Emergency and Broadcast (ES)

Emergency and Broadcast (ES), The Estate deck, Critical Infrastructure Threat Taxonomy: control-panel artwork showing a warning siren and an emergency call desk sending out three units.

Taxonomies › Critical Infrastructure › ES · Emergency and Broadcast

How the public is helped and warned: emergency calls, dispatch, responder radio, fire alarm monitoring, public warning and the broadcasters that carry emergency information. Part of The Estate deck, ranked Ace to 2 by severity in the game. The suit was added in version 1.2. This page is part of the Critical Infrastructure (Cyberwarfare) Threat Taxonomy, the reference for the Black Start card game.

ES Emergency and Broadcast taxonomy table, 13 entries: BKS-ES-A Emergency calls go unanswered; BKS-ES-K A false alarm reaches everyone; BKS-ES-Q Dispatch stops when the system does; BKS-ES-J One control room for every service; BKS-ES-10 Broadcasts carry the attacker's message; BKS-ES-9 Responder radio can be overheard; BKS-ES-8 Broadcasters go dark in a crisis; BKS-ES-7 Automatic fire alarms never arrive; BKS-ES-6 Fake alerts in an official voice; BKS-ES-5 Crews sent to the wrong place; BKS-ES-4 Hydrants run dry when needed; BKS-ES-3 Hoax calls send crews astray; BKS-ES-2 Staff directory stolen in one go. Each row gives the threat, any public case, the mitigation principle and the design measures.

Mappings at a glance

STRIDE, CAPEC 3.9, CWE 5.0, ATT&CK for ICS v20.0, the Cyber-Informed Engineering principles (main one first) and standards, entry by entry. The same mappings are in each entry below and in the Excel, SKOS and STIX downloads.

ES Emergency and Broadcast mapping table, 13 entries: BKS-ES-A Emergency calls go unanswered; BKS-ES-K A false alarm reaches everyone; BKS-ES-Q Dispatch stops when the system does; BKS-ES-J One control room for every service; BKS-ES-10 Broadcasts carry the attacker's message; BKS-ES-9 Responder radio can be overheard; BKS-ES-8 Broadcasters go dark in a crisis; BKS-ES-7 Automatic fire alarms never arrive; BKS-ES-6 Fake alerts in an official voice; BKS-ES-5 Crews sent to the wrong place; BKS-ES-4 Hydrants run dry when needed; BKS-ES-3 Hoax calls send crews astray; BKS-ES-2 Staff directory stolen in one go. Each row gives the STRIDE categories, CAPEC patterns, CWE weaknesses, ATT&CK for ICS techniques, Cyber-Informed Engineering principles and standards for the entry.

Entries

BKS-ES-A · Emergency calls go unanswered †

Emergency calls reach a few answering centres over shared networks. Flooding them with automated calls, attacking the call-routing core or taking their systems offline leaves real callers waiting, and in a crisis every other failure gets worse because nobody can report it.

Case: 911 call flood, Arizona, 2016; Dallas warning sirens, 2017.

Principle. Emergency call answering must keep working under flood and attack, with overflow, rerouting and priority for real callers.

Design measures.

  1. Route calls across several answering centres, with automatic overflow when one is flooded or offline.
  2. Detect and throttle automated and repeated calls at the network edge without blocking anyone’s first call.
  3. Keep a way to take calls and pass them to responders when call-handling systems are down.
  4. Test next-generation IP emergency cores against flooding before switching legacy routes off.

Mappings: STRIDE D, S · CAPEC-125 · CWE-770 · ATT&CK for ICS T0814, T0826 · CIE 10, 7, 5 · ETSI TS 103 479

BKS-ES-K · A false alarm reaches everyone †

Sirens, cell broadcast, alert apps and broadcast interrupts let one operator warn millions in seconds. Anyone who can trigger them, by replaying a radio signal, stealing a login or breaking into a broadcaster, can send a population running and teach it to ignore the next real warning.

Case: Dallas warning sirens, 2017; False air raid alerts on Russian radio, 2023.

Principle. Public warning must only be sent by authenticated, authorised operators, with a fast way to cancel and correct a false alert.

Design measures.

  1. Authenticate and encrypt every activation path, from control desk to siren, cell broadcast centre and broadcaster.
  2. Require two people to approve a live alert, except for pre-agreed immediate threats.
  3. Prepare and rehearse a correction, so a false alert is cancelled on every channel within minutes.
  4. Warn through several independent channels, so losing or spoofing one does not silence or mislead everyone.

