{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,4,4]],"date-time":"2026-04-04T08:45:20Z","timestamp":1775292320173,"version":"3.50.1"},"reference-count":22,"publisher":"Association for Computing Machinery (ACM)","issue":"10","license":[{"start":{"date-parts":[[2021,9,22]],"date-time":"2021-09-22T00:00:00Z","timestamp":1632268800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["Commun. ACM"],"published-print":{"date-parts":[[2021,10]]},"abstract":"<jats:p>Modern cell phones are required to receive and display alerts via the Wireless Emergency Alert (WEA) program, under the mandate of the Warning, Alert, and Response Act of 2006. These alerts include AMBER alerts, severe weather alerts, and (unblockable) Presidential Alerts, intended to inform the public of imminent threats. Recently, a test Presidential Alert was sent to all capable phones in the U.S., prompting concerns about how the underlying WEA protocol could be misused or attacked. In this paper, we investigate the details of this system and develop and demonstrate the first practical spoofing attack on Presidential Alerts, using commercially available hardware and modified open source software. Our attack can be performed using a commercially available software-defined radio, and our modifications to the open source software libraries. We find that with only four malicious portable base stations of a single Watt of transmit power each, almost all of a 50,000-seat stadium can be attacked with a 90% success rate. The real impact of such an attack would, of course, depend on the density of cellphones in range; fake alerts in crowded cities or stadiums could potentially result in cascades of panic. Fixing this problem will require a large collaborative effort between carriers, government stakeholders, and cellphone manufacturers. To seed this effort, we also propose three mitigation solutions to address this threat.<\/jats:p>","DOI":"10.1145\/3481042","type":"journal-article","created":{"date-parts":[[2021,9,22]],"date-time":"2021-09-22T14:37:02Z","timestamp":1632321422000},"page":"85-93","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":3,"title":["Securing the wireless emergency alerts system"],"prefix":"10.1145","volume":"64","author":[{"given":"Jihoon","family":"Lee","sequence":"first","affiliation":[{"name":"University of Colorado Boulder, Colorado"}]},{"given":"Gyuhong","family":"Lee","sequence":"additional","affiliation":[{"name":"Korea Army Academy, Yeongcheon, South Korea"}]},{"given":"Jinsung","family":"Lee","sequence":"additional","affiliation":[{"name":"University of Colorado Boulder, Colorado"}]},{"given":"Youngbin","family":"Im","sequence":"additional","affiliation":[{"name":"UNIST, South Korea"}]},{"given":"Max","family":"Hollingsworth","sequence":"additional","affiliation":[{"name":"University of Colorado Boulder, Colorado"}]},{"given":"Eric","family":"Wustrow","sequence":"additional","affiliation":[{"name":"University of Colorado Boulder, Colorado"}]},{"given":"Dirk","family":"Grunwald","sequence":"additional","affiliation":[{"name":"University of Colorado Boulder, Colorado"}]},{"given":"Sangtae","family":"Ha","sequence":"additional","affiliation":[{"name":"University of Colorado Boulder, Colorado"}]}],"member":"320","published-online":{"date-parts":[[2021,9,22]]},"reference":[{"key":"e_1_2_1_1_1","first-page":"33969","volume-title":"Technical Specification Group Services and System Aspects","year":"2018","unstructured":"3GPP TR 33.969. Technical Specification Group Services and System Aspects ; Study on security aspects of public warning system (PWS) (Release 15), 2018 . http:\/\/www.3gpp.org\/DynaReport\/ 33969 .htm. 3GPP TR 33.969. Technical Specification Group Services and System Aspects; Study on security aspects of public warning system (PWS) (Release 15), 2018. http:\/\/www.3gpp.org\/DynaReport\/33969.htm."