The alert that lights up a phone in your county was not sent by a phone company, and in most cases it was not sent by FEMA either. It was composed by somebody at a desk in an emergency operations center or a weather forecast office, entered into software that speaks one standard message format, and handed to a federal gateway that fans it out to whichever channels that person was given permission to use. This piece explains the architecture, who holds the authority, what the message length and geotargeting rules actually allow, and why the drafting and the drills matter more than the software.

Alerting authority: the MOA, the COG, and the permissions list

The Integrated Public Alert and Warning System, which everyone calls IPAWS, is a FEMA-operated message gateway rather than a warning system in the sense that a siren is a warning system. Its origins are in Executive Order 13407, signed in June 2006, which directed the establishment of a public alert and warning system with the capability to reach the American people through multiple communications pathways, and its statutory footing was strengthened by the IPAWS Modernization Act of 2015, which was signed in April 2016. What the gateway does is accept a message written in the Common Alerting Protocol, an open standard developed through the OASIS consortium, validate the sender and the message, and pass it to the distribution channels that the sender is authorized to use. FEMA does not write your local alerts, and the carriers do not write them either.

Becoming an alerting authority is a paperwork process rather than a purchase. A state, tribal, territorial or local government applies to the FEMA IPAWS Program Office, signs a memorandum of agreement, and is issued an identifier for its Collaborative Operating Group, the COG, which is the unit of identity in the system. Personnel who will originate alerts complete FEMA’s independent study training for alerting authorities, the IS-247 course in whatever its current revision happens to be, and the agency has to obtain alert origination software of its own, because FEMA supplies the gateway and not the front end. Public alerting permissions are then granted channel by channel and, in practice, event code by event code, so an agency may hold permission to send an EAS message and a weather radio message without holding permission to send a wireless alert. In many states the application passes through a designated state IPAWS point of contact who reviews what the local jurisdiction is asking for, and the current process, forms and training requirements should be confirmed with FEMA and with your own state emergency management agency rather than taken from an article.

So the honest answer to the question in the title is that a short and specific list of people can push an alert to your phone. The National Weather Service originates the overwhelming majority of wireless alerts in the United States through its forecast offices. State and local alerting authorities that hold wireless permission can originate for their own jurisdictions. AMBER alerts reach the channel through the state’s designated AMBER coordinator, which in most states sits with the state police or a comparable agency. National alerts, the class formerly labeled Presidential, can be originated only at the direction of the President, and they are the one class subscribers cannot turn off. FEMA publishes a current list of IPAWS alerting authorities, and if you want to know whether your county has wireless permission today, that list and your state point of contact are the two places to find out.

A detail that catches small agencies is that a city does not necessarily need its own COG. Many municipalities are covered by the county 911 center or the county emergency management agency, which holds the permissions and originates on request. That arrangement is fine and it is often the right one, though it converts a technical question into an operational one, because the useful thing to know is not whether somebody in the county can send an alert but whether a named person will answer the phone at two in the morning on a Sunday, what that person will need from your incident commander, and how long the whole exchange takes when nobody has rehearsed it.

One message, four ways out: WEA, EAS, weather radio, and the public feed

A single CAP message entering the gateway can be dispatched to several distribution paths at once, and the paths behave so differently that treating them as one button is the most common drafting error I see. Wireless Emergency Alerts, WEA, go to participating commercial mobile service providers and are pushed to handsets by cell broadcast. The Emergency Alert System, EAS, goes to broadcast radio and television stations, cable systems, wireline video providers, satellite radio and direct broadcast satellite. Non-weather emergency messages go to the National Weather Service for rebroadcast over NOAA Weather Radio All Hazards, the 162 MHz receivers that sit in schools, hospitals and a lot of bedrooms. The IPAWS all-hazards information feed is a public data feed that third parties consume, which is how alerts turn up in weather apps, on digital signage, in some campus systems and in various aggregators.

