UK Weakens Proposed Telecoms Defenses Against Chinese Hackers After Industry Pushback

Why It Matters

Weakening the telecom security framework leaves critical UK communications infrastructure more exposed to state‑backed cyber threats, potentially raising national security and economic risks. The move also highlights the tension between industry cost concerns and government security objectives.

Key Takeaways

• UK drops independent signalling intrusion detection requirement.
• Monthly network equipment reboot rule softened to 'where feasible'.
• Service‑account security deadline pushed from 2028 to 2029.
• Telecoms argued cost and practicality outweighed security benefits.
• Potential fines up to 10% of turnover for non‑compliance.

Pulse Analysis

The Salt Typhoon campaign, which exploited signalling protocols to siphon data from over 80 countries, prompted the UK Department for Science, Innovation and Technology (DSIT) to draft an updated telecoms security code last August.

The consultation attracted responses from the sector’s biggest players—BT, Vodafone, Sky, Ericsson and Amazon Web Services—coordinated by the trade association TechUK.

While the original draft aimed to harden network defenses with measures such as independent intrusion‑detection systems and mandatory monthly equipment restarts, industry feedback framed these as costly and operationally burdensome, leading to a negotiated revision.