},{"key":"e_1_2_1_2_1","first-page":"23041","volume-title":"Technical Specification Group Core Network and Terminals","year":"2018","unstructured":"3GPP TS 23.041. Technical Specification Group Core Network and Terminals ; Technical realization of Cell Broadcast Service (CBS) (Release 15), 2018 . http:\/\/www.3gpp.org\/dynareport\/ 23041 .htm. 3GPP TS 23.041. Technical Specification Group Core Network and Terminals; Technical realization of Cell Broadcast Service (CBS) (Release 15), 2018. http:\/\/www.3gpp.org\/dynareport\/23041.htm."},{"key":"e_1_2_1_3_1","first-page":"29168","volume-title":"Technical Specification Group Core Network and Terminals","year":"2018","unstructured":"3GPP TS 29.168. Technical Specification Group Core Network and Terminals ; Cell Broadcast Centre interfaces with the evolved packet core (Release 15), 2018 . http:\/\/www.3gpp.org\/dynareport\/ 29168 .htm. 3GPP TS 29.168. Technical Specification Group Core Network and Terminals; Cell Broadcast Centre interfaces with the evolved packet core (Release 15), 2018. http:\/\/www.3gpp.org\/dynareport\/29168.htm."},{"key":"e_1_2_1_4_1","first-page":"31115","volume-title":"Technical Specification Group Core Network and Terminals","year":"2019","unstructured":"3GPP TS 31.115. Technical Specification Group Core Network and Terminals ; Secured packet structure for (Universal) subscriber identity module (U)SIM toolkit applications (Release 15), 2019 . http:\/\/www.3gpp.org\/dynareport\/ 31115 .htm. 3GPP TS 31.115. Technical Specification Group Core Network and Terminals; Secured packet structure for (Universal) subscriber identity module (U)SIM toolkit applications (Release 15), 2019. http:\/\/www.3gpp.org\/dynareport\/31115.htm."},{"key":"e_1_2_1_5_1","first-page":"36211","volume-title":"Technical Specification Group Radio Access Network","author":"Px","year":"2018","unstructured":"3GP Px TS 36.211. Technical Specification Group Radio Access Network ; Physical channels and modulation (Release 15), 2018 . http:\/\/www.3gpp.org\/dynareport\/ 36211 .htm. 3GPPx TS 36.211. Technical Specification Group Radio Access Network; Physical channels and modulation (Release 15), 2018. http:\/\/www.3gpp.org\/dynareport\/36211.htm."},{"key":"e_1_2_1_6_1","first-page":"36331","volume-title":"Technical Specification Group Radio Access Network","year":"2018","unstructured":"3GPP TS 36.331. Technical Specification Group Radio Access Network ; Evolved universal terrestrial radio access (E-UTRA); radio resource control (RRC) (Release 15), 2018 . http:\/\/www.3gpp.org\/dynareport\/ 36331 .htm. 3GPP TS 36.331. Technical Specification Group Radio Access Network; Evolved universal terrestrial radio access (E-UTRA); radio resource control (RRC) (Release 15), 2018. http:\/\/www.3gpp.org\/dynareport\/36331.htm."},{"key":"e_1_2_1_7_1","doi-asserted-by":"publisher","DOI":"10.1007\/s13389-012-0027-1"},{"key":"e_1_2_1_8_1","volume-title":"ACM All Things Cellular (MobiCom Workshop) (November","author":"Bui N.","year":"2016","unstructured":"Bui , N. , Widmer , J. OWL : a reliable online watcher for LTE control channel measurements . In ACM All Things Cellular (MobiCom Workshop) (November 2016 ). Bui, N., Widmer, J. OWL: a reliable online watcher for LTE control channel measurements. In ACM All Things Cellular (MobiCom Workshop) (November 2016)."},{"key":"e_1_2_1_9_1","volume-title":"Cellular coverage and tower map","author":"CellMapper","year":"2018","unstructured":"CellMapper . Cellular coverage and tower map , 2018 . https:\/\/www.cellmapper.net. CellMapper. Cellular coverage and tower map, 2018. https:\/\/www.cellmapper.net."