Working Group 2: Emergency Alerting Platforms Status Update December 3, 2015 Farrokh Khatibi, Co-Chair (Qualcomm) Francisco Sánchez, Jr., Co-Chair (Harris County, Texas)

2 WG2 Objectives Working Group Description: WG2 is reviewing current Wireless Emergency Alert (WEA) security practices and recommend actions, including development of best practices. The review will cover end-to-end security aspects of WEA including the integrity of the C-interface, insuring the integrity of the WEA message as it transverses across the carrier networks and security of message data on handsets. Consideration will be given to new technologies and cyber risks to WEA. WG2 will provide recommendations to encourage local and state use of alerts across multiple platforms, examine technology opportunities to overcome barriers, identify paths for people to push information to officials and seek ways to improve public safety outcomes.

3 WG2 Deliverables Deliverables: Recommendation to the Commission on WEA security (Due: March 2016) Recommendation to the Commission on state/local use of “one-to-many” and “many-to-one” public communication systems (Due: September 2016)

4 WG2 Members NameCompany Farrokh Khatibi (Co-Chair)Qualcomm Technology Inc. Francisco Sanchez (Co-Chair)Harris Co. (TX) Emergency Management Hutch McClendonAdvanced Computer and Communications Brian DalyAT&T Peter MusgroveAT&T (ATIS) Caitlin ShockeyCenters for Disease Control James TysonCenters for Disease Control Jose RiveraDHS Denis A. GustyDHS, S&T/FRG Alexander GerdenitschEchostar Jennifer MannerEchostar Scott EnrightEmmis Communications Chris TarantinoEpicenter Alfred KenyonFEMA IPAWS Mark LuceroFEMA IPAWS Matthew StraebGSS Net Brian MurrayHarris County Office of Homeland Security & Emergency Management

5 WG2 Members (Cont.) NameCompany Tony SurmaHumanitarian Toolbox Bob SherryIntrado David LayerNAB Larry WalkeNAB Mike GerberNOAA/NWS Robert BungeNOAA/NWS Steve MaceNCTA Dana GolubPBS Mark D. AnnasRiverside (CA) Fire Dept Carol WoodySoftware Engineering Institute Brad GauntSprint John DavisSprint Keith BhatiaTCS Shelley BlakeneyT-Mobile Tim DunnT-Mobile Taelor HardestyUniveristy of Houston Jeannett SuttonUniversity of Kentucy Larry RybarVerizon

6 – Had several bi-weekly virtual meetings, developing draft report on WEA security – Presentation made by: PBS WARN Cybersecurity Engineering CERT Division, Carnegie Mellon University SEI – Members have volunteered to complete sections of the report – Contributions are being reviewed and incorporated into the report Security Subworking Status

7 Security Subworking Overview Alert Originators IPAWSCMSPs Alert Recipients Alert Originators: the people, information, technology, and facilities that initiate and create an alert, define a target distribution area (i.e., targeted geographic area), and convert the alert information into the appropriate format for dissemination Integrated Public Alert and Warning System (IPAWS): a collection of FEMA systems that receives, validates, authenticates, and routes various types of alerts to the appropriate disseminator, such as WEA, the Emergency Alert System, or the National Oceanic and Atmospheric Administration Commercial mobile service providers (CMSPs): commercial wireless carriers that broadcast WEA messages to a designated geographic area. Alert Recipients: the WEA-capable mobile devices located in the targeted alert area

8 – Construct security risk scenarios – Identify security threats and vulnerabilities – Analyze potential risks Probability Impact Risk exposure – Propose mitigation plans Security Subworking Methodology

9 Security Subworking Next Steps Continue with the analysis of potential security risks and ways to mitigate them for each element of the WEA chain Incorporate the findings in the report Final report review in early March Due to CSRIC on March 16

10 WG2 Subworking Group - Alerting Objective Multiple alerting aspects to be studied relating to: Wireless Emergency Alerts Mass notification systems Social media Focus on geo-targeting Identify barriers and solutions Best practices IMPROVE PUBLIC SAFETY OUTCOMES

11 Alerting Subworking Group Deliverable Goals Promote the use of emergency alerts by local/state officials at the geo-targeting level Leveraging various alerting platforms (WEA, EAS, social media, mass notification) Identify technical barriers and solutions Development of use standards, based on best practices and established sociology that improve public safety outcomes Consider “many-to-one” and “one-to-many” solutions to enhance situational awareness and improve direct communication

12 Alerting Subworking Group Study Approach Current status – what is the current state of practice Best practices – as identified by practitioners, developers and researchers Way forward – based on a better understanding, next steps and strategic options Recommendations to the full CSRIC and FCC

13 Alerting Subworking Group The Team Traditional Stakeholders Private Sector Local, state, federal government Special outreach: – Researchers and academics – Social media – Other similar initiatives

14 Alerting Subworking Group Meetings to Date Introduction and orientation Review of recent research Deaf and hard of hearing, functional access needs

15 Alerting Subworking Group Next Steps Continue presentations and education Fine tune objectives and expectations Assign responsibilities Draft report by late spring/early summer Final document ready for review by mid-summer Due to CSRIC – September 2016