Cell broadcast is worth understanding because it explains most of WEA’s behavior. The alert is transmitted point-to-multipoint from the cell sites serving the target area, so it does not require a list of phone numbers, it does not depend on knowing who is in the area, and it is not subject to the same congestion that makes text messages crawl during a major incident. The tradeoffs come with that design. There is no delivery confirmation for any individual handset, a phone that is switched off or out of coverage does not receive the alert and does not get it later, older handsets and non-participating carriers are outside the system, and subscribers may opt out of every class except national alerts. Nobody should plan on the assumption that a wireless alert reached everyone in the polygon.

Opt-in mass notification platforms, the ones where residents register a phone number to get calls and texts from the county, are a different animal that sits outside IPAWS entirely, and the site’s article on getting warnings to the public covers those in more detail. The distinction that matters here is that an opt-in system reaches only the people who signed up, with contact data that ages badly, over paths that do get congested, while WEA reaches devices in a geographic area regardless of who owns them and regardless of whether the owner has ever heard of your agency. Agencies that treat their subscription list as their warning capability tend to discover the size of the subscribed population during an evacuation.

What a WEA message can and cannot contain

WEA has its statutory origin in the Warning, Alert and Response Network Act of 2006 and its rules in the FCC’s Part 10, and the service went live for the public in April 2012 under the earlier name of the Commercial Mobile Alert System. The original message length limit was 90 characters, which is why the early alerts read like telegrams. The FCC’s 2016 order raised the maximum to 360 characters for networks and devices capable of supporting it, with an implementation deadline in 2019, and the 90-character message remains the fallback where the longer form is not supported. The same order required participating providers to support Spanish-language alerts, and the FCC adopted a further order in 2023 requiring support for additional languages through pre-installed templates, with staged compliance dates. Language support and character limits both change by regulatory action, so confirm the current state of both with the FCC’s WEA pages and with FEMA before you finalize a template library.

Alert classes determine both what a message may contain and how a handset treats it. The classes have grown over time and currently include national alerts, imminent threat alerts, AMBER alerts and public safety messages, with the FCC having acted more recently to add a category for missing and endangered persons; the authoritative current list is FEMA’s, not mine. Imminent threat and public safety messages, along with AMBER alerts, may carry an embedded reference, meaning one URL or one telephone number. National alerts may not carry embedded references. Imminent threat and national alerts trigger the distinctive attention signal and vibration cadence and will sound on a phone whose ringer is silenced, which is precisely why the imminent threat class should be reserved for hazards where waking a sleeping population is the correct outcome.

The practical drafting consequence of 360 characters is that the message is a headline and a protective action, with the explanation living somewhere else. If you include a URL, point it at something that will survive the traffic, because sending a wireless alert to a county of two hundred thousand people and aiming them at a database-driven county home page is a reliable way to take that page down in the first ninety seconds. A static page, a page on a hosted platform that scales, or a social media destination is a better landing spot than the site your webmaster is proud of. Short links are useful for character economy, and they carry the risk that a shortening service outage or an expired account turns your reference into a dead end, so whichever route you choose should be tested from a phone on a cellular connection rather than from a desk on the agency network.

Polygons, county codes, and the overshoot problem

Early WEA geotargeting was crude, with the rules requiring only that alerts be delivered to an area no worse than the county level, which meant a chemical release affecting one industrial park alerted an entire county and taught a lot of people to opt out. The FCC’s 2018 order tightened this considerably, requiring participating providers to deliver alerts to an area matching the target area with no more than one-tenth of a mile of overshoot, with a compliance date at the end of November 2019. That capability depends on the handset as well as the network, because the phone participates in deciding whether it is inside the polygon, so the geotargeting you get in practice varies with the age of the device in somebody’s pocket.

Overshoot and undershoot are both worth thinking about before you draw a polygon in anger. A tight polygon along a river floodplain will spill into the neighborhood on the bluff above it, and it may also miss a phone that is attached to a distant cell site because of terrain or building penetration. Radio propagation does not respect the boundary you drew, and neither does human movement, since the commuter who receives your shelter-in-place alert on the interstate may be twenty miles past the polygon by the time they read it. My own practice is to draw the polygon around the area where the protective action is correct, and then to write the location into the text of the message so that a person who received it outside the intended area can tell within one sentence that it does not apply to them.

