Planning the internet service entrance, equipment placement and protection against cut lines

What the provider controls and what the owner controls

Federal rules divide responsibility at a demarcation point. The provider owns and maintains everything up to that point, and wiring beyond it belongs to the customer or building owner.

Preparing the entrance during a renovation

• Choose the network closet first, then install a 1 to 1.25 inch conduit with a pull string from the exterior entry point to the closet, and ask the provider where its drop will land before the walls close.
• For underground service, a sealed conduit on the property from the building toward the property line lets the provider pull fiber later. Work in the sidewalk or street is performed by the provider or a contractor with the required city permits.
• Provide an outlet at the equipment location, installed by our licensed electrical partner, and a battery backup unit for the ONT or modem and router.
• Leave a service loop of fiber. Fiber has a minimum bend radius, so it is never stapled tight or buried in a wall without conduit.
• Coaxial shields and copper telephone cable must be bonded to the building grounding electrode system at the entrance with a short bonding conductor (NEC 800.100 and 820.100). This is why providers prefer an entry near the electric service. All-dielectric fiber without metal members does not require this bonding.
• Consolidate to one entry. Remove old telephone and coaxial entries and dead cable, as NYC section 800.25 requires for accessible abandoned cable, seal the openings against water and pests, and pre-run a second conduit if a second provider may be added for redundancy.

Neat installation and equipment placement

Installation crews work quickly and use the most direct route: the nearest wall, coaxial cable stapled across the facade, or an ONT mounted behind the boiler. Having the conduit, outlet and mounting location ready before the installation appointment is the most effective way to obtain a neat result in a conditioned space near the network closet.

Once service is inside, the router can move anywhere on a Cat6 run, and unused splitters and amplifiers on old coaxial lines are removed because each one adds a point of failure. In co-ops and condominiums, the service entry and risers belong to the building, so the board's approval and building rules come first.

Power outages and battery backup

Internet service stops when the power goes out unless the equipment has backup. Verizon's PowerReserve accessory holds 12 D-cell batteries and powers Fios home phone service for up to 24 hours, but it does not power Fios Internet, Fios TV, security systems or cordless phones. Ask your provider which backup options it offers for your equipment.

For internet that stays up in an outage, place the ONT or modem, router, PoE switch and camera recorder on one UPS sized for the combined load. A UPS on the router without the ONT, or the reverse, leaves the home offline. For longer outages, the same equipment can be connected to a home battery or a Tesla Powershare backup system.

Routing the entrance high

A common suggestion is to bring the service in high, through the attic or at the roof line, so that a burglar cannot easily cut it at a ground-level box. There is some basis for this. Burglars cutting telephone and alarm lines has been documented, and an exposed box at ground level is easy to reach. Many aerial drops in Queens, Brooklyn, Staten Island and Long Island already attach high on the house, and the exposed section is often the vertical run down the facade to a low box, which can be avoided by bringing the cable inside at the attachment height.

The protection is limited. The line can still be cut at the pole, along the aerial span or at a curb box, all outside the owner's control. Burglars increasingly use Wi-Fi and cellular jammers instead of cutting cable, and a high entry does nothing against that. The provider decides how its drop is attached; an owner can request an attic entry and provide a pathway but cannot require it. Roof penetrations raise waterproofing and roof warranty concerns, attic routes must maintain fire separation, homes with underground service enter at the foundation, and in multifamily buildings the service lands in the basement telecom room, which is better protected with a lock, a door contact and a camera.

A high entrance is a reasonable extra when you are renovating anyway and the provider agrees, but it is not a security measure on its own. A cellular backup path, local recording and offline alerts do the real work.

Protection that keeps working when a line is cut

• Dual-path alarm communication: the alarm panel reports over both cellular (LTE or LTE-M) and the internet, so a cut cable becomes an alarm event rather than a blind spot. Cellular backup detects the cut; it does not prevent it. Ask the monitoring company for a short supervision interval and a communication-failure alert to your phone.
• Local recording: cameras record to a network video recorder kept indoors, hidden or locked, and on battery backup. Cloud-only cameras stop recording when the line is cut.
• Hard-wired PoE cameras, which wireless jammers cannot disable. Police in New Jersey and Los Angeles have recommended hard-wiring after jammer burglaries. Operating or selling a jammer is illegal under federal law, but it still occurs.
• A local siren and motion lighting that do not depend on the internet.
• Offline and tamper alerts: camera and alarm apps that report a device offline, and a router with 5G or LTE failover so notifications continue. A camera covering the service entrance and the electric meter records any tampering.
• Physical measures within your control: your own wiring in conduit from the demarcation point inward, a lockable or tamper-resistant enclosure for your equipment, and battery backup, since cutting power is the other common tactic. The provider's box is not locked or modified without the provider's approval.

Older alarm communicators built for 2G or 3G networks no longer work since those networks were shut down in the United States, so confirm that the communicator uses LTE or LTE-M. Intrusion alarm installation and monitoring in New York State are services of a licensed alarm company under General Business Law Article 6-D, and we coordinate the cabling, power and network side with that company.

Service entrance checklist

Before a provider installation or during a renovation, we lay out the entrance pathway, network closet, battery backup and a camera and alarm arrangement that continues to report when a line is cut. We work on the customer side of the demarcation point, and changes to the provider's own drop and equipment are requested from the provider.