> ## Content Index
> Fetch the complete content index at: https://www.ostering.com/llms.txt
> Use this file to discover other available public pages before exploring further.
# Emergency and Broadcast (ES)
- URL: https://www.ostering.com/taxonomies/critical-infrastructure/bks-emergency-and-broadcast/
- Published: 2026-11-14T14:34:31.952Z
- Updated: 2026-11-14T14:34:31.952Z
- Description: Emergency calls, dispatch, responder radio, public warning and broadcast: 13 threats with mitigation principles, design measures and ATT&CK for ICS mappings.
- Author: Brett Crawley
[Taxonomies](https://ostering.com/taxonomies/) › [Critical Infrastructure](https://ostering.com/taxonomies/critical-infrastructure/) › ES · Emergency and Broadcast
How the public is helped and warned: emergency calls, dispatch, responder radio, fire alarm monitoring, public warning and the broadcasters that carry emergency information. Part of The Estate deck, ranked Ace to 2 by severity in the game. The suit was added in version 1.2. This page is part of the [Critical Infrastructure (Cyberwarfare) Threat Taxonomy](https://ostering.com/taxonomies/critical-infrastructure/), the reference for the Black Start card game.
## Mappings at a glance
STRIDE, CAPEC 3.9, CWE 5.0, ATT&CK for ICS v20.0, the Cyber-Informed Engineering principles (main one first) and standards, entry by entry. The same mappings are in each entry below and in the [Excel, SKOS and STIX downloads](https://ostering.com/taxonomies/critical-infrastructure/#downloads).
## Entries
BKS-ES-A · Emergency calls go unanswered †
Emergency calls reach a few answering centres over shared networks. Flooding them with automated calls, attacking the call-routing core or taking their systems offline leaves real callers waiting, and in a crisis every other failure gets worse because nobody can report it.
*Case:* 911 call flood, Arizona, 2016; Dallas warning sirens, 2017.
**Principle.** Emergency call answering must keep working under flood and attack, with overflow, rerouting and priority for real callers.
**Design measures.**
1. Route calls across several answering centres, with automatic overflow when one is flooded or offline.
2. Detect and throttle automated and repeated calls at the network edge without blocking anyone's first call.
3. Keep a way to take calls and pass them to responders when call-handling systems are down.
4. Test next-generation IP emergency cores against flooding before switching legacy routes off.
*Mappings:* STRIDE D, S · [CAPEC-125](https://capec.mitre.org/data/definitions/125.html) · [CWE-770](https://cwe.mitre.org/data/definitions/770.html) · ATT&CK for ICS [T0814](https://attack.mitre.org/techniques/T0814/), [T0826](https://attack.mitre.org/techniques/T0826/) · CIE 10, 7, 5 · ETSI TS 103 479
BKS-ES-K · A false alarm reaches everyone †
Sirens, cell broadcast, alert apps and broadcast interrupts let one operator warn millions in seconds. Anyone who can trigger them, by replaying a radio signal, stealing a login or breaking into a broadcaster, can send a population running and teach it to ignore the next real warning.
*Case:* Dallas warning sirens, 2017; False air raid alerts on Russian radio, 2023.
**Principle.** Public warning must only be sent by authenticated, authorised operators, with a fast way to cancel and correct a false alert.
**Design measures.**
1. Authenticate and encrypt every activation path, from control desk to siren, cell broadcast centre and broadcaster.
2. Require two people to approve a live alert, except for pre-agreed immediate threats.
3. Prepare and rehearse a correction, so a false alert is cancelled on every channel within minutes.
4. Warn through several independent channels, so losing or spoofing one does not silence or mislead everyone.
*Mappings:* STRIDE S, T, D · [CAPEC-151](https://capec.mitre.org/data/definitions/151.html), [CAPEC-148](https://capec.mitre.org/data/definitions/148.html) · [CWE-306](https://cwe.mitre.org/data/definitions/306.html), [CWE-294](https://cwe.mitre.org/data/definitions/294.html) · ATT&CK for ICS [T1692.001](https://attack.mitre.org/techniques/T1692/001/) · CIE 3, 2, 10 · ETSI TS 102 900
BKS-ES-Q · Dispatch stops when the system does †
Computer-aided dispatch holds incidents, unit status, locations and crew assignments. When ransomware or a supplier outage takes it down, call takers write incidents on paper and dispatchers work by radio. Responses slow, units are double-sent or missed, and the record of what happened is lost.