Mappings: STRIDE S, T, D · CAPEC-151, CAPEC-148 · CWE-306, CWE-294 · ATT&CK for ICS T1692.001 · CIE 3, 2, 10 · ETSI TS 102 900

BKS-ES-Q · Dispatch stops when the system does †

Computer-aided dispatch holds incidents, unit status, locations and crew assignments. When ransomware or a supplier outage takes it down, call takers write incidents on paper and dispatchers work by radio. Responses slow, units are double-sent or missed, and the record of what happened is lost.

Case: Dallas dispatch ransomware, 2023; Advanced and NHS 111, 2022.

Principle. Dispatch must have a rehearsed fallback that keeps responses moving when the computer-aided dispatch system is down.

Design measures.

  1. Keep a standby dispatch system, isolated from the main one, with a recent copy of units, addresses and open incidents.
  2. Rehearse paper and radio dispatch regularly, with unit lists and maps printed and kept current.
  3. Separate dispatch from the wider council or force network, so an attack on one does not reach the other.

Mappings: STRIDE D, T · CWE-653 · ATT&CK for ICS T0826, T0827 · CIE 10, 4, 3

BKS-ES-J · One control room for every service †

Police, fire and ambulance increasingly share control rooms, dispatch platforms, hosting and suppliers to save money. One intrusion, outage or supplier failure then removes call handling and dispatch for every service across a region at the same moment.

Case: Advanced and NHS 111, 2022.

Principle. Shared emergency control must fail over to a separate site and platform, so one compromise cannot silence every service at once.

Design measures.

  1. Pair each shared control room with a fallback site on separate networks, hosting and identity systems.
  2. Keep each service able to dispatch its own units if the shared platform is lost.
  3. Treat a supplier serving many control rooms as a single point of failure, and plan for its loss.

Mappings: STRIDE D, E · CWE-653 · ATT&CK for ICS T0826 · CIE 7, 4, 10

BKS-ES-10 · Broadcasts carry the attacker's message

Playout systems, news tickers, streaming platforms and radio servers put content on air with little checking at the last step. An adversary inside them interrupts programmes with false alerts, fake statements from leaders or propaganda, reaching millions in the voice of a trusted channel.

Case: Ukraine 24 ticker and deepfake, 2022; Hijacked TV streams, 2023; False air raid alerts on Russian radio, 2023.

Principle. What goes on air must pass through controls the adversary cannot reach from the newsroom or the internet, with fast takedown and correction.

Design measures.

  1. Separate playout and transmission networks from newsroom, office and internet access, with strong authentication for every change.
  2. Restrict who and what can change tickers, graphics and emergency interrupts, and log every change.
  3. Rehearse taking a compromised stream off air and broadcasting a correction from a clean path.

Mappings: STRIDE T, S · CAPEC-148 · CWE-306 · CIE 3, 6, 10

BKS-ES-9 · Responder radio can be overheard

Police, fire, ambulance and the security teams at ports and airports often rely on TETRA radio. Weak export-grade encryption, or none, lets an adversary listen to deployments and response times, and without per-message authentication some networks accept injected messages.

Case: TETRA:BURST, 2023.

Principle. Responder radio must use strong encryption and authentication, with keys that can be changed and weak modes switched off.

Design measures.

  1. Replace TEA1 and clear mode with strong air-interface or end-to-end encryption, and record every radio’s cipher.
  2. Apply the TETRA:BURST fixes to infrastructure and terminals, and verify them in the field.
  3. Assume someone is listening: keep tactical details off talkgroups that are not end-to-end encrypted.

Mappings: STRIDE I, S, T · CAPEC-97, CAPEC-157 · CWE-326, CWE-327 · ATT&CK for ICS T0887, T0860 · CIE 3, 9, 8 · ETSI EN 300 392

BKS-ES-8 · Broadcasters go dark in a crisis

Radio and television are the warning channel of last resort when mobile networks and the internet fail. A destructive attack on a broadcaster’s encoders, playout or transmitter control takes channels off air for hours or days, just when the public needs instructions.

Case: TV5Monde, 2015.

Principle. Broadcasters that carry emergency information must be able to stay on air, or return quickly, after a destructive attack.

Design measures.

  1. Keep a standby playout and transmission path that shares no accounts or management with the main one.
  2. Hold offline images and configurations for encoders and playout, and rehearse rebuilding from them.
  3. Agree with authorities which channels carry emergency information, and how to reach them without the network.

Mappings: STRIDE D, T · CWE-653 · ATT&CK for ICS T0826 · CIE 10, 1, 4

BKS-ES-7 · Automatic fire alarms never arrive †

Fire alarms in hospitals, care homes, plants and tunnels reach the brigade through alarm receiving centres and their transmission paths. If a receiving centre is attacked or a path fails silently, buildings burn without a call, and nobody knows the alarms were lost.

