Station Compliance›FCC Watch

The most useful FCC document on § 11.35(d) since the order itself. On Monday, September 21, the Public Safety and Homeland Security Bureau posted a page of answers to the questions stations had been asking.

What it settles

Scope. The rule covers EAS equipment, STL equipment, and remotely managed equipment that "routes, processes, or inserts content" into the program stream — the FAQ's examples are audio processors, ad insertion, and remotely managed AM, FM and DTV transmitters. Remotely managed gear that does none of those things is not covered. Scope, device by device.

Dictionary words. A single dictionary word cannot be a compliant password on its own, however long, because single words fall quickly to brute force. Dictionary words are fine inside a multiword passphrase of 15 characters or more.

Firewalls do not count toward the password. A firewall or VPN in front of a device "is not sufficient for compliance" — even one with a strong password of its own. The device itself still needs a strong password or an equivalent.

Gear that cannot take 15 characters. Three routes, in order: an alternative authentication method on the device that meets NIST's standards (one-time passwords, look-up secrets, an out-of-band device, cryptographic authentication); if that is not possible, replace the device — unless the station obtains a waiver. The password requirement in detail.

End-of-life equipment. The rule does not require you to replace gear that no longer receives patches, but the Bureau "strongly encourages" it.

One petition to know about

On September 25, WYRS Broadcasting, a noncommercial licensee in New Jersey, filed a petition asking the Commission to reconsider and give noncommercial stations one more year to comply (ECFS). The FCC has not acted on it. Until it does, the date is the date.