national security back then — you’re talking five or six years ago — there weren’t red flags to share about this equipment."

Acting Chairwoman Jessica Rosenworcel called the rulemaking "common sense."

"It will better align our commitment authorization procedures with our national security policies," Rosenworcel said.

Last month, U.S. Sens. Marco Rubio, R-Fla. and Ed Markey, D-Mass., introduced a bipartisan bill to close the same loophole targeted at the FCC meeting. Entitled the Secure Equipment Act of 2021, it directed the FCC to clarify it will no longer review or approve applications from Huawei and other companies that pose a threat to national security. Similar new legislation was introduced this week by Minority Whip Steve Scalise, R-La. and Rep. Anna Eshoo, D-Calif., giving the issue not only bipartisan, but also bicameral support.

In the wake of four major cyberattacks in the past six months — the SolarWinds Corp. and Microsoft Corp. attacks, the Colonial Pipeline Co. ransomware attack, and the recent United States Agency for International Development email hacks — cybersecurity has taken on new urgency for both energy companies and the U.S. government.

U.S. President Joe Biden signed an executive order in May to strengthen the country's cybersecurity defenses. The order's key points include the removal of contractual obligations for IT service providers and requiring them to share specific breach information with the government; the modernization of the federal government's cybersecurity standards through secure cloud services, a zero-trust security model and multifactor authentication and encryption; the establishment of baseline security standards for software development; and the creation of a standardized playbook for cyber incident response.

The FCC commissioners also unanimously voted to support other items introduced in the meeting, including improvements to robocall spoofing and to the U.S. wireless emergency alert system.