Cybersecurity experts outline challenges associated with FirstNet, other public-safety communications

While commercial IoT sensors can provide valuable situational data to first responders on occasion, public safety’s most common input from citizens is through the 911 system, which is in the early stages of transitioning to next-generation 911 (NG911). This all-IP platform should integrate well with FirstNet’s all-IP broadband system, but NG911’s ability to receive text, data, photos and video—as well as traditional voice—does create new cybersecurity concerns, Kassa said.

“As we move to next-generation 911, we can send video to a PSAP, we can send text, we can send payloads of just about anything that is multimedia in nature,” Kassa said. “So, now we have a problem where I’m getting video, and I’m getting texts. I don’t really know what’s in these files, but I know these are all great attack vectors. How many of you have opened up the wrong e-mail and had your IT department come and find you, because you infected the entire network?”

Zimmerman said that there are a variety of techniques that would allow such multimedia files to be opened and inspected for viruses and other potential cyberthreats quick enough to meet the needs of public safety. Some technologies can clean files of malicious software, but there may be a tradeoff, he said.

“The qualifier is that occasionally—because of the heinously invasive and intertwined nature of some types of attacks—by the time it cleans it [the file], it’s blank; there was nothing that was able to be preserved,” Zimmerman said.

“In those instances, the system has to be able—in real time—to make the determination that, ‘I can clean this right now, but the problem is that there will be nothing left to review. I will pass it in a protected mode, so it can be viewed in another part of the system, but it cannot communicate with any other part of the system.’ So you can pull that data, then it will immediately flush it out and log that it was a contaminated message.”

If the contaminated message contains information that is critical to the response—for instance, video of a suspect fleeing a crime scene—and ideally would be shared as quickly as possible, determining how to handle that file becomes more complicated, Kassa said. Sharing such files may help the immediate response effort, but it could compromise public-safety user devices and the larger system in the long term.

“[That] is something we’ve got to figure out as a whole community,” Kassa said. “FirstNet will be able to get that very quickly to the responder. But if it’s infected when you stick it in the pipe, it’s going to be infected at the other end of the pipe, because we don’t we don’t want to be in the situation of cleaning out the file. So, it’s something we’ve got to figure out.”