[photon12]

I'm not calling for regulation on general security outcomes. I'm talking specifically about access controls on sensitive and highly privileged systems that have ripple impacts to consumer security, which should already be obvious best practice.

[gjsman-1000]

You assume that T-Mobile didn't try and just fail miserably, or repeatedly fail to insider attacks. If it was multiple insiders, the systems could be perfect technically and completely useless practically. We also don't know what the similar statistics for Verizon or AT&T or any other global carrier are for comparison.

[photon12]

I'm not assuming anything, I'm pointing out a failure of self-regulation given the TTPs listed in the original article, which are distinct from fully insider-supported attacks, should not happen.

There is obvious, direct, and destructive customer impact here.

Edit: actually I know people working in security roles for T-Mobile, and I am sure they or their sister teams are trying.

[anigbrowl]

What point are you trying to make here? That T-mobile maybe needs to screen employees better? That compromises are inevitable and we just need to deal? That we shouldn't give out so much data to corporations?