If my guess that they use their POCSAG system is right, they have four transmitter sites licensed to 350 watts each. This is beyond inexpensive equipment, but n

If my guess that they use their POCSAG system is right, they have four transmitter sites licensed to 350 watts each. This is beyond inexpensive equipment, but not beyond what you can buy from a ham radio shop and then 'unlock', for example. But of course it's a paging system, so the goal is strong one-way coverage to small devices in buildings and such. The sirens are all outdoors and probably all have generous fixed antennas installed, so you wouldn't need nearly as much power to get a message to them. I assumed that the hackers injected their command via radio, which I still think is likely based on getting the FCC involved, but with POCSAG involved there's definitely another possibility. A lot of pager systems might have a fairly exposed way to send in messages - a phone number you can call, an email address, perhaps a poorly secured web interface. The hackers might have figured out what pager numbers the sirens respond to by listening in and then sent their message via "legitimate" means like an email-to-pager gateway.