Review of Security Vulnerabilities and Authentication Mechanisms in Cellular Public Warning Systems: Spoofing, Alert Suppression, and Verification Approaches

Abstract

Cellular public warning systems provide a mechanism for disseminating urgent alerts to mobile devices within geographically defined areas. Their effectiveness depends not only on timely message delivery but also on the authenticity, availability, and interpretability of warnings received by the public. Security research has demonstrated that cellular warning mechanisms can be exposed to message spoofing, unauthorized alert injection, and alert suppression, creating risks of false public instructions and missed legitimate warnings. This critical narrative review examines the security properties of cellular public warning systems, with particular attention to LTE and 5G environments, the relationship between broadcast signaling and warning authentication, and the feasibility of proposed verification mechanisms. We draw on experimental security research, cellular standards, and studies of public warning communication. We distinguish authentication of warning content from authentication of the cellular signaling environment and examine the limits of approaches that require network changes, device modifications, or observations from several cells. A seven-dimensional threat-to-control framework is proposed covering adversarial capability, entry point, attack mechanism, affected security property, verification mechanism, deployment dependency, and residual risk. The review finds that neither authenticated network signaling nor improved warning-message design independently resolves the full range of spoofing and suppression threats. Effective protection requires attention to message provenance, network trust boundaries, warning availability, operational deployment constraints, and the ability of recipients to interpret alerts correctly. Further research is needed to evaluate defenses under realistic deployment conditions, particularly where legitimate warning delivery must remain reliable during emergencies.