Principle. Alarm transmission must be supervised end to end, so a lost path or a silent receiving centre is noticed at once.

Design measures.

  1. Use dual-path alarm transmission with polling, so a failed path raises a fault within minutes.
  2. Give each alarm receiving centre a standby centre that can take over every connected site.
  3. Tell premises when their alarm link is down, so they can post a fire watch.

Mappings: STRIDE D, T · CAPEC-603 · CWE-754 · ATT&CK for ICS T1691.002, T0878 · CIE 5, 10, 2 · EN 50136-1, EN 54-21

BKS-ES-6 · Fake alerts in an official voice †

Text messages, robocalls and apps can carry the name of a civil defence authority without any proof. In a crisis an adversary sends mass messages telling people to avoid shelters, install a fake alert app or expect shortages, and spoofed caller ID makes them look official.

Case: Fake Home Front Command alerts, Israel, 2025.

Principle. The public must be able to tell a real alert from a fake one, through channels that cannot be spoofed and a clear rule about what authorities never send.

Design measures.

  1. Send official alerts only through cell broadcast and named apps, and say publicly which channels are never used.
  2. Work with mobile operators to block sender names and caller ID that imitate the authority.
  3. Prepare rebuttals for the false alerts an adversary is most likely to send.

Mappings: STRIDE S · CAPEC-151, CAPEC-148 · CWE-290 · CIE 6, 12, 3

BKS-ES-5 · Crews sent to the wrong place †

Caller location comes from handsets, mobile networks and address databases. Spoofed caller ID, manipulated location data or a corrupted address gazetteer sends crews to the wrong street, or to a place the adversary has chosen, while the real emergency waits.

Principle. Location used for dispatch must be checked against more than one source, and call takers must be able to confirm it.

Design measures.

  1. Compare handset, network and caller-stated locations, and flag disagreements to the call taker.
  2. Protect the address and map data used for dispatch with change control and integrity checks.
  3. Train call takers to confirm an unusual location by voice before committing units.

Mappings: STRIDE S, T · CAPEC-151 · CWE-290, CWE-353 · CIE 3, 6, 1 · ETSI TS 103 625

BKS-ES-4 · Hydrants run dry when needed †

Firefighting depends on mains pressure that the water utility manages remotely. An adversary in the water network who lowers pressure, closes valves or stops pumps leaves hydrants weak or dry just as fires break out, perhaps fires the same adversary started.

Principle. Firefighting water must be planned as a shared service, with pressure protected and alternatives ready when the network fails.

Design measures.

  1. Agree minimum firefighting pressures with the water utility, with alarms to the brigade when they are breached.
  2. Map static water supplies and tanker capacity for areas fed by a single pumping station.
  3. Require local confirmation before remote changes that drop a zone below firefighting pressure.

Mappings: STRIDE T, D · ATT&CK for ICS T0831, T0836 · CIE 7, 1, 10

BKS-ES-3 · Hoax calls send crews astray †

Hoax calls, spoofed caller ID and swatting send armed officers, fire crews or ambulances to false emergencies. In a campaign many arrive at once across a region, tying up units, endangering the people at the false address and showing the adversary how the services respond.

Principle. Call handling must spot hoax patterns across calls and centres without slowing the response to genuine emergencies.

Design measures.

  1. Share suspected hoax calls, numbers and scripts between answering centres in real time.
  2. Flag spoofed or unverifiable caller ID to call takers, with a callback check where time allows.
  3. Preserve call recordings and network data, so police can trace callers while the campaign is still running.
  4. Pre-agree a graded response for addresses repeatedly targeted by hoaxes.

Mappings: STRIDE S, D · CAPEC-151, CAPEC-416 · CWE-290 · CIE 6, 7, 12

BKS-ES-2 · Staff directory stolen in one go

Directories, rosters and contact lists for police, fire and ambulance staff sit in shared systems reachable with one stolen session. Taken in bulk, they let an adversary phish, impersonate, intimidate or locate staff, and know who will be on duty in a crisis.

Case: Dutch police staff data, 2024.

Principle. Staff identities and rosters must be protected as security data, with access limited and bulk export detected.

Design measures.

  1. Limit who and what can read the whole staff directory, and alert on bulk queries or exports.
  2. Bind sessions to devices and require phishing-resistant authentication for cloud services.
  3. Plan how to warn and protect staff quickly if their details are stolen.

Mappings: STRIDE I, S · CAPEC-593, CAPEC-60 · CWE-359, CWE-294 · CIE 3, 8, 12

Public cases cited in this suit

© 2026 Jonathan Brett Crawley. Licensed under CC BY-NC-ND 4.0 with additional permissions: see the licence on the overview. † marks a physical-safety consequence.