*Case:* Dallas dispatch ransomware, 2023; Advanced and NHS 111, 2022.
**Principle.** Dispatch must have a rehearsed fallback that keeps responses moving when the computer-aided dispatch system is down.
**Design measures.**
1. Keep a standby dispatch system, isolated from the main one, with a recent copy of units, addresses and open incidents.
2. Rehearse paper and radio dispatch regularly, with unit lists and maps printed and kept current.
3. Separate dispatch from the wider council or force network, so an attack on one does not reach the other.
*Mappings:* STRIDE D, T · [CWE-653](https://cwe.mitre.org/data/definitions/653.html) · ATT&CK for ICS [T0826](https://attack.mitre.org/techniques/T0826/), [T0827](https://attack.mitre.org/techniques/T0827/) · CIE 10, 4, 3
BKS-ES-J · One control room for every service †
Police, fire and ambulance increasingly share control rooms, dispatch platforms, hosting and suppliers to save money. One intrusion, outage or supplier failure then removes call handling and dispatch for every service across a region at the same moment.
*Case:* Advanced and NHS 111, 2022.
**Principle.** Shared emergency control must fail over to a separate site and platform, so one compromise cannot silence every service at once.
**Design measures.**
1. Pair each shared control room with a fallback site on separate networks, hosting and identity systems.
2. Keep each service able to dispatch its own units if the shared platform is lost.
3. Treat a supplier serving many control rooms as a single point of failure, and plan for its loss.
*Mappings:* STRIDE D, E · [CWE-653](https://cwe.mitre.org/data/definitions/653.html) · ATT&CK for ICS [T0826](https://attack.mitre.org/techniques/T0826/) · CIE 7, 4, 10
BKS-ES-10 · Broadcasts carry the attacker's message
Playout systems, news tickers, streaming platforms and radio servers put content on air with little checking at the last step. An adversary inside them interrupts programmes with false alerts, fake statements from leaders or propaganda, reaching millions in the voice of a trusted channel.
*Case:* Ukraine 24 ticker and deepfake, 2022; Hijacked TV streams, 2023; False air raid alerts on Russian radio, 2023.
**Principle.** What goes on air must pass through controls the adversary cannot reach from the newsroom or the internet, with fast takedown and correction.
**Design measures.**
1. Separate playout and transmission networks from newsroom, office and internet access, with strong authentication for every change.
2. Restrict who and what can change tickers, graphics and emergency interrupts, and log every change.
3. Rehearse taking a compromised stream off air and broadcasting a correction from a clean path.
*Mappings:* STRIDE T, S · [CAPEC-148](https://capec.mitre.org/data/definitions/148.html) · [CWE-306](https://cwe.mitre.org/data/definitions/306.html) · CIE 3, 6, 10
BKS-ES-9 · Responder radio can be overheard
Police, fire, ambulance and the security teams at ports and airports often rely on TETRA radio. Weak export-grade encryption, or none, lets an adversary listen to deployments and response times, and without per-message authentication some networks accept injected messages.
*Case:* TETRA:BURST, 2023.
**Principle.** Responder radio must use strong encryption and authentication, with keys that can be changed and weak modes switched off.
