The ubiquity of mobile devices provides new opportunities to warn people of emergencies and imminent threats using location-aware technologies. The Wireless Emergency Alerts (WEA) system, formerly known as the Commercial Mobile Alert Service (CMAS), is the newest addition to the Federal Emergency Management Agency (FEMA) Integrated Public Alert and Warning System (IPAWS), which allows authorities to broadcast emergency alerts to cell phone customers with WEA-enabled devices in an area affected by a disaster or a major emergency. This blog posting describes how the Software Engineering Institute's (SEI) work on architecture, integration, network security, and project management is assisting in implementing the WEA system, so it can handle a large number of alert originators and provide an effective nationwide wireless emergency warning system.

Why We Need the WEA System

In the summer of 2012, the western United States experienced unprecedented wildfires costing several lives and hundreds of millions of dollars of property damage. The Lower North Fork fire in Colorado caused three fatalities and could have been worse due to massive failures in the landline-based telephone alerting systems. A local television station reported that incorrect records in a geographic database were responsible for many of the failures.

The Denver Post report on the 2012 Waldo Canyon fire near Colorado Springs (the most destructive fire in Colorado history) revealed similar problems in the emergency alert system. An additional complication to the alert process lies in the fact that more than 35 percent of U.S. homes do not have a land-based phone line. Given the mobile nature of today's society, a better solution is needed to warn people of imminent threats using geographic data.

Pursuant to the Warning, Alert, and Response Network (WARN) Act, FEMA's IPAWS, and the Department of Homeland Security's Science & Technology (DHS S&T) Directorate have partnered with the Federal Communications Commission and commercial mobile service providers to develop the WEA system to bring emergency alert messages to mobile devices configured to allow wireless emergency alerts. This effort is the latest in a series of alert and warning systems that date back to 1951 when President Harry Truman established the Control of Electromagnetic Radiation (CONELRAD) program. The WEA system will enable alert originators--including federal, state, tribal, and territorial governments as well as local emergency response authorities that provide fire protection, transit, and public utilities--with the potential to reach the more than 325 million wireless subscribers.

The four largest cellular carriers--AT&T, Sprint Nextel, T-Mobile, and Verizon, which connect with 90 percent of all cell phones in the United States--have agreed to participate along with another 72 smaller carriers (see FCC Master CMAS (prior designation for WEA) Registry for reported numbers). The SEI has two major tasks in this effort: developing an integration strategy to help assimilate alert originators into the system and identifying an initial set of best practices that apply to WEA use.

The SEI is just one of several organizations involved in the WEA system project. The John Hopkins Applied Physics Laboratory is constructing a large-scale computer model of the system on which to run simulation studies and an environment to test the interfaces and system. The RAND Corporation developed a mobile-penetration strategy to determine the availability and acceptability of mobile alerting services across the country. The MITRE Corporation is working on test plan development.

The WEA system went online nationally in April 2012. This activation meant that the backbone infrastructure is up and running, providing alerting authorities with the appropriate alert originating software to send messages to WEA system-enabled handsets. The hard task of expanding the number of participating originators and mobile carriers can now commence.

When an emergency responder or alerting agency, such as the National Weather Service (which went online June 28, 2012), or the National Center for Missing and Exploited Children (NCMEC) (which issued its first AMBER alert through WEA on December 18, 2012) becomes aware of an event that the public should know about, it can use the WEA system to initiate a geographically targeted alert message and identify smart phone users in the geographic area who should receive the message. The WEA system portion of the Common Alerting Protocol (CAP) specifies a text message of up to 90 characters detailing the topic of the alert, the area affected, the alert expiration, the prescribed action, and the alert sender. Most modern phones (e.g., 3G, 4G, or LTE) are already equipped with the technology to receive WEA messages. Cell phone users are automatically subscribed to the service; they do not have to opt in to receive alerts. They may opt out of all but the presidential alerts.

The WEA system sends out three types of messages

• presidential alerts
• AMBER (America's Missing: Broadcast Emergency Response) alerts
• imminent threats to safety or life

The WEA system also uses Federal Information Processing Standard (FIPS) codes, which are alphanumeric codes to target cell phones in geographic areas at the county level. The WEA system operates using cell broadcast, a one-to-many technology rather than point-to-point (phone number addressed) text messages. The WEA system messages are transmitted on a separate channel from the voice and data communication links. As a result, authorities sending out emergency alerts can do so even when voice and data channels are saturated.

Leveraging Our Architecture Analysis Expertise

Along with Lawrence Jones, project lead for the SEI's work on the WEA effort, and our colleagues in the Software Solutions and CERT divisions at the SEI, we have been leveraging our architecture and system-of-systems analysis techniques to help ensure the smooth national deployment and operation of the WEA system. Specifically, we are using the Mission Thread Workshop (MTW) approach that has been used by the Department of Defense in large systems-of-systems analysis to describe the step-by-step sequences required to execute a given mission.

