Station Compliance›Field Notes

FCC 26-38 is two documents in one binding. The first half is the Report and Order that created § 11.35(d) and the September 29 deadline. The second half is a Further Notice of Proposed Rulemaking, and it is the part nobody at a small station has read.

It is worth twenty minutes, because it is where the Commission signals what your next equipment purchase should be able to do.

What the Commission proposed

The order lists five directions in its introduction.

Authenticate alerts before they are transmitted. The headline proposal, and the logical successor to § 11.35(d). Securing station equipment stops an attacker who gets into your rack; authenticating alerts stops a forged alert that arrives looking legitimate. The Commission proposes requiring EAS Participants to reject alerts that fail authentication.

A universal alert identification number. A single ID carried across systems so duplicate alerts can be detected and blocked, and so a WEA reaches people who enter an alert area after the alert was first sent, until the emergency ends.

Better geographic accuracy. Eliminating what the Commission calls outdated WEA geotargeting exceptions that cause alerts to land in the wrong places, and expanding geotargeting options for EAS.

Alerts that communicate faster. Seeking comment on symbols matched to the emergency type, and on making earthquake alerts more attention-grabbing.

Removing outdated requirements — including the two that matter most to broadcasters below.

The one that changes your capital planning

Buried in the last bullet: the Commission proposes allowing EAS capabilities to be implemented in software instead of hardware.

For a small station this is potentially the most consequential thing in the document. The current model is a dedicated encoder/decoder box from a small number of manufacturers, at a price that is a meaningful line item for a station running on a shoestring. A software path changes that market.

The Commission is not naive about the tradeoff, and its own reasoning is worth quoting because it will shape whatever rule emerges. It observes that unlike physical devices, "software platforms have large attack surfaces, including APIs, databases, and remote" interfaces, and that EAS software "may be more prone to cyberattack by virtue of its IP interconnectedness."

So the likely shape of any software-EAS rule is permission plus conditions — and the conditions will look like § 11.35(d) with more teeth. A station that gets its network segmentation right this year is a station that can adopt software EAS when it arrives. One that cannot demonstrate a secured program chain will find the door open and be unable to walk through it.

The Further Notice also tentatively concludes on a 72-hour figure in the context of software resilience against ransomware, viruses and other attacks — a signal that availability requirements will come attached.

The practical advice: do not buy hardware on the assumption software is imminent, and do not delay compliance waiting for it. A Further Notice is the beginning of a process, not the end. But if you are scoping a five-year equipment plan, put a marker down.

The other retirement: 90-character WEA

The Commission proposes retiring the 90-character maximum versions of WEA messages. This is a carrier-side matter more than a broadcaster one, but it is a useful indicator of direction: the alerting system is being modernised toward richer messages, and the constraints written for 2012 handsets are coming off.

Why authentication is the real successor to your compliance work

The Commission's framing of the security problem has two halves, and it has now addressed one.

§ 11.35(d) protects the station: your equipment, your credentials, your network boundary. It stops the attacks in the FCC's footnote trail, which all ran through an exposed management interface.

Alert authentication protects the system: it ensures the alert your equipment receives and relays is genuine. The order notes that when the Commission examined this in 2018 it determined legacy EAS may be vulnerable to attack, and the Further Notice asks hard questions about how far authentication can go — whether the audio portion of an EAS message remains susceptible to manipulation and replay even if the header is authenticated.

That question does not have a settled answer, which is why it is a Further Notice and not a rule.

What a small station should actually do about this

Very little, immediately, and that is the honest answer.

1. Finish § 11.35(d). It is a rule with a date. The Further Notice is a conversation.
2. File a comment if you have something specific to say. Comments were due 30 days after Federal Register publication, replies 60 days. Small-station perspectives are genuinely underrepresented in these proceedings — the record for this order leaned heavily on trade associations and large groups, and the Commission quoted the few individual broadcasters who wrote in.
3. Ask "can this be updated?" of anything you buy. Whatever emerges from this docket, software updates will be part of complying with it. Equipment that cannot accept a firmware update is equipment with a compliance expiry date.
4. Do not pay for anything on the strength of a proposal.

If you want the current obligations rather than the proposed ones, the rule reference covers § 11.35(d) as adopted, and the small-station exemption question covers who it applies to.