[EAS] EAS and WEA usage during the protests/riots/civil unrest

[Sean Donelan]

On Mon, 6 Jul 2020, Dave Turnmire wrote:
> On 6/10/2020 7:25 AM, Dave Kline wrote:
>> All of this has now lead me to conclude that the alert I saw on Saturday 
>> afternoon, had actually come in on Friday evening,
> I no doubt should know this... but... in my low population area, WEA alerts 
> are pretty rare, so my experience is limited:
>
> Don't WEA alerts have an event duration or expiration time such as EAS does? 

1. Software sucks.

2. Organizations don't like to share their operational logs.

Every service operator in the WEA delivery chain maintains operational 
logs.  However these logs are considered proprietary, and not shared. 
Broadcasters, cellular service providers, emergency management officials, 
device manufacturers, etc. hate sharing access to their logs with 
"outsiders."

So its very unlikely you will be able to determine what happened.

WEA has an expiration time, but the expiration time is NOT transmitted as 
part of the wireless message to the mobile device. Instead, cellular 
service providers re-broadcast active WEA messages every "N" minutes 
(N=varies by service provider) until the end of the alert. Mobile devices 
check the broadcast message IDs, and ignore duplicate re-transmissions 
of the same message ID.

Cellular provider towers cease re-transmiting cancelled and expired WEA 
messages.  Importantly, they do not transmit any message at the end of 
an alert. WEA message re-transmissions just cease.

What could go wrong?

If you power-off and restart your mobile device, the device may flush its 
cache of old message IDs, and all continuing alert broadcast transmissions 
will be treated as new messages.

If your mobile device "roams" to a different carrier's tower, the other 
service provider may use different message IDs, and your device will see 
the duplicate message as "new" from the new carrier.  This should only 
happens when you roam to a different carrier.  Changing towers within the 
same service provider's area should maintain the same message IDs across 
its towers in the area.

Again, if the alert messages are expired or cancelled, the new cell tower 
should NOT still be transmitting old messages. WEA messages are supposed 
to be limited to a maximum of 24 hours. Theoretically, the worst case 
would be a 24-hour old WEA message, not weeks old.

WEA 3.0 and device-based geo-fencing may change how mobile devices 
store & process old messages while crossing alert polygon boundaries. I 
don't think in-transit device-based geo-fencing has been standardized. 
But AMBER alerts rarely use polygons or DBGF. Not relevant in this case.

Most likely cause
    1. Carrier mobile switch oops.
         I've seen carriers reboot a message server somewhere in the nation 
and re-send old messages.  Happens with SMS/TXT, WEA, Email, etc.
    2. Software bugs in the carrier or mobile devices
         Expected carrier rsponse -- crickets.

Did I mention software sucks.