The mismatch between channels is the part that surprises people. CAP supports a polygon, a circle and geocodes, and WEA distribution can work from the polygon, while EAS geography is built on the Specific Area Message Encoding scheme with its FIPS-based county and county-subdivision codes, so an EAS message is inherently a county-level or coarser product. NOAA Weather Radio transmitters cover broad areas by design and are selected by SAME code as well. If your message needs to be geographically precise, WEA is the precise channel and the others are not, and the drafting has to account for the fact that the same words will be heard by an audience many times larger than the polygon if you send it to broadcast.

EAS: the daisy chain, the CAP path, and the state plan

EAS is the oldest surviving piece of this architecture, descended from CONELRAD in the 1950s and the Emergency Broadcast System that ran from 1963 until EAS replaced it in 1997. It is administered jointly by the FCC, which writes the rules in Part 11, FEMA, which runs the origination side, and the National Weather Service, which is by volume its heaviest user. There are two independent distribution paths, and the existence of both is the reason EAS still works when the internet does not. The legacy path is a broadcast daisy chain, in which Primary Entry Point stations receive a national message directly from FEMA and other stations monitor assigned sources, with local primary and state relay assignments documented in the State EAS Plan. The newer path is the CAP path, in which EAS participants poll the IPAWS feed over the internet, a requirement that took effect for participants in 2011.

Participation rules are narrower than most people assume. EAS participants are required to carry a national activation and required to participate in national tests, while carriage of state and local EAS messages is voluntary for broadcasters, and the willingness of a given station to interrupt programming for your civil emergency message depends on relationships and on what the state plan says. This is why the local broadcast engineer and the news director belong on your contact list alongside FEMA, and why a jurisdiction that has never spoken with its local primary station should not assume its message will air.

Two operational constraints are worth committing to memory. Part 11 limits non-national EAS message audio to two minutes, which is a great deal more than 360 characters and still not enough for a rambling official statement, and the FCC’s rules prohibit transmission of false or deceptive EAS codes and attention signals, a prohibition that has produced enforcement action against broadcasters who used the tones in programming. State EAS Plans are filed with the FCC by State Emergency Communications Committees, and the Commission restructured that governance and the filing process in a 2022 order that also consolidated test reporting into a single reporting system. Rather than quoting a section number to your chief, get the current State EAS Plan from your State Emergency Communications Committee and read the monitoring assignments for your own county.

Hawaii, January 2018: what the false alert changed

On the morning of January 13, 2018, the Hawaii Emergency Management Agency sent a live wireless alert reading, in full, “BALLISTIC MISSILE THREAT INBOUND TO HAWAII. SEEK IMMEDIATE SHELTER. THIS IS NOT A DRILL.” The message was published in the FCC Public Safety and Homeland Security Bureau’s report on the incident, which was released later that month. There was no missile. The alert went out at about 8:07 in the morning local time during a shift-change exercise, and a corrected wireless alert reached the public roughly thirty-eight minutes later, with intermediate corrections issued through social media and other means in the interval.

The findings that matter for the rest of us are procedural rather than technical. The FCC’s report described an exercise scenario played over the internal notification system whose recorded message contained exercise language and also contained the phrase “this is not a drill,” and it recorded that the employee who sent the alert stated he believed the threat was real, while other personnel on duty reported hearing the exercise language clearly. The FCC noted that it was not able to interview that employee directly. The state of Hawaii conducted its own investigation with its own findings about the individual’s performance history, and the two records do not tell an identical story about what the employee understood, which is a good reason to read both rather than either one alone. What is not in dispute is that the agency’s software presented live and test options in the same menu, that no second person was required to authorize a live public alert, and that the agency had no pre-scripted cancellation message ready to send.

The doctrinal consequences spread well beyond Hawaii. FEMA and the FCC both pushed alerting authorities toward a second-person authorization step for live public alerts, toward clear separation between test and live functions in origination software, and toward maintaining a cancellation and correction template as a standing item. If your agency holds wireless permission and cannot show a written authorization step and a correction template today, then the most consequential lesson of January 2018 has not yet been applied at your desk, and applying it costs a meeting and a page of text rather than a budget request.

