FCC Seeks Comments On New EAS and WEA Cybersecurity Rules

posted on 10.31.2022

In a 4-0 showing of bipartisan support, the FCC adopted a proposed rulemaking on Oct. 27 meant to “strengthen” the operational readiness and security of the nation’s Emergency Alert System (EAS).

Broadcast EAS has been operational in the U.S. since Jan. 1, 1997, and replaced its legacy predecessor, the Emergency Broadcast System (EBS).

The NPRM also contains proposed changes to the national wireless emergency alert system (WEA) rules.

The two systems are used primarily by local emergency managers and the National Weather Service (NWS) to warn the public about emergencies using broadcast alerts received on televisions and radios, and wireless alerts on devices such cell phones. 

Some of the proposals outlined in the FCC NPRM would increase broadcaster FCC obligations and could especially impact those stations in smaller markets with less staff.

Under the FCC’s proposed rules, broadcast stations would be required to report to the commission, within 72 hours, any “unauthorized access” to a station’s EAS equipment such as a cyberattack. 

The FCC is also considering requiring participants to notify the FCC when EAS equipment fails, similar to broadcasters notifying the FAA when tower lighting fails in some way. The commission could potentially shorten the timeframe EAS participants have to fix broken EAS equipment.

The NPRM also seeks comment on the current requirements for ensuring that EAS equipment is ready to transmit alerts. 

A broadcaster would need to implement a plan that would “include security measures that address changing default passwords prior to operation, installing security updates in a timely manner, securing equipment behind properly configured firewalls or using other segmentation practices, requiring 
multifactor authentication where applicable, addressing the replacement of end-of-life equipment, and wiping, clearing, or encrypting user information before disposing of old devices.”  

An annual certification of readiness would be required under the proposal, which could be collected from stations as part of the annual filing of FCC Form One in the EAS Test Reporting System (ETRS). 

While it may take some time before any proposed rules are adopted, broadcasters should consider how the proposed changes could affect their operations.

After the NPRM is published in the Federal Register, comments and reply comments will be due within 30 and 60 days, respectively.

TAB will keep stations apprised of developments with this NPRM as they occur. 

Questions? Contact TAB’s Michael Schneider or call (512) 322-9944.

---