At its regular monthly open meeting last week, the FCC adopted an Order meant to enhance the security of the Emergency Alerting System.  Citing past hacks of the system that have resulted in false EAS alerts being transmitted to the public by broadcast stations, the FCC proposed in 2022 that broadcasters adopt a comprehensive cybersecurity plan with an annual filing requirement detailing how risks were managed and controlled (see our article here).  The Order adopted this week did not go that far, but it did adopt a mandatory three-point plan to secure not only EAS equipment at a station, but also to secure the entire program chain to ensure that bad actors can’t access station programming to insert false emergency information or other malicious content. 

While the first two requirements of the mandated plan should be relatively simple for broadcasters to quickly implement, the third may require some outside help – and the FCC has given broadcasters only a short time to implement this requirement.  The Order requires implementation within 60 days of the date that the Order is published in the Federal Register (see the just-released FCC Erratum correcting the Order to reiterate that the effective date will be 60 days after Federal Register publication).  As Federal Register publication should come soon, the Order requires quick action by broadcasters.  Let’s look at the new obligations.