Persona: Senior Cyber-Physical Systems (CPS) & RF Security Analyst
Abstract:
This analysis examines the technical architecture and security posture of the Emergency Alert System (EAS) and the Specific Area Message Encoding (SAME) protocol, with a specific focus on its implementation within Mexico’s Seismic Alert System (SASMEX). The speaker, Manuel Rábade, details how SASMEX leverages the speed differential between seismic waves (4.5 km/s) and radio waves (300,000 km/s) to provide Mexico City with a ~60–90 second early warning for subduction zone earthquakes.
The technical core of the presentation explores the SAME protocol—a legacy 1960s-era Audio Frequency Shift Keying (AFSK) system operating in the 162 MHz VHF band. While the system's simplicity ensures resilience and interoperability across North America, it lacks modern cryptographic primitives. The analysis demonstrates that the absence of origin verification and message signing renders the infrastructure vulnerable to signal spoofing and unauthorized alert injection via Software Defined Radio (SDR). The session concludes with a discussion on the trade-offs between system accessibility and the security requirements of critical public safety infrastructure.
Technical Summary: EAS-SAME Protocol and SASMEX Infrastructure
0:15 Seismic Context and Early Warning Logic: Mexico City's geography (former lakebed) amplifies seismic waves. SASMEX exploits the "early warning" window: seismic waves from the coast take ~90 seconds to reach the city, while radio-based alerts arrive near-instantaneously (1 second), providing actionable lead time.
6:13 SASMEX System Architecture: The system consists of coastal sensor stations (accelerometers), a network of repeaters, and a central processing station in Mexico City that runs rapid detection algorithms to trigger alerts via dedicated VHF channels.
9:22 Reverse Engineering and Community Impact: The speaker documented the transition from closed, expensive proprietary receivers to open-source solutions. By developing a Python-based decoder and an SDR-based receiver, the speaker catalyzed a market shift, forcing commercial vendors to lower costs and prompting the adoption of more accessible hardware.
12:24 SAME Protocol Technical Specs: SAME utilizes AFSK modulation at a bit rate of approximately 520.83 bps. It is a minimalist, low-bandwidth protocol designed for high reliability in analog environments.
15:03 RF Parameters and Modulation: Alerts are broadcast over seven standard channels in the 162.400–162.550 MHz range (Wide FM, 16 kHz bandwidth). In Mexico, transmitters typically operate at 100 watts with a ~50 km range.
16:51 Message Framing and Redundancy: A SAME message packet includes a Preamble, a Header (sent three times for forward error correction/voting), an optional 1050 Hz attention tone, a voice message, and an End of Message (EOM) burst.
17:54 Header Metadata: The digital header contains the Originator ID, Event Type (e.g., EQW for Earthquake Warning), Geographic Area Code (FIPS/PSS), Issue Time, and Expiration Time.
18:41 Mexican Implementation Deviations: Mexico’s implementation (NOM/technical standards) differs slightly from the U.S. NOAA standard, utilizing specific test intervals (every 3 hours) and omitting voice messages in favor of a standardized, high-intensity audio alert.
20:10 Signal Reception and Decoding: Reception is achievable using low-cost RTL-SDR hardware and quarter-wave monopole antennas. Software tools like SDR++ and custom Python scripts using the Goertzel algorithm can reliably decode these transmissions.
24:24 Synthesis and Spoofing Risks: Because the protocol is unencrypted and lacks digital signatures, an attacker with a VHF transmitter (or SDR with a power amplifier) can inject arbitrary alert packets. There is no built-in mechanism for receivers to verify the authenticity of the broadcast source.
Strengths: Simplicity, high resilience, massive interoperability, and low power requirements for receivers.
Vulnerabilities: Lack of origin verification, susceptibility to message tampering, and vulnerability to RF jamming or spoofing.
32:15 Policy and Regulatory Outlook: While newer technologies like Cell Broadcast and Common Alerting Protocol (CAP) introduce XML-based signatures, legacy EAS-SAME remains a primary layer of defense due to its ability to function when cellular infrastructure fails.
Recommended Reviewers
To comprehensively evaluate the implications of this data, the following expert groups should review this material:
Critical Infrastructure Security Personnel: To assess the physical and psychological impact of unauthorized alert injection on urban stability.
RF Protocol Engineers: To evaluate potential "shim" solutions for introducing authentication into legacy AFSK systems without breaking backward compatibility.
Emergency Management Agency Technicians (FEMA/NOAA/SASMEX): To coordinate the transition toward Common Alerting Protocol (CAP) and signed digital broadcast standards.
Hardware Security Researchers: To review the robustness of consumer-grade alert receivers against non-standard signal inputs.