Station Compliance›Field Notes

§ 11.35(d) is not a rule about your EAS box. It covers the EAS equipment, the studio-transmitter link, and "any remotely managed equipment that routes, processes, or inserts content" into your programming. Together that is the program chain, and you cannot secure a list you have never made.

Making it is not engineering work. It is an inventory. You need the router's admin login, a phone on cellular data, and an afternoon when nothing is going on air live.

The one test for every box

For each piece of equipment, ask two questions:

1. Can it be managed remotely? A web page, an app, a vendor portal, remote desktop, a telnet or SSH login. Anything other than walking up to it and pressing buttons.
2. Can it change what goes out over the air? Route the audio, process it, insert into it, or stop it.

If the answer to both is yes, it is in scope, whatever kind of box it is and whoever installed it. If you are unsure, count it in. Listing a device you did not need costs nothing. Missing one you did is how the rule gets failed.

Follow the audio

Start where the programming starts and follow it to the antenna, writing down every box it passes through. For most small radio stations the main line looks like this:

• Automation or playout computer, and the software on it if it has a web or remote interface
• Console or studio router, if it has network control
• Air-chain audio processor
• EAS encoder/decoder, wherever it is inserted into the chain
• STL, including any codec pair, and the backup path if you have one
• Transmitter remote control, and the transmitter or exciter itself if it is on the network

Then go back and follow each branch that comes off that line. Branches are where devices get missed, because nobody thinks of them as "the air chain":

• RDS encoder
• Stream processor and streaming encoder, hardware or software
• Satellite receiver, if it is managed over the network
• Voice-tracking or remote contribution systems
• Remote broadcast codecs, including the ones packed in a road case. A codec that only comes out for the county fair still has a password, and it is the one least likely to have been changed.

Anything powered and networked counts, even if it is racked and unused. Dormant equipment is the least likely to have current firmware and the most likely to still have its factory password.

What to write down for each one

One line per device is enough. For each:

The "how it is reached" column is the one that matters most. A box that can only be reached from inside the building is a much smaller problem than one with a forwarded port.

Then read the router

Log into the router or firewall that the station's network sits behind and find the port forwarding list. It may be called virtual servers, NAT rules or applications. Every rule on it sends traffic from the internet to a device inside.

Match each rule to a line on your list. You will usually find one of three things:

• A rule you can explain and still need. Note what it is for.
• A rule for a device that is gone, or a job that ended. Delete it.
• A rule pointing at an address you do not recognize. Find out what is at that address before you do anything else. That is the device nobody listed.

Then test it from outside. Turn off Wi-Fi on your phone, so it is on cellular data, and try to open each forwarded device's management page using the station's public address. Anything that loads a login screen is reachable from anywhere in the world.

The parts that are not boxes

Two kinds of access reach your chain without being a device in your rack, and they are the ones most often missed:

• Vendor cloud and remote-management portals. Codec management services, transmitter monitoring sites, streaming dashboards. Each is an account that can reach your equipment from anywhere.
• Other people's logins. The integrator who commissioned the automation, the engineer who covers when you travel, the staff member who left last year. These often still work, and some of them live at the vendor rather than on any device you control.

Add each one to the list as its own line, with who holds it.

Remote desktop tools belong here too. If anyone can reach the automation computer from home, that tool is part of the chain.

What you have when you finish

A single page that lists every box and every account on your program chain, how each is reached and who can get in. That page is what the rest of the rule is done against: the passwords get set from it, the firmware gets checked from it, and the firewall work starts from the port-forwarding notes on it.

It is useful twice more this fall. ETRS Form One, due October 30, asks about your EAS equipment, so the make, model and firmware are already in front of you. And before the National EAS Test on November 17, the FCC's notice asks every station to bring its EAS unit's software and firmware up to date.

Keep the page somewhere the next person can find it. The person who answers questions about this two years from now may not be the person who did the work.

The short version

• In scope: anything that can be managed remotely and can change what airs.
• Follow the audio from the studio to the antenna, then follow every branch: RDS, the stream, remotes, satellite.
• Write down the model, firmware, how it is reached and who has a login. Never the password itself.
• Read the router's port-forwarding list and explain every rule. Test from a phone on cellular data.
• Add the vendor portals and other people's logins as their own lines.

The kit has this inventory as a ready-made worksheet, along with the port-forwarding audit and a device reference for common broadcast gear, so the list turns straight into the fixes.