FCC Moves to Modernize Nation's Emergency Alert Systems
The Federal Communications Commission (FCC) has circulated a draft Report and Order in PS Docket Nos. 25-224 and 22-329 alongside a Further Notice of Proposed Rulemaking (FNPRM) in PS Docket Nos. 25-224, 15-94, and 15-91 (FCC-CIRC2606-04). The proceeding addresses comprehensive updates to the Emergency Alert System (EAS) and Wireless Emergency Alerts (WEA) following an extensive review initiated in 2025.
The action focuses on hardening critical alerting infrastructure against unauthorized intrusions, improving geographic accuracy, eliminating legacy constraints, and enabling software-based EAS architecture while preserving the core redundancy of the broadcast daisy-chain network.
- Adopts mandatory baseline cybersecurity hygiene rules for all EAS Participants.
- Proposes mandatory digital signature authentication for Common Alerting Protocol (CAP) EAS messages.
- Proposes establishing a universal alert message ID to eliminate duplicate WEA and EAS notifications.
- Proposes eliminating outdated WEA geotargeting exceptions and retiring 90-character WEA messages.
- Grants the National Association of Broadcasters (NAB) Petition for Rulemaking to explore software-defined EAS solutions.
Report and Order: Mandatory Cybersecurity Requirements for EAS Participants
In response to incidents where unauthorized actors exploited exposed, network-connected equipment to broadcast unauthorized tones and offensive material, the Report and Order adds Section 11.35(d) to the Commission's Part 11 rules. EAS Participants must implement three specific security controls for EAS devices, studio-transmitter link (STL) equipment, and any remotely managed equipment that routes, processes, or inserts content into programming streams.
EAS Participants must comply within 60 days following publication of the final rule in the Federal Register. The Commission estimated total annual industry-wide compliance costs at approximately $26 million, finding that public safety and national security benefits substantially outweigh these costs.
- Password Management: Requires changing default passwords prior to operational broadcast use, enforcing passwords of at least 15 characters without dictionary words, prohibiting credential reuse across systems, or deploying equivalent NIST-recognized authentication measures.
- Vulnerability Remediation: Requires prompt testing and installation of manufacturer-issued security patches and firmware updates.
- Network Segmentation: Requires isolating remote management interfaces behind firewalls, Virtual Local Area Networks (VLANs), or demilitarized zones (DMZs) to block direct public internet access.
Termination of Docket 22-329 and Tailored Regulatory Scope
The Commission terminated PS Docket No. 22-329, declining to adopt broader proposals from the 2022 Alerting Security NPRM that would have mandated comprehensive cybersecurity risk management plans, formal annual certifications, and mandatory breach reporting to the FCC. Commenters noted that comprehensive risk plans would impose disproportionate burdens on small and noncommercial broadcasters without adding proportional security value.
The FCC also declined to apply new cybersecurity mandates to WEA at this time, citing an absence of successful cyberattacks on commercial mobile service alerting paths and recommending continued reliance on industry standards and best practices.
Additionally, the FCC deferred immediate changes to mandatory incident reporting, opting to monitor the Cybersecurity and Infrastructure Security Agency's (CISA) implementation of the Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) to prevent duplicative reporting obligations.
- Eliminates proposed requirement for annual cybersecurity risk management plan certifications.
- Declines separate FCC cyber incident reporting rules pending CISA CIRCIA implementation.
- Maintains existing rule text in 47 CFR Sections 10.330 and 10.500 regarding Participating CMS Provider delivery technologies.
Further Notice: Securing EAS and Bolstering Alert Reliability
The accompanying FNPRM proposes requiring EAS Participants to reject any CAP-formatted EAS messages that lack a valid digital signature under Section 11.56(c), closing an existing gap where unsigned messages could still be broadcast.
To combat duplicate alerts and alert fatigue, the FNPRM proposes a universal alert message identifier for WEA and EAS. The Commission seeks input on deriving this fixed-size identifier from FEMA Integrated Public Alert and Warning System (IPAWS) metadata via cryptographic hashing. Furthermore, the FCC proposes requiring Participating CMS Providers to rebroadcast active WEA messages once every 60 seconds throughout an alert's active window, ceasing 5 minutes prior to expiration for 24-hour alerts.
- Proposes mandatory rejection of CAP alerts lacking valid cryptographic digital signatures.
- Proposes universal alert message ID to suppress duplicate alerts across carriers and network generations.
- Proposes standardized 60-second WEA message retransmission intervals to capture devices entering target hazard zones.
Further Notice: Enhanced Geotargeting, Visual Symbology, and Software EAS
The FNPRM proposes eliminating legacy network and disabled location service exceptions to WEA geotargeting under Section 10.450(a), while strictly protecting consumer privacy by prohibiting location data transmission off mobile devices and requiring immediate data deletion. It also proposes permitting EAS Participants to utilize circle and polygon coordinates from CAP alerts instead of relying solely on county geocodes.
The Commission proposes retiring the legacy 90-character WEA message limit under Section 10.430, retaining the 360-character maximum standard. Finally, the FCC proposes authorizing software-based EAS encoder/decoder solutions under Part 11 certification, provided the software is hosted on-premises at local broadcast or cable headend facilities and subject to a 72-hour defective software remediation timeframe.
- Proposes ending WEA geotargeting exceptions while requiring device-level location data deletion immediately after geofencing.
- Proposes retiring 90-character WEA message support in favor of the 360-character standard.
- Proposes authorizing software-only EAS encoders/decoders under Part 2 certification when hosted at local facilities.
- Proposes standardizing threat-specific symbology for EAS and WEA displays and examining automated text-to-speech for WEA earthquake warnings.
- Proposes delegating authority to the Public Safety and Homeland Security Bureau to assign specialized partial-county EAS location codes.