CR911: NG911 Security and Resilience

Background

Several recent disruptions to 911 service started outside the 911 call path. In 2024, most ransomware incidents affecting 911 dispatch began on connected city, county or police networks. The best-documented telephony denial-of-service (TDoS) extortion campaign against public safety answering points (PSAPs) targeted their 10-digit administrative lines, and in July 2024 a faulty security-software update stopped 911 call answering in several states. CR911 therefore looks at the systems connected to a 911 center as well as the call path.

Field work

Between July 2025 and June 2026 the team visited four sites: three PSAPs, from a large urban center to a mid-size county center, and a state 911 program that runs one Emergency Services IP Network (ESInet) for 103 PSAPs. Observations that came up at more than one site:

• Parts of the system, such as the network, the ESInet, computer-aided dispatch (CAD) hosting or server management, were often run by an organization other than the 911 agency.
• One statewide network had never had a formal security assessment because its provider contract did not allow testing.
• At most sites, vendors patch, reimage or operate critical components.
• One site tested failover regularly; another had never tested it.
• At two sites, supplemental data and AI tools reached call-takers over separate internet connections, outside the ESInet.

Testing

The project’s testbed runs commercial NG911 products from several vendors, from the ESInet border to two call-taker consoles. The lab also keeps an open-source replica of the call path (Kamailio, OpenSIPS, Asterisk, FreeSWITCH and related components) so that each test can run on its own isolated copy.

Test areas

• Border control function and Session Initiation Protocol (SIP) handling
• Call flooding and TDoS
• Caller-ID spoofing and call-suspicion marking
• Location and time integrity
• Logging and signed log events
• Pushed rules and blocklists
• Vendor remote access
• Updates, patches and rollback

Tools

• Agentic penetration-testing harness that replays attacks on SIP signaling and Real-time Transport Protocol (RTP) media, based on published Common Vulnerabilities and Exposures (CVE) entries, against copies of the replica.
• Software bill of materials (SBOM) scanner that checks a product’s SBOM with four vulnerability scanners and verifies each result against the CVE and Open Source Vulnerabilities (OSV) databases.