Working Group 2: Emergency Alerting Platforms

Status UpdateDecember 3, 2015

Farrokh Khatibi, Co-Chair (Qualcomm)Francisco Sánchez, Jr., Co-Chair (Harris County, Texas)

2

WG2 Objectives Working Group Description: • WG2 is reviewing current Wireless Emergency Alert (WEA) security

practices and recommend actions, including development of best practices. The review will cover end-to-end security aspects of WEA including the integrity of the C-interface, insuring the integrity of the WEA message as it transverses across the carrier networks and security of message data on handsets. Consideration will be given to new technologies and cyber risks to WEA.

• WG2 will provide recommendations to encourage local and state use of alerts across multiple platforms, examine technology opportunities to overcome barriers, identify paths for people to push information to officials and seek ways to improve public safety outcomes.

3

WG2 Deliverables

Deliverables:

• Recommendation to the Commission on WEA security (Due: March 2016)

• Recommendation to the Commission on state/local use of “one-to-many” and “many-to-one” public communication systems (Due: September 2016)

4

WG2 MembersName CompanyFarrokh Khatibi (Co-Chair) Qualcomm Technology Inc.Francisco Sanchez (Co-Chair) Harris Co. (TX) Emergency ManagementHutch McClendon Advanced Computer and CommunicationsBrian Daly AT&TPeter Musgrove AT&T (ATIS)Caitlin Shockey Centers for Disease ControlJames Tyson Centers for Disease ControlJose Rivera DHSDenis A. Gusty DHS, S&T/FRGAlexander Gerdenitsch EchostarJennifer Manner EchostarScott Enright Emmis CommunicationsChris Tarantino EpicenterAlfred Kenyon FEMA IPAWSMark Lucero FEMA IPAWSMatthew Straeb GSS NetBrian Murray Harris County Office of Homeland Security &

Emergency Management

5

WG2 Members (Cont.)Name CompanyTony Surma Humanitarian ToolboxBob Sherry IntradoDavid Layer NABLarry Walke NABMike Gerber NOAA/NWSRobert Bunge NOAA/NWSSteve Mace NCTADana Golub PBSMark D. Annas Riverside (CA) Fire DeptCarol Woody Software Engineering InstituteBrad Gaunt SprintJohn Davis SprintKeith Bhatia TCSShelley Blakeney T-MobileTim Dunn T-MobileTaelor Hardesty Univeristy of HoustonJeannett Sutton University of KentucyLarry Rybar Verizon

6

–Had several bi-weekly virtual meetings, developing draft report on WEA security–Presentation made by:• PBS WARN• Cybersecurity Engineering CERT Division, Carnegie Mellon

University SEI–Members have volunteered to complete sections of

the report–Contributions are being reviewed and incorporated

into the report

Security Subworking Status

7

Security Subworking Overview

Alert Originators IPAWS CMSPs Alert Recipients

Alert Originators: the people, information, technology, and facilities that initiate and create an alert, define a target distribution area (i.e., targeted geographic area), and convert the alert information into the appropriate format for dissemination

Integrated Public Alert and Warning System (IPAWS): a collection of FEMA systems that receives, validates, authenticates, and routes various types of alerts to the appropriate disseminator, such as WEA, the Emergency Alert System, or the National Oceanic and Atmospheric Administration

Commercial mobile service providers (CMSPs): commercial wireless carriers that broadcast WEA messages to a designated geographic area.

Alert Recipients: the WEA-capable mobile devices located in the targeted alert area

8

–Construct security risk scenarios–Identify security threats and vulnerabilities–Analyze potential risks• Probability• Impact• Risk exposure

–Propose mitigation plans

Security Subworking Methodology

9

Security Subworking Next Steps

• Continue with the analysis of potential security risks and ways to mitigate them for each element of the WEA chain• Incorporate the findings in the report• Final report review in early March• Due to CSRIC on March 16

10

WG2 Subworking Group - Alerting Objective

Multiple alerting aspects to be studied relating to:• Wireless Emergency Alerts• Mass notification systems• Social media• Focus on geo-targeting• Identify barriers and solutions• Best practices• IMPROVE PUBLIC SAFETY OUTCOMES

11

Alerting Subworking Group Deliverable Goals

• Promote the use of emergency alerts by local/state officials at the geo-targeting level

• Leveraging various alerting platforms (WEA, EAS, social media, mass notification)

• Identify technical barriers and solutions• Development of use standards, based on best practices and

established sociology that improve public safety outcomes• Consider “many-to-one” and “one-to-many” solutions to

enhance situational awareness and improve direct communication

12

Alerting Subworking Group Study Approach

• Current status – what is the current state of practice• Best practices – as identified by practitioners, developers and

researchers• Way forward – based on a better understanding, next steps

and strategic options• Recommendations to the full CSRIC and FCC

13

Alerting Subworking Group The Team

• Traditional Stakeholders• Private Sector• Local, state, federal government• Special outreach:

– Researchers and academics– Social media– Other similar initiatives

14

Alerting Subworking Group Meetings to Date

• Introduction and orientation• Review of recent research• Deaf and hard of hearing, functional access needs

15

Alerting Subworking Group Next Steps

• Continue presentations and education• Fine tune objectives and expectations• Assign responsibilities• Draft report by late spring/early summer• Final document ready for review by mid-summer• Due to CSRIC – September 2016