FCC Passes New Cybersecurity Rules for Emergency Systems and Undersea Cables This Week

More than 95% of international internet traffic travels through undersea cables — and until this week.

Table of Contents

The rules governing their security had not seen a major overhaul since 2001. The Federal Communications Commission has now changed that.

In a landmark pair of rulemakings finalized in late June 2026, the FCC passes new cybersecurity rules for emergency systems and undersea cables this week. Closing decades-old regulatory gaps that national security experts had long flagged as dangerous. [1]

Key Takeaways

The FCC passed two major rulemakings simultaneously: one covering Emergency Alert System (EAS) and Wireless Emergency Alerts (WEA), and one overhauling submarine cable regulations for the first time since 2001.
Emergency alert operators must now meet mandatory cyber hygiene and authentication controls to protect public warning systems.
New licensing requirements apply to submarine line terminal equipment (SLTE) operators, with expanded oversight of capacity arrangements and downstream customers.
Applicants who meet strict national security standards may qualify for presumptive exemptions from Team Telecom review, streamlining the approval process.
Foreign-adversary-linked technology and service providers face new restrictions on involvement in critical submarine cable infrastructure.

What the New FCC Cybersecurity Rules Cover

The FCC passes new cybersecurity rules for emergency systems and undersea cables this week through two distinct but complementary rulemakings adopted together. [2]

Emergency Alert System and Wireless Emergency Alerts

The first rulemaking targets the Emergency Alert System (EAS) and Wireless Emergency Alerts (WEA).

The systems that push tornado warnings, AMBER Alerts, and presidential emergency messages to televisions, radios, and mobile phones across the country. Under the new rules, operators must implement:

Mandatory cyber hygiene practices
Authentication controls to prevent spoofed or hijacked alerts
Regular security audits and reporting obligations

A compromised emergency alert system is not a hypothetical threat. Bad actors have previously hijacked EAS equipment to broadcast fake zombie apocalypse warnings. The new rules aim to prevent far more serious intrusions. [5]

Submarine Cable Regulations

The second rulemaking is arguably the more sweeping of the two. The FCC’s submarine cable authority had not undergone a comprehensive review since 2001.

Long before modern cybersecurity threats, cloud computing, or state-sponsored hacking became dominant concerns. [3]

Key provisions include:

Provision	Details
SLTE Licensing	New requirements for submarine line terminal equipment operators
Team Telecom Exemptions	Presumptive exemptions for applicants meeting national security standards
Foreign Adversary Restrictions	Bans on principal equipment from adversary-linked vendors
Expanded Oversight	Covers capacity arrangements, IRUs, and downstream customers

The rules also restrict the use of technology and services linked to foreign adversaries in core cable infrastructure — a direct response to growing concerns about Chinese-linked vendors. [4]

Why Now? The National Security Case

The timing reflects escalating geopolitical pressure. State-sponsored actors have demonstrated both the capability and the intent to target undersea cable infrastructure.

A successful attack on even a handful of major cable landing stations could disrupt internet connectivity for entire regions.

Affecting financial markets, healthcare systems, and government communications simultaneously.

The vulnerability of critical digital infrastructure extends well beyond cables. AI-powered hacking tools have lowered the barrier for sophisticated attacks. Data breaches affecting millions of records have become routine.

Regulators could no longer justify leaving foundational communications infrastructure under rules written before smartphones existed. [6]

The FCC’s move also aligns with broader federal efforts to harden national security infrastructure against adversaries. Particularly as AI agents are increasingly exploited for malicious purposes.

What Compliance Looks Like for Operators

For operators, the new rules create concrete obligations. SLTE licensees must meet updated security standards and demonstrate compliance during the licensing process. Capacity arrangement holders and downstream customers now fall under expanded FCC oversight, meaning due diligence requirements extend further down the supply chain. [7]

Operators who proactively meet the national security benchmarks can qualify for presumptive exemptions from the lengthy Team Telecom interagency review process — a meaningful incentive for compliance. [2]

Cybersecurity insurance coverage for telecom operators is also likely to evolve in response to these new standards, as insurers update their risk models to reflect the FCC’s new baseline requirements.

Conclusion

The FCC passes new cybersecurity rules for emergency systems and undersea cables this week in a move that represents the most significant update to U.S. communications security policy in a generation.

Operators of EAS/WEA systems and submarine cable infrastructure should begin gap assessments immediately. Prioritizing authentication controls, supply chain reviews, and licensing compliance.

Organizations that act early will be better positioned to qualify for Team Telecom exemptions and avoid enforcement exposure.

The rules signal that critical communications infrastructure will face sustained regulatory scrutiny — and the cost of inaction is now measurably higher than the cost of compliance.