Drafting in advance: CAP fields, five content elements, and the 911 surge

CAP carries structured fields that determine how the message is treated downstream, and the three that govern WEA imminent threat eligibility are urgency, severity and certainty. The combination that qualifies is an urgency of immediate or expected, a severity of extreme or severe, and a certainty of observed or likely, which means a hazard your agency rates as possible rather than likely will not go out as an imminent threat no matter how strongly the incident commander feels about it. Those fields are not decoration and they are not marketing, so somebody at your agency needs to understand them well enough to explain to a chief why a particular message did or did not qualify, and the current authority on the required combinations is FEMA’s IPAWS documentation and the FCC’s Part 10 rules.

The content of the text itself is where most agencies underperform, and the elements taught in FEMA’s alerting courses are a reliable checklist: name the source so the reader knows who is talking, name the hazard, name the location precisely enough to be actionable, state the time frame, and state the protective action in the imperative. Within 360 characters that means writing the protective action first if the character count gets tight, spelling out place names rather than using agency shorthand, and avoiding both jargon and acronyms that mean nothing outside the building. Templates make this possible. A library of pre-approved messages for your actual hazards, whether that is a dam failure, a hazardous materials release at a named facility, a wildfire evacuation in a named subdivision, a boil water notice, or an active shooter at a large venue, converts a twenty-minute drafting argument into filling in three blanks. Draft them with your public information officer, have your legal counsel and your authorizing official approve them once, and store them inside the alerting software rather than in a folder somebody has to find.

Two operational consequences of sending an alert belong in the plan alongside the text. The first is the call surge, because a wireless alert to a populated polygon generates calls to your 911 center from people asking what it means, and if the telecommunicators have not been given the message text and a one-line answer before the alert goes out, they will be answering an emergency line with a guess. The second is the follow-through, since telling several thousand people to seek shelter or to evacuate creates an obligation to tell them when it is over and where to get more information, which is why the cancellation and the all-clear are part of the same template set as the initial warning. My rule for the drafting file is that no scenario is finished until it has an initial message, an update, and an all-clear written for it.

Testing, proficiency, and the person on shift at three in the morning

Nationwide tests exercise the top of the architecture rather than your part of it. The first nationwide EAS test was conducted on November 9, 2011, the first nationwide test that included WEA took place on October 3, 2018, a further nationwide test was conducted on August 11, 2021 with the wireless portion going to handsets that had opted in to receive test messages, and a nationwide test of both EAS and WEA was conducted on October 4, 2023. FEMA and the FCC publish the schedule and the results, and the current schedule should be taken from them. None of those tests tells you whether your county’s software, credentials and personnel work, because they do not involve your county’s software, credentials or personnel.

What tells you that is proficiency exercise in the IPAWS test environment, which FEMA provides so that a COG can send messages end to end without alerting the public, and which FEMA has long recommended alerting authorities use on a regular cycle. Ask your vendor and your state IPAWS point of contact how your agency’s proficiency demonstrations are scheduled and who receives the confirmation. Ask also about the credentials and any digital certificate that authenticates your connection to the gateway, specifically who tracks the expiry date and what happens to your ability to alert if it lapses, because an expired credential discovered during a live incident is a failure mode I would rather a reader avoid by asking a question this month. For a live end-to-end test that reaches the public, the State and Local WEA Test category exists precisely so that an authority does not have to use a real alert code, and the way it behaves on handsets depends on carrier and device implementation, so plan any public-facing test with FEMA, your state, and public notice well in advance.

The personnel problem outlasts every technical problem in this subject. Permission belongs to the agency and competence belongs to individuals, so a jurisdiction with one trained originator has a warning capability that works during business hours on days that person is not on vacation. The questions to answer in writing are how many people hold current training and current logins, whether the login credentials are individual or shared and what your records retention policy says about that, who authorizes a live public alert at three in the morning and how that person is reached, and what happens if the primary alerting workstation or the internet connection at the emergency operations center is unavailable. The last one usually resolves to a second machine at the 911 center or a mutual aid arrangement with a neighboring COG, and it is worth documenting that the neighboring county will send on your behalf before you need them to.

