THIS RADIO HACKER COULD HIJACK CITYWIDE EMERGENCY SIRENS TO PLAY ANY SOUND

At exactly noon on the first Tuesday after Balint Seeber moved from Silicon Valley to San Francisco in late 2015, the Australian radio hacker and security researcher was surprised to discover a phenomenon already known to practically every other resident of the city: a brief, piercing wail that rose and then fell, followed by a man's voice: "This is a test. This is a test of the outdoor warning system. This is only a test."

The next week, at exactly the same time, Seeber heard it again. A few weeks after that, Seeber found himself staring up from his bicycle at a utility pole in the city's SoMa neighborhood, examining one of the more than 100 sirens that produced that inescapable emergency test message around the city. At the top, he noticed a vertical antenna; it seemed to be receiving signals via radio, not wires. The thought came to him: Could a hacker like him hijack that command system to trigger all the sirens around the whole city at will, or to use them to broadcast even more alarming sounds?

Spoofable SirensNow, after two-and-a-half years of patiently recording and reverse-engineering those weekly radio communications, Seeber has indeed found that he or anyone with a laptop and a $35 radio could not only trigger those sirens, as unknown hackers did in Dallas last year. They could also make them play any audio they choose: false warnings of incoming tsunamis or missile strikes, dangerous or mass-panic-inducing instructions, 3 am serenades of death metal or Tony Bennett. And he has found the same hackable siren systems not only in San Francisco but in two other cities, as well as hints they may be installed in many more. "If you wanted to send out your own music or your own alert, you could broadcast it across entire cities," Seeber says. "You could do it with something as cheap and easy as a handheld radio you can buy from Amazon."

On Tuesday, security firm Bastille, where Seeber works as director of vulnerability research, went public with his discovery that the emergency siren equipment sold by Boston-based ATI Systems in all three cities Bastille tested lacked the basic encryption necessary to prevent any prankster or saboteur from commandeering the system. In San Francisco, Wichita, Kansas, and another city that Bastille declined to name, Seeber was able to read and fully reproduce the transmissions to those siren systems. By bouncing that signal through a repeater near the center of each city's network, Seeber believes he could have gained control over the citywide collection of sirens, each one capable of pumping out as much as 135 decibels, according to Bastille's estimates, more than the noise of four jackhammers combined.