**Design measures.**
1. Replace TEA1 and clear mode with strong air-interface or end-to-end encryption, and record every radio's cipher.
2. Apply the TETRA:BURST fixes to infrastructure and terminals, and verify them in the field.
3. Assume someone is listening: keep tactical details off talkgroups that are not end-to-end encrypted.
*Mappings:* STRIDE I, S, T · [CAPEC-97](https://capec.mitre.org/data/definitions/97.html), [CAPEC-157](https://capec.mitre.org/data/definitions/157.html) · [CWE-326](https://cwe.mitre.org/data/definitions/326.html), [CWE-327](https://cwe.mitre.org/data/definitions/327.html) · ATT&CK for ICS [T0887](https://attack.mitre.org/techniques/T0887/), [T0860](https://attack.mitre.org/techniques/T0860/) · CIE 3, 9, 8 · ETSI EN 300 392
BKS-ES-8 · Broadcasters go dark in a crisis
Radio and television are the warning channel of last resort when mobile networks and the internet fail. A destructive attack on a broadcaster's encoders, playout or transmitter control takes channels off air for hours or days, just when the public needs instructions.
*Case:* TV5Monde, 2015.
**Principle.** Broadcasters that carry emergency information must be able to stay on air, or return quickly, after a destructive attack.
**Design measures.**
1. Keep a standby playout and transmission path that shares no accounts or management with the main one.
2. Hold offline images and configurations for encoders and playout, and rehearse rebuilding from them.
3. Agree with authorities which channels carry emergency information, and how to reach them without the network.
*Mappings:* STRIDE D, T · [CWE-653](https://cwe.mitre.org/data/definitions/653.html) · ATT&CK for ICS [T0826](https://attack.mitre.org/techniques/T0826/) · CIE 10, 1, 4
BKS-ES-7 · Automatic fire alarms never arrive †
Fire alarms in hospitals, care homes, plants and tunnels reach the brigade through alarm receiving centres and their transmission paths. If a receiving centre is attacked or a path fails silently, buildings burn without a call, and nobody knows the alarms were lost.
**Principle.** Alarm transmission must be supervised end to end, so a lost path or a silent receiving centre is noticed at once.
**Design measures.**
1. Use dual-path alarm transmission with polling, so a failed path raises a fault within minutes.
2. Give each alarm receiving centre a standby centre that can take over every connected site.
3. Tell premises when their alarm link is down, so they can post a fire watch.
*Mappings:* STRIDE D, T · [CAPEC-603](https://capec.mitre.org/data/definitions/603.html) · [CWE-754](https://cwe.mitre.org/data/definitions/754.html) · ATT&CK for ICS [T1691.002](https://attack.mitre.org/techniques/T1691/002/), [T0878](https://attack.mitre.org/techniques/T0878/) · CIE 5, 10, 2 · EN 50136-1, EN 54-21
BKS-ES-6 · Fake alerts in an official voice †
Text messages, robocalls and apps can carry the name of a civil defence authority without any proof. In a crisis an adversary sends mass messages telling people to avoid shelters, install a fake alert app or expect shortages, and spoofed caller ID makes them look official.
*Case:* Fake Home Front Command alerts, Israel, 2025.
**Principle.** The public must be able to tell a real alert from a fake one, through channels that cannot be spoofed and a clear rule about what authorities never send.
**Design measures.**
1. Send official alerts only through cell broadcast and named apps, and say publicly which channels are never used.
2. Work with mobile operators to block sender names and caller ID that imitate the authority.
3. Prepare rebuttals for the false alerts an adversary is most likely to send.
*Mappings:* STRIDE S · [CAPEC-151](https://capec.mitre.org/data/definitions/151.html), [CAPEC-148](https://capec.mitre.org/data/definitions/148.html) · [CWE-290](https://cwe.mitre.org/data/definitions/290.html) · CIE 6, 12, 3
BKS-ES-5 · Crews sent to the wrong place †
Caller location comes from handsets, mobile networks and address databases. Spoofed caller ID, manipulated location data or a corrupted address gazetteer sends crews to the wrong street, or to a place the adversary has chosen, while the real emergency waits.
