Avoiding a repeat of Hawaii's 'wrong button' mistake
Connecting state and local government leaders
After an errant alert told millions of people a missile was headed their way, emergency notification systems are getting a thorough review.
There are probably a limited number of IT mistakes that result in an entire state population fearing for their lives, but one such error occurred on the morning of Jan. 13 when Hawaii residents awoke to a message: “BALLISTIC MISSILE THREAT INBOUND TO HAWAII. SEEK IMMEDIATE SHELTER. THIS IS NOT A DRILL.”
As eventually became clear, the alert was mistakenly sent by an employee who "pushed the wrong button" during a test of the warning system.
The message was sent out across the Integrated Public Alert and Warning System (IPAWS). The federal system allows non-federal governments down to the county level to become certified to send alerts out over a gateway Federal Emergency Management Agency manages between them and wireless careers, according to Todd Piett, president and CEO of Rave Mobile Security.
David Ige, the governor of Hawaii, said on Jan. 15 that steps were already being taken to improve the notification process.
“We created an immediate process with a pre-scripted cancellation and false alert message,” Ige said. “We imposed a two-step, two-person rule for all TV, radio and wireless activation. And we established better protocols and lines of communication across our emergency management network.”
The kind of testing the state was doing when it sent out the inaccurate alarm is important to the operation of an emergency notification system, Piett said.
“You’re not going to be sending out an Amber alert or missile alert very often,” he explained. “So the last thing you want to have happen is, when it actually is a real emergency, that people don’t know how to do it or the system fails.”
But agencies must ensure the training alerts aren’t sent through the main channel because, as the world witnessed on Saturday, chaos ensues. Avoiding this kind of human error relies heavily on good design.
Besides the weaknesses cited by the governor, the button confusion may have been enabled by a poorly designed web interface. Screenshots of the system obtained by Honolulu Civil Beat show the test option and live option are both blue text links among a number of alert links on the same page.
User interface design in emergency systems is "huge, actually critical,” according to Meg Lovell, director of implementations and customer success at Everbridge, an emergency alert vendor.
If there is something requiring the user's attention, designers must make sure it really stands out, Piett said. This means using bright colors and different fonts; it also means forcing people to scroll through notifications, rather than allowing them to simply click through without thinking.
Troy Harper, the general manager of public sector for OnSolve, said his company's alert system accomplishes this with color coded box in the header bar. It also separates the test and live environments so users must choose test or live message at the beginning, he said.
[Editor's note: None of these firms are directly involved with the Hawaii alert system. Each of the executives stressed that they were speaking only about general best practices.]
The experts also agreed that an extra verification step prior to launching a live alert is important because it slows people down and makes them look at things again. Everbridge's system automatically sends messages as a test, forcing users to manually change them to live notifications, Lovell said.
Harper said OnSolve has untrained users do blind tests of the software to ensure the design is clear and easy to follow.
The system in Hawaii had a verification box to ask if the user if sure of the action, but Piett said “confirmation fatigue” can lead people to ignore those kinds of alerts.
Agencies should also consider role-based permissions, he suggested, so more people can send out alerts for broken water mains, but only a handful can press an IPAWS alert.
After the alert was sent out in Hawaii it took 30 minutes for it to be corrected
“The biggest issue wasn’t the message going out, it was the time it took to make a retraction,” Piett said.
Federal regulations require systems have a process in place for issuing a correction. The agencies that issue the alerts should have templates for these corrections and training for how to use them, Harper said.
While the mistake in Hawaii has agencies thinking about the best way to handle emergency messaging, Wain Kellum, the CEO of OnSolve said there was a silver lining.
“It does validate how powerful these systems can be because, in Hawaii, a million people with these powerful devices in their pocket could actually get alerted and action could be taken,” he said.