Cybersecurity Policy Report, Inspector General Flags Cyber Deficiencies in Public Safety Communications System, (Sep 3, 2026)

By Jeff Williams

Calling the network built for the First Responder Network Authority a “strategically significant target for advanced cyberattacks,” the Commerce Department's Office of Inspector General (OIG) has released a management alert calling for "independent cybersecurity oversight" of the nationwide public safety broadband network (NPSBN) and detailing security risks caused by the shared network architecture between FirstNet and network partner AT&T, Inc.

"Strengthening federal visibility into NPSBN cybersecurity will require addressing these architecture-driven barriers, which shape the government’s ability to monitor, assess, and enforce security compliance across the network," the OIG said in the alert.

The framework Congress established for the NPSBN to be a "hybrid system" combining NPSBN components with AT&T’s commercial mobile network "directly contributes to the oversight limitations" because "key operational components reside on private commercial infrastructure," it said.

That arrangement "significantly restricts opportunities for independent testing and oversight by government entities" and the "statutory design decision inherently shapes the government’s ability to conduct independent, hands-on cybersecurity oversight of the NPSBN, even if contractual provisions were to permit such activities," the alert said.

The OIG initiated an evaluation in January of NPSBN security controls in place to detect and respond to cyber incidents, the alert said. While the OIG had planned to "perform hands-on security testing," it said it was unable to reach an agreement with AT&T to allow the "independent testing of the NPSBN on the production network or review third-party security tests."

AT&T "expressed concerns about contractual authorities and the risk that testing might pose to shared NPSBN operations given the network’s importance to first responders," the alert said.

Among other issues, the alert said that because the NPSBN architecture was "intertwined with AT&T's commercial network," FirstNet's contracting officer's representatives had "limited to no visibility into the security posture of commercial equipment that processes network data beyond select NPSBN core devices."

The OIG also said that a "lack of transparency with respect to security testing" of the NPSBN conducted by third parties for AT&T "reflects an ongoing source of oversight risk.”

The lack of visibility into “critical operational components” residing on AT&T’s commercial network means that the government cannot “[d]irectly observe how security controls operate in practice"; “[i]ndependently validate the network’s defensive posture”; or “[a]ccess detailed third-party technical evaluations,” the alert said.

To address the security concerns, the alert proposed that the Commerce Department and National Telecommunications and Information Administration should "[i]nform congressional stakeholders of the structural oversight limitations and outline potential remedies”; “[e]ngage with AT&T to pursue targeted contractual and technical mechanisms that reduce reliance on contractor-provided information”; and "[i]dentify the architectural features that limit federal oversight and develop tailored mitigation strategies."

The OIG noted that in response to a draft of its findings, "NTIA provided technical comments and comments related to the public releasability of certain statements in the draft" and that the OIG "considered these comments and revised the alert where appropriate."

A spokesperson for NTIA said in a statement today that NTIA head Arielle Roth and FirstNet "appreciate the IG’s work on this matter and are committed to ensuring first responders have access to a secure and resilient network.”

An AT&T spokesperson said today that the Commerce OIG alert did “not identify a cybersecurity incident, breach, or network security vulnerability. We welcome rigorous oversight of the FirstNet program and the accountability that comes with serving as public safety’s network partner. At the same time, oversight activities must protect sensitive security information, safeguard public safety operations, and avoid introducing risk to America's public safety network. FirstNet is built to meet the unique security, resiliency, and mission needs of public safety, which go beyond standard commercial wireless security measures. We will continue to enhance FirstNet so America’s first responders can rely on secure, resilient communications when lives are on the line.”

News: FederalLegislation DataSecurity