**Principle.** Location used for dispatch must be checked against more than one source, and call takers must be able to confirm it.
**Design measures.**
1. Compare handset, network and caller-stated locations, and flag disagreements to the call taker.
2. Protect the address and map data used for dispatch with change control and integrity checks.
3. Train call takers to confirm an unusual location by voice before committing units.
*Mappings:* STRIDE S, T · [CAPEC-151](https://capec.mitre.org/data/definitions/151.html) · [CWE-290](https://cwe.mitre.org/data/definitions/290.html), [CWE-353](https://cwe.mitre.org/data/definitions/353.html) · CIE 3, 6, 1 · ETSI TS 103 625
BKS-ES-4 · Hydrants run dry when needed †
Firefighting depends on mains pressure that the water utility manages remotely. An adversary in the water network who lowers pressure, closes valves or stops pumps leaves hydrants weak or dry just as fires break out, perhaps fires the same adversary started.
**Principle.** Firefighting water must be planned as a shared service, with pressure protected and alternatives ready when the network fails.
**Design measures.**
1. Agree minimum firefighting pressures with the water utility, with alarms to the brigade when they are breached.
2. Map static water supplies and tanker capacity for areas fed by a single pumping station.
3. Require local confirmation before remote changes that drop a zone below firefighting pressure.
*Mappings:* STRIDE T, D · ATT&CK for ICS [T0831](https://attack.mitre.org/techniques/T0831/), [T0836](https://attack.mitre.org/techniques/T0836/) · CIE 7, 1, 10
BKS-ES-3 · Hoax calls send crews astray †
Hoax calls, spoofed caller ID and swatting send armed officers, fire crews or ambulances to false emergencies. In a campaign many arrive at once across a region, tying up units, endangering the people at the false address and showing the adversary how the services respond.
**Principle.** Call handling must spot hoax patterns across calls and centres without slowing the response to genuine emergencies.
**Design measures.**
1. Share suspected hoax calls, numbers and scripts between answering centres in real time.
2. Flag spoofed or unverifiable caller ID to call takers, with a callback check where time allows.
3. Preserve call recordings and network data, so police can trace callers while the campaign is still running.
4. Pre-agree a graded response for addresses repeatedly targeted by hoaxes.
*Mappings:* STRIDE S, D · [CAPEC-151](https://capec.mitre.org/data/definitions/151.html), [CAPEC-416](https://capec.mitre.org/data/definitions/416.html) · [CWE-290](https://cwe.mitre.org/data/definitions/290.html) · CIE 6, 7, 12
BKS-ES-2 · Staff directory stolen in one go
Directories, rosters and contact lists for police, fire and ambulance staff sit in shared systems reachable with one stolen session. Taken in bulk, they let an adversary phish, impersonate, intimidate or locate staff, and know who will be on duty in a crisis.
*Case:* Dutch police staff data, 2024.
**Principle.** Staff identities and rosters must be protected as security data, with access limited and bulk export detected.
