Next-Gen 911 Systems are Outpacing Cyber Defenses

A shift in the United States to Next Generation 911 is outpacing the deployment of cybersecurity safeguards needed to protect them, leading analysts to warn that the rapid modernization environment risks creating ideal conditions for hackers.

See Also: OnDemand | Navigate the threat of AI-powered cyberattacks

Telecommunications firm Intrado – formerly West Communications – published Tuesday report on the state of 911 technology, warning that “ensuring the cybersecurity of the 911 ecosystem is a hill we must climb faster” to protect the roughly 240 million emergency calls made each year in the United States. The shift “has created both opportunities and challenges,” the report says, as evolving services, expanded data flows and next-generation capabilities introduce new cybersecurity risks.

The Federal Communications Commission has nudged telecoms for more than a decade now into adopting NG911 technology to replace legacy emergency number tech with internet protocol technology. The shift is meant to enable new ways of interacting with emergency services including SMS, video and location data.

Application of the new technology include K-12 schools deploying panic buttons that connect directly to emergency responders, consumer apps that can automatically call 911 and share location data and incident management platforms helping campuses assess threats and notify responders. Those features expand access to emergency services, they also “increase the surface area for attack and abuse,” said Trey Ford, CISO for the cybersecurity platform Bugcrowd.

Beyond more traditional abuses of 911 systems like swatting and hoax calls – both of which have surged in recent years, according to research – the report points to new points of cybersecurity risk: insecure cloud storage, real-time communications tools and expanded use of IP-based technologies.

Ransomware and denial-of-service attacks have forced some dispatchers to revert to paper logs as botnets overwhelm public safety answering points with spoofed VoIP floods faster than filters can respond. Segmented Emergency Services IP Network gateways, signed firmware and offline immutable backups are now the baseline safeguards for keeping 911 calls running during malware outbreaks or traffic storms, said Jason Soroko, senior fellow at Sectigo.

A singular misconfigured 911 call has the potential to leak sensitive, personally identifiable information. “Zero-trust identity, continuous social-engineering drills, formal model validation and latency-aware anomaly detection tuned to 911 workloads now define the baseline for resilience,” he said.

The FCC published a further notice of proposed rulemaking in early June seeking to advance significant rule changes to reinforce reliability and cybersecurity of NG911 systems, including expanded oversight of service providers and updated definitions for covered entities. The rules also call for minimum cybersecurity practices, formal risk management plans and adherence to national interoperability standards.

The proposed rules, which could take effect following a public comment period later this year, stop short of recommending regular cloud provider audits, end-to-end encryption or routine manual testing of communication apps. Those steps are critical to preventing the next wave of cyberattacks on the 911 ecosystem, according to Nivedita Murthy, senior staff consultant at Black Duck.

“Emergency responders often deal with people in their most vulnerable states, and all communications during these calls should be treated as confidential unless otherwise determined,” Murthy said. “Data confidentiality should remain the highest priority in these critical interactions.”