Station Compliance›Field Notes

Most coverage of the FCC's new program chain security rule has been written for radio, including a good deal of what is on this site. That is a reasonable starting point — the documented hijackings that produced the rule were radio incidents, running through STL boxes with factory passwords.

But the rule was not written for radio, and reading it as a radio rule causes television stations to under-count what is in scope. A TV plant has more devices inside § 11.35(d) than a radio plant does, and the reason is a requirement television has carried for years.

The scope language

§ 11.35(d) applies to EAS equipment, studio transmitter link equipment, and:

any remotely managed equipment that routes, processes, or inserts content into the transmission of the EAS Participant's programming

Three verbs — routes, processes, inserts. In radio these mostly describe audio devices. In television they describe audio and video, which roughly doubles the equipment list before you have thought about anything unusual.

The requirement that forces the issue

Television does not merely happen to have video insertion equipment in the air path. It is required to.

Under § 11.51(d), a television station transmitting an EAS message must transmit a visual message carrying the originator, event, location and valid time period. The rule goes further and specifies how: at the top of the screen or where it will not interfere with other visual messages, readily readable and understandable, without overlapping lines or text running past the viewable display, and displayed in full at least once during the message.

Something has to render that text onto the picture. Depending on the plant it is a character generator, a dedicated crawl inserter, a keyer in master control, or the video output of the EAS box itself.

Whatever it is, it is inserting content into the transmission of your programming. That is not an inference about the rule's intent. It is the rule's own words applied to a device whose entire function is described by them.

Why this device in particular gets missed

It has an unusual combination of properties, all of which push it off the inventory:

• It is not thought of as a network device. It lives in the video world, on the wall of the rack where video gear lives, and the person auditing network exposure is thinking about servers.
• It was commissioned by a vendor. Set up once, years ago, by somebody who is not on staff and who chose the password.
• It is boring until it is not. A crawl inserter demands attention only when the crawl is wrong, which is rare.
• It is deliberately remotely reachable. A stuck crawl is a visible, embarrassing, on-air fault, so somebody made sure it could be fixed from home — often by forwarding a port.
• It has a web interface. Which is to say: it has a login, and that login has a default.

Every one of those is also a description of the Barix units the FCC cited in the incidents that produced this rule. Same shape of problem, different rack.

What an attacker does with it

Worth being concrete, because the risk here is not abstract.

The documented radio attacks put unauthorised audio on transmitters — alert tones, an offensive song, promotional content. A compromised crawl inserter puts unauthorised text over the picture, on a device whose legitimate purpose is displaying emergency messages.

That is a more credible-looking false alert than anything achievable on radio, because viewers are conditioned to trust text at the top of the screen during an emergency, and because the device is doing exactly what it normally does. Nothing about the output looks wrong.

The rest of the television list

While the crawl inserter is the one most likely to be missed, the full scope in a TV plant is longer than most stations assume: master control switcher, playout automation and video servers, routers in the air path, encoder and multiplexer, PSIP generator, captioning encoder, STL at both ends, transmitter remote control and exciter, and — in an ATSC 3.0 facility — the gateway and broadcast core, which are IP-native by design.

The TV scope guide walks all of it device by device.

What to do this week

1. Find out what puts EAS text on your picture. Name the device. If nobody can, that is the finding.
2. Check whether it has a password set, and whether that password is the vendor's default or shared with anything else. § 11.35(d) requires 15 characters with no dictionary words, not reused anywhere else in the facility.
3. Check whether it is reachable from outside the building. If there is a port-forwarding rule pointing at it, that rule is the problem, and a VPN is the replacement.
4. Add it to the inventory permanently, so the next person does not have to rediscover it.

There is nothing to file — § 11.35(d) carries no reporting obligation. The deadline is September 29, 2026, and the obligation is to have done the work.

The rule reference covers all three requirements, and the small-station exemption question covers who this applies to, which is every EAS Participant including every television licensee.