**Design measures.**
1. Limit who and what can read the whole staff directory, and alert on bulk queries or exports.
2. Bind sessions to devices and require phishing-resistant authentication for cloud services.
3. Plan how to warn and protect staff quickly if their details are stolen.
*Mappings:* STRIDE I, S · [CAPEC-593](https://capec.mitre.org/data/definitions/593.html), [CAPEC-60](https://capec.mitre.org/data/definitions/60.html) · [CWE-359](https://cwe.mitre.org/data/definitions/359.html), [CWE-294](https://cwe.mitre.org/data/definitions/294.html) · CIE 3, 8, 12
## Public cases cited in this suit
- **911 call flood, Arizona, 2016.** In October 2016 a web link that made iPhones dial 911 repeatedly spread on Twitter. The calls flooded emergency call centres in Arizona and other states, and one centre was in danger of losing service. The 18-year-old who wrote the code was arrested and said he had published it by mistake. *Attribution:* Criminal case against an individual; not state-linked. *Sources:* [The Register: iOS call exploit knocks out Arizona 911 center](https://www.theregister.co.uk/2016/10/28/ios_bughunter_poc_floods_911/); [FedScoop: DHS says teenager's malware disrupted 911 call centers in 12 states](https://www.fedscoop.com/dhs-teenagers-malware-disrupted-911-call-centers-in-12-states/)
- **Dallas warning sirens, 2017.** Late on 7 April 2017 all 156 outdoor warning sirens in Dallas sounded for about 90 minutes, triggered over radio rather than through the city's computer network. The city shut down the whole radio system to stop them, and 911 call centres received thousands of calls. *Attribution:* Unattributed; nobody has been publicly identified. *Sources:* [StateTech: Dallas reveals radio signals triggered emergency sirens](https://statetechmagazine.com/article/2017/04/dallas-reveals-radio-signals-not-network-hack-triggered-emergency-sirens); [CSO: hacked Dallas sirens get extra encryption](https://www.csoonline.com/article/3189043/hacked-dallas-sirens-get-extra-encryption-to-fend-off-future-attacks.html)
- **False air raid alerts on Russian radio, 2023.** On 22 and 28 February 2023 hacked commercial radio stations, and later some television channels, in several Russian regions and occupied Crimea broadcast false air raid alerts telling people to go to shelters. Russia's emergencies ministry said the alerts were false and the result of hacking. *Attribution:* Unattributed; Russian regional officials blamed Ukraine. *Sources:* [The Record: commercial radio stations broadcast fake air strike warnings](https://therecord.media/russia-radio-hackers-fake-air-raid-missile-strike-warnings); [Times of Israel: Russia says hackers set off false air raid alerts on TV, radio](https://www.timesofisrael.com/russia-says-hackers-set-off-false-air-raid-alerts-on-tv-radio/)
- **Dallas dispatch ransomware, 2023.** In May 2023 Royal ransomware hit the City of Dallas and took its computer-aided dispatch system offline. 911 calls were still answered, but police and fire crews were dispatched by hand and by radio while the system was restored. *Attribution:* Royal ransomware group (criminal), per the city. *Sources:* [Dallas Morning News: a group called Royal is behind the ransomware attack](https://dallasnews.com/news/public-safety/2023/05/04/a-group-called-royal-is-behind-the-ransomware-attack-on-dallas-the-city-said); [The Record: Dallas says it will take weeks to recover](https://therecord.media/dallas-ransomware-attack-will-take-weeks-to-recover)
- **Advanced and NHS 111, 2022.** In August 2022 ransomware hit Advanced, whose Adastra system ran most NHS 111 services. NHS 111, ambulance dispatch and emergency prescriptions were disrupted, and some staff worked on paper for weeks. The ICO later fined Advanced £3.07 million. *Attribution:* LockBit (criminal), per the ICO. *Sources:* [Computer Weekly: Advanced Software fined £3m over LockBit attack](https://www.computerweekly.com/news/366621298/Advanced-Software-fined-3m-over-LockBit-attack); [The Register: NHS call-handling vendor faces fine](https://www.theregister.com/2024/08/07/ico_plans_to_fine_nhs/)
