In a significant move aimed at bolstering U.S. national security, the Department of Justice (DOJ) has rolled out its final rule implementing Executive Order 14117, which takes a firm stance on preventing countries deemed as “concerned” from accessing sensitive American data.
Effective April 8, 2025, this Data Security Program (DSP) targets nations such as China, Cuba, Iran, North Korea, Russia, and Venezuela, placing stringent restrictions on data transactions that could compromise U.S. security interests.
The DSP is not merely another privacy regulation.
It is a dedicated national security measure designed to tackle potential threats posed by the bulk transfer of sensitive personal and government-related data.
The DOJ’s rules are particularly consequential for the telecommunications sector, which must navigate these waters carefully to avoid severe civil and criminal penalties for non-compliance.
Telecommunications services enjoy a specific exemption under the DSP, but this does not mean they can breathe easy.
The rule carves out this exemption only for transactions that are “ordinarily incident to and part of the provision of telecommunications services.”
Thus, telecom providers are urged to meticulously evaluate their operations, particularly any dealings with countries of concern, to ensure they fall within the exemption’s ambit.
The DSP’s scope is far-reaching, applying to U.S. entities and individuals engaged in transactions that might expose Covered Data to Countries of Concern or associated Covered Persons.
The definition of Covered Persons is broad, encompassing entities with significant ties to these nations, either through ownership, business operations, or residency.
The DOJ, aware of the rule’s complexity, has introduced a compliance guide and FAQs to aid entities in understanding their obligations.
A 90-day grace period from April 8 to July 8, 2025, is intended to allow businesses to align with the new requirements without facing immediate enforcement actions.
However, by October 6, 2025, full compliance, including adherence to due diligence, audit, and reporting requirements, will be mandatory.
For telecommunications providers, the stakes are high.
The DSP’s exemption for telecommunications services does not extend to ancillary activities such as data brokerage, marketing, or data analytics.
This distinction is crucial, as the DOJ has made it clear that the exemption applies strictly to the technical and operational aspects of delivering telecommunications services, such as voice and data communications over various transmission mechanisms.
Examples provided in the DSP illustrate the fine line telecom providers must walk.
Transactions integral to the delivery of telecommunications services, like facilitating international roaming, fall within the exemption.
However, selling geolocation data for advertising purposes does not, exemplifying how easily a transaction can slip outside the DSP’s protective umbrella.
Telecom providers must therefore scrutinize their service offerings, especially those bundled with non-telecommunications services like cloud computing.
The DOJ’s definition of telecommunications services explicitly excludes internet-based services such as cloud computing, necessitating a careful examination of integrated service offerings to avoid inadvertently triggering prohibited data transactions.
The DOJ’s insistence on a unique definition for telecommunications services under the DSP underscores the need for telecom providers to reassess their compliance strategies.
This definition diverges from the Communications Act, broadening the scope to include contemporary communications modes while sidestepping the common carrier designation.
The implications of this regulatory landscape are profound.
Telecom providers must not only ensure compliance with the DSP but also reassess their customer agreements to mitigate exposure from potential non-compliance by clients.
This is particularly pertinent for transactions involving sensitive data that could be transferred via international submarine cables to countries of concern.
In crafting these rules, the DOJ has sent a clear message: national security is paramount, and the telecommunications sector, as a key player in the data ecosystem, must play its part in safeguarding sensitive information.
As the October compliance deadline looms, telecom providers must act decisively, reviewing their operations and service offerings to ensure alignment with the DSP’s rigorous standards.
The path ahead is fraught with challenges, but with careful planning and thorough understanding of the DSP, telecom providers can navigate this complex regulatory environment.
The stakes are high, but so too is the responsibility to protect the integrity of U.S. data against potential threats from adversarial nations.
New research highlights how opportunistic infostealer malware is exploiting browser-based password managers to compromise corporate credentials at an unprecedented scale.
A new strategic partnership aims to overhaul space-based encryption hardware to support the high-speed data demands of modern military satellite networks.
Commercial data networks have become a critical vulnerability for military personnel as foreign adversaries exploit real-time bidding for intelligence.
