|
FCC Strengthens Emergency Alert System Security – Time for Stations to Act Now
At its regular monthly meeting last week, the FCC approved new rules designed to better protect the Emergency Alerting System (EAS) from hackers.
The Commission acted after several incidents where bad actors broke into the system and sent false emergency alerts over the air. The new three-part plan aims to secure not just the EAS equipment itself, but the entire chain of systems stations use to air programming. The goal is to prevent unauthorized people from inserting fake alerts or other harmful content.
Important Deadline Note
There was some initial confusion about when these rules take effect. An erratum released today clarifies that the new requirements will go into effect 60 days after the order is published in the Federal Register. That publication could happen at any time, which likely means a September compliance deadline. Stations should begin working on compliance right away—especially with summer vacations in full swing.
The Three Requirements
1. Strong Password Security (Easy to Do – Start Today)
Broadcasters must use much stronger passwords for their systems.
- Passwords must be at least 15 characters long.
- They cannot be common dictionary words (these are too easy to guess or crack).
- Passwords should not be reused across other accounts, equipment, or services.
Stations should also have a policy to change passwords whenever an employee who had access leaves the station.
2. Keep Equipment Updated
Make sure all available software updates and security patches for your EAS equipment are installed.
You must also create an ongoing process to regularly check for new updates and install them promptly. This is a straightforward but important step.
3. Protect Your Systems with a Firewall (Most Involved – Start Planning Now)
All EAS equipment and programming systems connected to the internet must be placed behind a network firewall or use similar network segmentation methods.
In simple terms: EAS systems should be separated from your regular office/business networks so that outsiders cannot easily reach them from the internet.
These changes are mandatory. Starting compliance efforts early will help stations avoid last-minute rushes. If you have questions about how to implement these requirements, your station’s engineering or IT team should begin reviewing your current setup now.
|