FCC Urges IMMEDIATE Action to Prevent Further Fake EAS Alerts

Scott R. Flick

Posted February 12, 2013

By Scott R. Flick

With the State of the Union Address occurring tonight, the FCC wasted no time in advising broadcast stations and other EAS Participants to take immediate steps to prevent unauthorized uses of the Emergency Alert System like the fake zombie attack alerts that went out over a few stations in Michigan and Montana yesterday. While federal and state authorities are investigating the source of those hoax alerts, which appear to have come from outside the U.S., the FCC has just released instructions for EAS Participants in hopes of heading off any more false alerts.

The haste with which these instructions have been generated is demonstrated by the fact that they are not even on FCC letterhead, nor formatted for such a release. It is also worth noting that they are not described as "recommendations" or "guidelines", but as actions EAS Participants "must" or "are required" to take. A copy of the FCC release can be found here, but the full text is below:

Urgent Advisory: Immediate actions to be taken regarding CAP EAS device security.

All EAS Participants are required to take immediate action to secure their CAP EAS equipment, including resetting passwords, and ensuring CAP EAS equipment is secured behind properly configured firewalls and other defensive measures. All CAP EAS equipment manufacturer models are included in this advisory.

All Broadcast and Cable EAS Participants are urged to take the following actions immediately

  1. EAS Participants must change all passwords on their CAP EAS equipment from default factory settings, including administrator and user accounts.
  2. EAS Participants are also urged to ensure that their firewalls and other solutions are properly configured and up-to-date.
  3. EAS Participants are further advised to examine their CAP EAS equipment to ensure that no unauthorized alerts or messages have been set (queued) for future transmission.
  4. If you are unable to reset the default passwords on your equipment, you may consider disconnecting your device's Ethernet connection until those settings have been updated.
  5. EAS Participants that have questions about securing their equipment should consult their equipment manufacturer.

I'll have more to say about the zombie apocalypse in the next few days, as I was already writing a post on the subject when the FCC release arrived. However, I wanted to get the FCC's message out to broadcasters, cable operators, and other EAS Participants quickly, so that they can take action to prevent further hoax alerts, as well as be aware of the seriousness with which the FCC is taking these false alerts. Management should make sure that their staff is on alert for unusual EAS activity, particularly during major events coverage.

While the farcical nature of the initial hoax caused more amusement than panic, it is easy to see how a more realistic message could have caused far more damage. Yesterday's events will hopefully be isolated incidents, but we will be seeing a lot more attention focused on the security, as opposed to the reliability, of the EAS system.

Comments