Station Compliance›Field Notes
EAS Security
Somebody has probably quoted you a fine figure for this. It is worth knowing where that number came from, because it almost certainly attaches to a different rule.
By Mark Shannon ·
Let me start with the honest answer, because it is more useful than the confident one.
Section 11.35(d) has no enforcement history. The rule was adopted June 25, 2026 and took effect September 29, 2026. As of this writing no station has been fined under it, no Notice of Apparent Liability has been issued under it, and no consent decree mentions it. Anyone quoting you a specific dollar figure for violating this rule is extrapolating from something else, and it is worth knowing what.
That is not a reason to ignore the rule. It is a reason to be accurate about it.
If you have heard "$10,000" attached to this deadline, that figure is almost certainly borrowed from public file enforcement, where the Commission has issued a great many penalties in that range for missing quarterly issues/programs lists. It is a real number. It attaches to a different rule.
The base forfeiture amounts are published, at 47 CFR § 1.80. The one closest to this subject is:
EAS equipment not installed or operational — $8,000
That is a base amount, and the word does real work. The Commission adjusts upward or downward for the circumstances: how long it went on, how many people heard it, whether the station self-reported, whether anyone was misled, and whether the licensee can pay at all. Base amounts are a starting point in a negotiation, not a price list.
For context on the ceiling rather than the floor, the statutory maximum for a broadcast licensee currently runs to $62,829 per violation, with a cap near $628,305 for a single continuing act. Those are the outer bounds of the Commission's authority, not what a small station should expect for a late password change.
Note what the $8,000 line actually covers: equipment not installed or operational. A station with a working EAS unit that has a weak password is not obviously described by that entry. § 11.35(d) is new enough that where it lands in the forfeiture schedule has not been tested. That uncertainty runs in both directions.
The Commission does enforce Part 11, and reasonably hard. But look at what the cases are about.
Corridor Television L.L.P. (KCWX, Fredericksburg, Texas) — $369,190 proposed, January 8, 2025. The largest recent EAS penalty by a wide margin. The violations: failure to participate in Nationwide EAS Testing over roughly three years, failure to file the required ETRS forms, and misrepresentation in the ETRS filings that were made. Not a security failure. A filing-and-testing failure, aggravated substantially by the false certifications.
Entercom (WNEW-FM) — $20,000. Unauthorized transmission of EAS tones.
ESPN — $20,000 proposed. An alert tone in programming with no emergency, authorised test, or PSA behind it.
A cable sports network — $146,976. False EAS tones.
Three of those four are § 11.45 cases — the prohibition on transmitting false or deceptive EAS tones. The fourth is about testing and filing. None of them is about securing equipment, because until this year there was no rule requiring it.
Two things, and they point in opposite directions.
The reassuring one: the Commission's EAS enforcement has concentrated on conduct that is visible from outside the building — a tone that went out over the air, a test that did not happen, a form that was filed falsely. A weak password on a rack unit is visible to nobody until something happens. There is no audit programme for § 11.35(d), no certification to fail, and no database that surfaces non-compliance. The realistic near-term probability of a station being fined purely for having a short password is low.
The one that should worry you more: the largest penalty on that list was driven by misrepresentation, not by the underlying violation. Corridor's testing failures alone would have been a fraction of $369,190. What multiplied it was telling the Commission something untrue about them.
That matters here because § 11.35(d) has no filing — which means there is almost no way to misrepresent your compliance until someone asks you directly. If an inspection or an incident investigation ever puts that question to you, the answer you give is the one that carries the enforcement risk, far more than the password itself did.
Not an audit. An incident.
The Commission wrote this rule on a documented record of stations being hijacked — real intrusions, real false content on real air. If that happens to you, the question is no longer whether a rule was technically met. It is an investigation, and your compliance posture becomes the difference between an unfortunate event and a culpable one.
That is the asymmetry worth planning around. The cost of compliance is an afternoon and possibly a firewall. The cost of non-compliance is close to zero right up until the moment it is not, and you do not control when that moment arrives.
Something like this, which has the advantage of being true:
There is no fine schedule for this rule yet, and nobody can tell you what it would cost, because nobody has been penalised under it. The base amount for the nearest existing EAS entry is $8,000, adjustable. The real exposure is not a routine fine — it is what happens if we get hijacked and the investigation finds we had not done the three things the rule asked for. The three things take an afternoon.
If somebody tries to sell you this deadline with a scary number, ask them which rule the number comes from. It is a fair question and it has a specific answer.
The free reference on § 11.35(d) walks the rule text line by line. If you are past the deadline, start here instead.
Everything on this site is free to read. The Program Chain Compliance Kit is the implementation version — the device-by-device reference, the network patterns for a one-rack station, and the worksheets that leave a paper trail behind the work.
The rules on this site change without warning — a deadline gets waived, a filing window opens, a Public Notice lands on a Friday. Leave an address and you get an email when something changes that affects a small station. Nothing else, and one click to leave.