"Any vulnerability in systems like the Emergency Alert System “can have serious consequences,” said FCC Commissioner Olivia Trusty in a statement after the vote.
Strengthening the Emergency Alert System and Wireless Emergency Alerts
The Federal Communications Commission on Thursday approved new rules aimed at hardening the nation’s two primary public-warning platforms: the Emergency Alert System (EAS) and Wireless Emergency Alerts (WEA). The EAS delivers weather, AMBER and other urgent messages via radio and television broadcasters; WEA carries similar messages via text. The FCC framed the changes as a response to the risk that a compromise of either system — by "a foreign government, cybercriminal group or other rogue actor" — could be used to sow chaos and disinformation or to impede coordination during a genuine emergency.
Authentication ID and basic cyber hygiene for alert infrastructure
Among the measures, the Commission required EAS and WEA participants to adopt what the agency called “basic — but still critical — cyber hygiene practices.” The rules compel use of strong passwords, rapid installation of vendor security patches, and firewalls to limit access to equipment. The FCC also created a new authentication ID system designed to verify alerts before submission and to prevent duplicate or unauthorized alerts from spreading.
Submarine cable regulation updated for the first time in decades
The same vote produced what the FCC described as the first comprehensive update to its submarine cable regulations in decades. The ruleset both tightens cybersecurity requirements in some areas and loosens them in others. A central change is a presumptive exemption from the Commission’s customary national security licensing review — known as “Team Telecom” — for undersea cable license applicants who can self-certify to “high security standards” that are “structured to increase certainty, predictability, and faster timelines for the licensing process.”
Team Telecom referrals, new equipment licensing, and supply-chain safeguards
The FCC summarized the change this way: “Currently, all submarine cable applications get referred to Team Telecom…the changes adopted would exempt applications from applicants that have operated cables without incident, can certify to the highest national security standards, and agree to ongoing oversight and monitoring.” The source describes Team Telecom as an interagency body led by the Department of Justice’s Foreign Investment Review Section and other federal agencies that advise the FCC on national-security implications.
The rule also gives the FCC greater oversight over key functions in undersea cable operations. Owners and operators of submarine line terminal equipment — the systems that connect submarine cables to land-based facilities in the U.S. — will face a new licensing requirement. In addition, the FCC moved to update safeguards addressing vulnerabilities tied to principal equipment, third-party service providers, and other elements of the undersea cable supply chain.
What this means for technologists, policymakers, and the public
- Technologists and security teams: Must implement the specified cyber hygiene measures for EAS and WEA (strong passwords, timely patching, and firewall controls) and prepare to integrate the new authentication ID system for alerts. For submarine cable technicians and operators, the ruling adds a licensing requirement for submarine line terminal equipment and tighter supply-chain safeguards in some areas.
- Policymakers and regulators: Will see a shift in process via presumptive exemptions from Team Telecom referrals when applicants self-certify to “high security standards,” which the FCC says are intended to deliver “certainty, predictability, and faster timelines.” At the same time, the FCC expands oversight in selected cable functions and equipment.
- End users and the general public: The rules aim to reduce the risk that hijacked alerts could be used to spread disinformation or hamper response during real emergencies by hardening alert infrastructure and adding authentication checks.
The FCC’s Thursday vote recalibrates two different risk profiles: it hardens critical public-warning systems with baseline cybersecurity practices and an alert authentication mechanism, while it attempts to streamline undersea cable approvals through self-certification — paired with targeted new licensing and supply-chain controls. Whether the combination of presumptive exemptions and ongoing oversight will produce the intended faster timelines without compromising the stated security goals is the immediate policy tradeoff the rules leave on the table.
Source: https://cyberscoop.com/fcc-undersea-cable-regulations-national-security/