What to do at your agency

• Have your emergency management director confirm in writing which IPAWS channels and event codes your COG currently holds permission for, or, if you do not hold a COG, which agency alerts on your behalf and what its after-hours phone number is, and file that page with your emergency operations plan.
• Ask your alerting software vendor and your state IPAWS point of contact who tracks the expiry date of your connection credentials and certificates, get the next expiry date, and put it on the same calendar your agency uses for license renewals.
• Have the alerting authority list every person who currently holds both completed FEMA alerting authority training and a working login, and if that list has fewer than three names, enroll two more people this month.
• Write a cancellation and correction template and an all-clear template into your alerting software for your two most likely scenarios, have the authorizing official approve the wording once, and confirm they can be retrieved from the software rather than from a shared drive.
• Add one item to the next emergency management or communications committee meeting already on the calendar: who authorizes a live public alert between midnight and six in the morning, how that person is contacted, and what happens if they do not answer.
• Run one proficiency exercise in the FEMA IPAWS test environment with the person who is actually on shift rather than the person who set up the software, and have the 911 supervisor confirm that dispatch received the message text and a one-line answer for callers before the exercise message went out.
• Have your public information officer verify that the landing page named in your templates loads in under three seconds from a phone on a cellular connection, and move it to a static or hosted page if it does not.

Takeaways

• IPAWS is a FEMA-operated gateway that accepts Common Alerting Protocol messages and distributes them to authorized channels, and it does not compose local alerts, which are written by state, tribal, territorial and local alerting authorities and by National Weather Service forecast offices.
• Alerting authority comes from an application to FEMA, a memorandum of agreement, a COG identifier, completion of FEMA’s alerting authority training, agency-supplied origination software, and permissions granted channel by channel, and FEMA publishes the current list of alerting authorities.
• National alerts can be originated only at the direction of the President and are the only class subscribers cannot opt out of, while imminent threat, AMBER and public safety message classes are all subject to opt-out.
• WEA message length rose from an original 90 characters to a maximum of 360 for supporting networks and devices under the FCC’s 2016 order, with an implementation deadline in 2019, and both the character limits and the language requirements have changed by regulatory action since, so current specifics belong to FEMA and the FCC.
• WEA uses cell broadcast, so it needs no phone number list and resists congestion, and it also provides no per-device delivery confirmation and does not reach a handset that was switched off, out of coverage, opted out, or too old to participate.
• The FCC’s 2018 order required participating providers to match the target area with no more than one-tenth of a mile of overshoot as of the end of November 2019, while EAS and NOAA Weather Radio remain keyed to county and county-subdivision codes, which means the same words sent to broadcast reach a far larger audience than the polygon.
• EAS survives on two independent paths, the legacy broadcast daisy chain documented in the State EAS Plan and the internet-based CAP path required of participants since 2011, and carriage of state and local messages is voluntary for broadcasters even though national activation and national tests are not.
• The January 13, 2018 Hawaii false missile alert, documented in the FCC Public Safety and Homeland Security Bureau’s report that month, involved no second-person authorization for a live public alert, live and test functions in the same software menu, and no pre-scripted cancellation, and the corrected wireless alert reached the public roughly thirty-eight minutes after the original.
• A cancel message stops further distribution and does not remove an alert already on a handset, so correcting a bad alert means sending a second alert that the public will see, which is an argument for writing that correction template in advance.
• WEA imminent threat eligibility depends on the CAP urgency, severity and certainty fields rather than on how urgent the incident feels, and somebody at your agency needs to understand those fields well enough to explain a rejection to a chief.
• Nationwide tests, conducted in 2011, 2018, 2021 and 2023 among others, exercise the national architecture and tell you nothing about your own credentials, templates and staffing, which are exercised only in the FEMA IPAWS test environment with your own people.