- **Ukraine 24 ticker and deepfake, 2022.** On 16 March 2022 the news ticker of the Ukrainian channel Ukraine 24 and the Segodnya website were hacked to show a false surrender statement from President Zelensky, and a deepfake video of him spread the same day. He quickly posted a video denying it. *Attribution:* No formal attribution; the channel blamed enemy hackers. *Sources:* [Atlantic Council DFRLab: hacked news program and deepfake video spread false Zelenskyy claims](https://www.atlanticcouncil.org/blogs/new-atlanticist/russian-war-report-hacked-news-program-and-deepfake-video-spread-false-zelenskyy-claims/); [NPR: deepfake video of Zelenskyy](https://www.npr.org/2022/03/16/1087062648/deepfake-video-zelenskyy-experts-war-manipulation-ukraine-russia)
- **Hijacked TV streams, 2023.** In December 2023 streaming television services in the UAE, the UK and Canada were interrupted by a fake news bulletin read by an AI-generated anchor. *Attribution:* Attributed by Microsoft to Cotton Sandstorm, a group it links to Iran's Islamic Revolutionary Guard Corps. *Sources:* [IranWire: Iranian fake news interrupts TV services with AI-generated anchor](https://www.iranwire.com/en/technology/125182-iranian-fake-news-tv-services-interrupted-with-report-using-ai-generated-anchor/); [VOA: Iranian hackers interrupt UAE broadcasts with deepfake news](https://www.voanews.com/a/7480126.html)
- **TETRA:BURST, 2023.** In July 2023 researchers at Midnight Blue disclosed five vulnerabilities in TETRA, the radio standard used by police and emergency services in many countries. They include a deliberately weakened TEA1 cipher whose key can be brute-forced, and flaws that can allow messages to be decrypted or injected. *Attribution:* Vulnerability research, not an attack; no confirmed exploitation. *Sources:* [GovInfoSecurity: critical vulnerabilities found in radio encryption system](https://www.govinfosecurity.com/critical-vulnerabilities-found-in-radio-encryption-system-a-22643); [The Hacker News: TETRA:BURST, 5 new vulnerabilities](https://thehackernews.com/2023/07/tetraburst-5-new-vulnerabilities.html)
- **TV5Monde, 2015.** In April 2015 attackers who had been inside TV5Monde's network since January sabotaged its systems, taking its 12 channels off air for hours, and posted messages in the name of a self-styled 'CyberCaliphate'. *Attribution:* Attributed by the French government to APT28, a unit of Russian military intelligence (GRU). *Sources:* [GovInfoSecurity: French officials detail Fancy Bear hack of TV5Monde](https://www.govinfosecurity.com/french-officials-detail-fancy-bear-hack-tv5monde-a-9983); [Global Voices: France accuses Russia of cyberattacks](https://advox.globalvoices.org/2025/07/06/france-accuses-russia-of-cyberattacks-on-public-services-private-companies-and-media-outlets/)
- **Fake Home Front Command alerts, Israel, 2025.** During the June 2025 war with Iran, Israelis received text messages, robocalls and app download links imitating the Home Front Command, some telling people to stay out of shelters. *Attribution:* Israeli authorities blamed Iran and its proxies. *Sources:* [Ynetnews: Israel warns of fake calls posing as Home Front Command](https://www.ynetnews.com/article/rjp1ka9xxx); [The JC: Israelis get fake texts telling them to avoid bomb shelters](https://www.thejc.com/news/israel/israelis-fake-texts-avoid-bomb-shelters-ia4tgxi9)
- **Dutch police staff data, 2024.** In September 2024 an attacker used a stolen session to reach a Dutch police account and took the work contact details of police staff. In May 2025 the Dutch intelligence services named the previously unknown group behind it Laundry Bear. *Attribution:* Attributed by the Dutch AIVD and MIVD to Laundry Bear, highly probably Russian state-supported. *Sources:* [The Record: Dutch intelligence unmasks Russian hacking group Laundry Bear](https://therecord.media/laundry-bear-void-blizzard-russia-hackers-netherlands); [Security Affairs: Laundry Bear linked to 2024 Dutch police attack](https://securityaffairs.com/178338/apt/russia-linked-apt-laundry-bear-linked-to-2024-dutch-police-attack.html)
---
*© 2026 Jonathan Brett Crawley. Licensed under [CC BY-NC-ND 4.0](https://creativecommons.org/licenses/by-nc-nd/4.0/) with additional permissions: see the licence on the [overview](https://ostering.com/taxonomies/critical-infrastructure/#licence). † marks a physical-safety consequence.*