Cybersecurity and the Emergency Alert System: New Rules, Real Deadlines

The box in your rack that can interrupt every program you air is, in most LPTV facilities, the least-patched device in the building.

October is Cybersecurity Awareness Month, which in broadcasting usually produces a round of advice about phishing training and password managers. Useful, and beside the point. The specific asset that makes a television station a target isn’t its email. It’s the encoder-decoder that sits in the air chain with authority to take over the transmission and address the public in the voice of the government.

The Commission has been working on this problem. On June 25, 2026, it adopted a Report and Order modernizing the nation’s alerting systems (FCC 26-38, PS Docket Nos. 25-224 and 22-329). The new EAS security rules took effect September 29. Every LPTV and Class A operator should read the order and confirm what applies to their station directly against it and the FCC’s follow-up guidance, rather than relying on a summary, including this one.

The Threat Model Isn’t Abstract

A compromised business system costs a station money and time. A compromised EAS device costs the station something it can’t buy back: the public’s willingness to believe the next alert. False activations are corrosive in a way that scales badly. If a community learns that a warning on television might be somebody’s idea of a joke, the hesitation that creates on a real day is measured in lives.

The vulnerability profile is familiar to anyone who has walked a small master control. EAS units are appliances. They get installed, configured once, and then they sit for years because nothing about them looks broken. Firmware goes unpatched because updating the device means touching the air chain. Default credentials survive because the person who set the unit up has moved on. Management interfaces end up reachable from networks that were never supposed to reach them, often because a remote-access arrangement made sense to a contractor at the time.

None of that is negligence in the way a lawyer would use the word. It’s what happens when a resource-constrained facility treats a compliance appliance as furniture.

What the Commission Now Requires

Read the order for the operative language, but the baseline in effect since September 29 comes down to three practices:

• Passwords. Change default passwords before the equipment is used to reach the public. New passwords must be at least 15 characters, avoid dictionary words and not be reused elsewhere, and must be changed when there’s reason to think one has been compromised. Authentication that is equally or more secure can be used instead.
• Patches. Install security patches and security-related updates promptly after they become available. You can test first, as long as testing starts promptly and wraps up on a reasonable schedule.
• Remote access. Use a firewall or comparable network segmentation so that only authorized devices and users can reach the equipment for remote management.

The same order carried a Further Notice that looks ahead. Among other things, the Commission proposed requiring EAS Participants to reject CAP-based alerts that lack a valid digital signature, and asked whether legacy alerts should be signed too. That comment cycle closed in September. Authentication is the structural fix for false alerts, and it’s worth planning for now.

Compliance questions in this area turn on the details: which devices count, what “promptly” means for your setup, what your records need to show. Treat any date or rule you hear at a conference or read in a vendor email as a lead to verify, not a fact. Check the order and the FCC’s guidance, and have your FCC attorney confirm what applies to your class of station.

Dates on the Calendar

The cybersecurity rules aren’t the only EAS obligation this fall. Under the Bureau’s Public Notice (DA 26-989), ETRS Form One is due October 30. FEMA and the FCC will run a nationwide EAS test on November 17 at 2:20 p.m. ET, with December 3 as the backup date. ETRS Form Two is due by 2:20 p.m. ET on November 19, and Form Three by January 4, 2027. LPTV stations are EAS Participants and must air the test.

The Small-Station Problem

Large groups have information security staff. Our members generally have a chief engineer who is also the IT department, the facilities manager, and occasionally the guy who plows the access road.

That shapes what good advice looks like. The answer isn’t an enterprise security program. It’s a short list of things that remove most of the realistic risk at close to zero capital cost:

• Get the alerting device off any network path reachable from the public internet, and confirm it by testing from outside rather than trusting the topology diagram.
• Change every default credential, on the EAS unit and on every device that shares its network segment, and store the new ones somewhere that survives an engineer’s departure.
• Subscribe to your manufacturer’s security notification list and apply firmware updates on a schedule you write down, not when something breaks.
• Put alerting equipment on its own VLAN, separated from office traffic, traffic and billing systems, and anything a salesperson plugs a laptop into.
• Keep a written log of configuration changes, firmware versions and test results, so you can show what you did and when.

That list isn’t sophisticated. Most successful attacks on broadcast infrastructure don’t require sophistication either.

Security Is Becoming a General Condition of the ATSC 3.0 Era

ATSC 3.0, marketed to consumers as NextGen TV, moves the entire air chain onto internet protocol. That’s what makes datacasting, targeted advertising and advanced emergency alerting possible. It also means a modern broadcast facility has an attack surface an 8VSB plant didn’t. Gateways, schedulers, encoders and return-path systems are networked computers, and they should be run like networked computers.

The standards work has anticipated this. ATSC’s recommended practice on digital rights management, A/362, is built around the principle that the broadcaster holds the keys to its own content and services. Same principle, different domain. Security architecture and control of the platform are the same subject seen from two angles.

It’s also why ATBA keeps returning to the question of who operates the platform. A station that controls its own transmission, its own multiplex and its own alerting workflow can secure them and answer for them. A station that has handed operational control of its spectrum to a third party is accountable to the Commission for systems it doesn’t administer. The Spectrum We Cannot Afford to Give Away is usually read as a spectrum policy piece. It’s also a governance piece.

What This Means for Your Station

This month, do a physical inventory. Walk the rack, write down every device involved in receiving, generating or transmitting an alert, and record its make, model, firmware version and network address. Most operators find at least one thing on that walk they didn’t know was connected.

Then pull the order and build a one-page compliance calendar for your own facility: each obligation, the date you’ve verified it applies, and the name of the person responsible. Verify those dates. Don’t inherit them from a trade article.

Then test. Run a scheduled test, document the result, and file the documentation where a successor could find it.

The Emergency Alert System is the clearest expression of why broadcast licenses exist in the first place. Defending it as a technical asset is how we keep defending it as a policy argument.