We are applying the MTW approach to the WEA system to develop mission thread descriptions of typical integration challenges. To analyze the WEA system as a socio-technical system-of-systems, we developed mission threads to describe operational scenarios that the emergency response community might encounter that would benefit from the WEA system alerting capabilities. Table top walk-throughs of the mission threads with emergency management experts reveal underlying quality attributes (QAs) that the system must have to perform properly. These underlying QAs can include normal system QAs, such as resilience, reliability, modifiability, securability, and sustainability, as well as QAs that are particularly relevant to the WEA system, such as accuracy, urgency, timeliness, and relevance.

Addressing Security Concerns

A key quality attribute of interest for the WEA system is security. Like other cyber-enabled services, the WEA system is subject to cyber threats that may prevent its use or damage the credibility of the service it provides. Attackers may attempt to delay, destroy, or modify alerts, or even insert false alerts, actions that may pose a significant risk to the public. Accordingly, a team of experts from the SEI's CERT division is examining the security aspects of the WEA system using the MTW approach. By reviewing the step-by-step sequence documented in mission threads, security experts are identifying threats and potential vulnerabilities that may make the WEA system susceptible to cyber-attacks. To address these concerns, the SEI is developing a cybersecurity risk management strategy for the WEA system that alert originators can use to identify, prioritize, develop, and implement cybersecurity risk mitigation plans.

Best Practices Work

Although WEA adoption is still in the early stages, the SEI is leading a best practices task that supports the DHS effort. This work includes

• a lessons learned report on the New York City WEA demonstration conducted in December 2011
• creation and analysis of a WEA trust model that incorporates inputs from the emergency management organization community and a sample of the public. This study identifies key factors involved in trust in WEA messages to increase understanding of the effectiveness of these alerts
• selected example best practices

Addressing Challenges of Scale

A key challenge to deploying and operating the WEA system effectively is dealing with issues of scale. It's estimated there are between 10,000 and 40,000 alert originators who may initiate the WEA system messages including designated federal, state, territorial, tribal, and local authorities (the WEA system alert authorization is a state-driven organizing model that is expected to mimic the hierarchical structure of emergency and disaster response networks). The SEI is developing integration strategies to help those originators to bring the WEA system capability to their constituents.

Many of these originators will rely on vendors to provide solutions. The vendors build the systems that help emergency response operators prepare alerts for dissemination. The human-machine interfaces vary but generally support common features, such as a text-based interface, checklist prompts, predefined templates for message support, and map-based interfaces for geographic targeting assistance. Vendors also ensure that the operators have the needed message control fields, such as

• What is the severity?
• What is the urgency?
• When should the message be taken down?

Originators face many scale-related challenges as they attempt to implement the WEA system:

• Many alert originators employ different types of software and have acquired that software from multiple vendors or, even, custom built it themselves.
• The state of readiness to integrate with the WEA system varies from originator to originator.
• The use of protocols varies from one originator to another. The WEA system standard is the Common Alerting Protocol which, among other things, has a 90-character message length limit (for the WEA system), which is even shorter than a Tweet! Originators feel that this limit impedes their ability to aptly describe a situation to users, especially for AMBER alerts.

The WEA system is often integrated or supplemented with other existing emergency alert system channels, including television, radio, and social media.

Related DHS Science and Technology Directorate research projects involve improving the granularity of the geo-location capability (some carriers are already committed to a finer granularity than is required) and addressing the challenges associated with citizen reaction/non-reaction to the alerts. In many cases alerting authorities want to narrow their message to a geographic area smaller than the county level. They are also concerned that those who receive messages react promptly and correctly.

What's Ahead

The SEI team working on the WEA system project is consolidating the results of the data collection phase of our project interviewing originators and the vendor community that supports the originators. Questions include

• What kind of systems do the originators use?
• How do the originators adopt new systems?
• Do they have system documentation?
• What problems have they encountered using the systems?

The results of our work will be delivered to DHS this summer with public release anticipated sometime in the fall. We would welcome your feedback on our work. Please share your insights in the comments section below.

Additional Resources

For more information about the Mission Thread Workshop, please visit
https://resources.sei.cmu.edu/library/asset-view.cfm?assetID=63148

For more information about the the Wireless Emergency Alerts (WEA) Research, Development, Testing, and Evaluation (RDT&E) program, formerly known as the Commercial Mobile Alert Service (CMAS) RDT&E program, please visit
https://www.fema.gov/frequently-asked-questions-wireless-emergency-alerts