6 U.S.C. § 321o–1 — Integrated public alert and warning system

(a) Definitions. This section defines its own key terms: "Administrator" means the head of the Agency; "Agency" means the Federal Emergency Management^* Agency (FEMA); "appropriate congressional committees" means the Senate Committee on Homeland^* Security and Governmental Affairs, the House Committee on Transportation and Infrastructure, and the House Committee on Homeland Security; "public alert and warning system" means the national alert system described in section 321o of this title; "Secretary" means the Secretary of Homeland Security; and "State" means every U.S. state, plus the District of Columbia, Puerto Rico, the Virgin Islands, Guam, American Samoa, the Northern Mariana Islands, and any other U.S. possession.

(b) Integrated public alert and warning system.
(1) In general. By December 20, 2020 (one year after enactment), the Administrator had to write minimum requirements that state, tribal, and local governments must follow to use the alert system and to keep it trustworthy. These requirements had to cover: what kinds of emergencies justify sending an alert; the steps officials must follow to confirm an emergency^* is real and to start, change, or cancel an alert — including rules for whether one single person can (or cannot) trigger an alert alone, how to test alert tools without accidentally sending a real alert, and how to reduce the risk of sending a false alert; making sure the tools different governments use work the same way and can talk to each other; yearly training and recertification for the staff who send alerts; procedures for telling the public what to do after a real alert; procedures for telling the public after a false alert; a plan for officials to reach each other, federal officials, and other alert-system participants by phone, text, or other means during an emergency; and any other procedure the Administrator thinks is needed to protect the system's integrity and the public's trust in it.
(2) Coordination with National Advisory Council report. The Administrator had to make sure these new requirements did not conflict with the recommendations in the National Advisory Council's report on improving the alert system, which was required by the 2015 modernization law.
(3) Public consultation. While writing the requirements, the Administrator had to consult the public and, as much as practical, work with stakeholders — including officials from agencies like NIST, FEMA, and the FCC; state and local government^* and emergency-services representatives nominated by national organizations; representatives of Indian tribes and national Indian organizations; communications companies; makers of communications equipment; third-party service companies; the national organization representing noncommercial broadcast TV stations; broadcasting technical experts; instructors from the Emergency Management Institute; and anyone else with relevant technical expertise the Administrator wanted to include.
(4) Advice to the administrator. Under the Federal Advisory Committee Act, the Administrator can get advice from one individual, or separate, non-consensus advice from members of a group, without having to follow that Act's usual committee rules.

(c) Incident management and warning tool validation.
(1) In general. The Administrator must set up a process to check that the software tools state, tribal, and local governments use to send alerts actually meet the requirements written under subsection (b)(1).
(2) Requirements. That process must let a tool be tested in the system's lab; must be able to certify that a tool meets DHS's and NIST's cybersecurity rules; must certify the developers who build emergency-management software; and must require developers to give the Administrator a copy of — and rights to keep testing — each new version of their software before any government starts using it.

(d) Review and update of memoranda of understanding. The Administrator must review the existing agreements between FEMA and state, tribal, and local governments about the alert system, to make sure every agreement matches the requirements set under subsection (b)(1).

(e) Future memoranda. Starting 60 days after the Administrator issues those requirements, any new agreement between FEMA and a state, tribal, or local government about the alert system must follow them.

(f) Missile alert and warning authorities.
(1) In general. Starting 120 days after December 20, 2019, the authority to send a public alert warning of a missile attack on a state belongs mainly to the federal government. The Secretary may hand that authority to a state, tribal, or local government only if, within 180 days, the Secretary tells Congress either that it isn't practical for the federal government to send the alert, or that letting the federal government send it isn't in the national security interest. Once a missile threat is confirmed, the President may activate the alert system using the normal chain of command. Nothing here changes who was in charge of identifying, sharing, or issuing missile-threat information before December 20, 2019.
(2) Required processes. The Secretary, through the Administrator, must set up a way to quickly tell a state's warning point — and any other state offices the Administrator thinks appropriate — as soon as a missile alert is issued, so the state can act to protect its residents.
(3) Guidance. The Secretary, through the Administrator, must work with a state's Governor to build and carry out protective-action plans for responding to a missile alert.
(4) Study and report. Within a year, the Secretary had to study whether it's possible to create a special missile-alert category that warns the public while also alerting the state's warning point, and then report the findings — including costs and a timeline — to five specific congressional subcommittees and committees: the Senate and House Appropriations Subcommittees on Homeland Security, the Senate Committee on Homeland Security and Governmental Affairs, the House Committee on Transportation and Infrastructure, and the House Committee on Homeland Security.

(g) Use of integrated public alert and warning system lab. Within a year, the Administrator had to build a program to get more state, tribal, and local governments using FEMA's alert-system lab to test their tools and train their staff, and then report to Congress on how that program affected lab use — especially in rural areas — and on any further authority or funding the Administrator thinks is needed.

(h) Awareness of alerts and warnings. Within a year, the Administrator had to review FEMA's National Watch Center and each Regional Watch Center, then report to Congress on whether those centers can technically learn about state alerts as they happen, which state alerts they should be aware of, and how to improve their ability to receive the alerts the Administrator thinks matter.

(i) Reporting false alerts. Within 15 days after a state, tribal, or local official sends a false alert, the Administrator must report to Congress on what caused it, what it said, how many people it reached, and what was done to reduce the harm.

(j) Reporting participation rates. Every year, the Administrator must report to Congress on how many governments are participating in the alert system, and on efforts to bring alerts and interoperable^* communication to rural and underserved areas.

(k) Timeline for compliance. Every state must be given a reasonable amount of time to meet any new rule, regulation, or requirement created under this section.