As evidenced in the November 8, 2001 Federal Communication Commission (FCC) order, Mass Media broadcasters are being placed under great pressure to convert their facilities to all Digital Tele-Vision (DTV) and radio (IBOC) operation. At risk of humor we will generalize this transition to digital as Broadcast Architecture Digital (BAD). In the several Memoranda and Orders, the FCC has acted to expedite Broadcast Digital transition by placing strict time limits with real penalties on the implementation of Digital Broadcast build-out rules. Through this aggressive digitization doctrine, the Broadcast industry is being strongly encouraged by the FCC to convert all broadcast communications facilities exclusively to digital technology.
The FCC has mandated that there are very few reasons to defer this conversion. Broadcasters understand that there is a great risk of penalty (including loss of license) for non-compliance without good reason. "Good Reasons" currently include:
It is the contention of this document to demonstrate that there is another extremely vital good reason to approach DTV conversion with deliberation.
|
BROADCASTERS CANNOT PROTECT DIGITAL BROADCAST SIGNALS WITHOUT DIGITAL INFORMATION SECURITY CONSIDERATION AND DESIGN. |
This document summarizes certain issues that may not be immediately visible to the broadcasting industry. Of concern is the security of both transmission facilities and the validation of content when compromised. Regulators must be made aware that a comprehensive, effective security architecture must be correctly implemented to prevent broadcasters from becoming unwitting parties to acts that may be criminal or even undermine national security.
At this time, while we feel that no new rulemaking is required, this issue of broadcast system security needs to be brought forth in a public forum in order to increase homeland security. Thus a delay in the implementation of DTV nationwide is mandated.
The issues fall into two broad categories:
False control of transmission facilities includes such ideas as unauthorized persons controlling authorized transmitters and unauthorized transmissions.
Subversion of content can include substitution of unauthorized content and prevention of authorized content transmission.
These are not new issues in the sense that these acts have been committed before. Examples of "pirate" stations and program substitution pre-dating digital broadcasting are easy to find. The new concerns include the possibilities of digital sabotage that may not be addressed as we transition to an unsecured interconnected digital world of programming and transmission. Although signal based acts such as these have been committed before, there appears to be an assumption that digital technology will automatically prevent further crimes. In fact quite the opposite is rather the case. When all digital systems are installed the opportunity for the distortion of transmission systems seems to be a constant problem. What the Broadcast industry is being forced to do is make itself as vulnerable as the World Wide Web to hacking and other forms of digital signal mischief.
Note that there are techniques to mitigate and prevent these crimes. It is possible to use digital technology to enhance the security beyond that possible in the primarily analog systems. These include but are not limited to many methods of
None of these techniques have been mandated by regulation, and our research has determined that these techniques are not being considered in the haste to meet the FCC imposed DTV implementation requirements.
Particularly in the current climate, the duty of the FCC is to assure that the public gets timely, accurate, information privacy, accuracy integrity and non-repudiation. The FCC, while attempting the laudable task of improving the national television transmission system is inadvertently allowing security architecture to fall by the wayside in favor of expediency.
The goal of this document is to make you aware of the need to insure that an overall security strategy and architecture is developed tested certified and installed prior to a declaration of operational readiness requirement for Digital Broadcasting.
The following examples show how work done on computer network security issues can be applied to broadcast facilities.
This is equivalent to control of the transport layer in standard internetworking terminology.
Internet access to transmitter control has been seriously proposed and implemented and positively reported. This was documented at the National Association of Broadcasters (NAB 2000) a paper on Internet based transmitter control was presented (Internet Information Server was reported to be the system in use to control a transmitter plant remotely.
Currently all transmission system control chains are typically under the direct control of computer operating systems with known security vulnerabilities.
This is equivalent to control of the session layer in standard internetworking technology.
The Media eXchange Format (MXF) proposed interoperability standard implements as the exchange method the FTP protocol. This legacy protocol places both the system security user ID and Password in the clear on the transmission path.
While internal information security at the FCC is exemplary, information security and assurance, particularly in the area of common carrier disaster restoration priority and tariff issues, are the major considerations of the Commission. Broadcast information security is at this time only a consideration with the emergency notification system at a technical level and a rating system at the program level.
Assurance in this area of Broadcast Security Architecture might fall under the Jurisdiction of Homeland Security. If this were the case this might involve a significant structural adjustment to the FCC mandate. Whether this would be a good thing is worth serious consideration.
Rather than expand this internal entertainment industry issue, a proposed mitigation of this matter would as mentioned above involve the existing FCC process for public comment. The upshot of this process might involve into the clarification of regulations, followed by Notice of Inquiry, and Notice of Proposed Rule Making, a standard change activity within the FCC.
The desired result is that broadcasters moving towards converged systems would be supported in insuring they can securely continue to meet the public interest, convenience and necessity by not allowing themselves to become unwitting participants in crimes. Now is the time that Broadcasters be made aware of the policy issues involved in developing a security architecture, have a forum to address those issues, and have access to technology that can minimize the risks.
On September 12, 2001 engineers finally noticed that the Cockpit doors on passenger airlines would likely need to be reinforced. If only airline system security had been considered prior to this date, we would be living in a different world. It is our hope that this draft petition could serve as a wake-up call to the Regulatory and Broadcast community to consider proper security architecture design and certification now, rather than when the damage is done.