},{"key":"e_1_2_1_10_1","doi-asserted-by":"publisher","DOI":"10.1145\/2789168.2790107"},{"key":"e_1_2_1_11_1","doi-asserted-by":"publisher","DOI":"10.5555\/993515"},{"key":"e_1_2_1_12_1","volume-title":"Workshop) (October","author":"Gomez-Miguelez I.","year":"2016","unstructured":"Gomez-Miguelez , I. , Garcia-Saavedra , A. , Sutton , P.D. , Serrano , P. , Cano , C. , Leith , D.J. srsLTE : an open-source platform for LTE evolution and experimentation. In ACM WiNTECH (MobiCom , Workshop) (October 2016 ). Gomez-Miguelez, I., Garcia-Saavedra, A., Sutton, P.D., Serrano, P., Cano, C., Leith, D.J. srsLTE: an open-source platform for LTE evolution and experimentation. In ACM WiNTECH (MobiCom, Workshop) (October 2016)."},{"key":"e_1_2_1_13_1","doi-asserted-by":"publisher","DOI":"10.1145\/2307636.2307658"},{"key":"e_1_2_1_14_1","doi-asserted-by":"publisher","DOI":"10.1145\/2973750.2973751"},{"key":"e_1_2_1_15_1","doi-asserted-by":"publisher","DOI":"10.1109\/MCOM.2016.7452266"},{"key":"e_1_2_1_16_1","volume-title":"Officials assess response to camp fire in northern california","author":"National Public Radio.","year":"2018","unstructured":"National Public Radio. Officials assess response to camp fire in northern california , 2018 . https:\/\/goo.gl\/iF12Vo. National Public Radio. Officials assess response to camp fire in northern california, 2018. https:\/\/goo.gl\/iF12Vo."},{"key":"e_1_2_1_17_1","volume-title":"Open source implementation of LTE EPC","author":"NextEPC Inc.","year":"2019","unstructured":"NextEPC Inc. Open source implementation of LTE EPC , 2019 . https:\/\/www.nextepc.com\/. NextEPC Inc. Open source implementation of LTE EPC, 2019. https:\/\/www.nextepc.com\/."},{"key":"e_1_2_1_18_1","volume-title":"NS-3: a discrete-event network simulator for internet systems","author":"Nsnam","year":"2018","unstructured":"Nsnam . NS-3: a discrete-event network simulator for internet systems , 2018 . https:\/\/www.nsnam.org. Nsnam. NS-3: a discrete-event network simulator for internet systems, 2018. https:\/\/www.nsnam.org."},{"key":"e_1_2_1_19_1","volume-title":"Cellphone users nationwide just received a 'Presidential Alert.' Here's what to know","author":"The Washington Post","year":"2018","unstructured":"The Washington Post . Cellphone users nationwide just received a 'Presidential Alert.' Here's what to know , 2018 . https:\/\/goo.gl\/KRfDjf. The Washington Post. Cellphone users nationwide just received a 'Presidential Alert.' Here's what to know, 2018. https:\/\/goo.gl\/KRfDjf."},{"key":"e_1_2_1_20_1","volume-title":"Hawaii false missile alert","author":"Wikipedia","year":"2018","unstructured":"Wikipedia . Hawaii false missile alert , 2018 . https:\/\/goo.gl\/oD9ofx. Wikipedia. Hawaii false missile alert, 2018. https:\/\/goo.gl\/oD9ofx."},{"key":"e_1_2_1_21_1","doi-asserted-by":"publisher","DOI":"10.1145\/2348543.2348567"},{"key":"e_1_2_1_22_1","doi-asserted-by":"publisher","DOI":"10.1109\/TWC.2014.030514.130447"}],"container-title":["Communications of the ACM"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3481042","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3481042","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,17]],"date-time":"2025-06-17T20:18:23Z","timestamp":1750191503000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3481042"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2021,9,22]]},"references-count":22,"journal-issue":{"issue":"10","published-print":{"date-parts":[[2021,10]]}},"alternative-id":["10.1145\/3481042"],"URL":"https:\/\/doi.org\/10.1145\/3481042","relation":{},"ISSN":["0001-0782","1557-7317"],"issn-type":[{"value":"0001-0782","type":"print"},{"value":"1557-7317","type":"electronic"}],"subject":[],"published":{"date-parts":[[2021,9,22]]},"assertion":[{"value":"2021-09-22","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}