7 ms·
Hawaii’s false missile alert sent by worker believing attack on US was imminent
- jandrese 9y agoWait, so all of the hand wringing over the crappy UI was pointless because it was actually a case of miscommunication?
- blueish 9y agoI wouldn't call it hand wringing, as I think all the points were valid, but yes, the employee sent out the message he intended to (the real alert over the test alert).
- krapp 9y agoNo, according to the end of the posted article, poor UI and a lack of necessary safeguards were part of the problem, just not the entire problem.
- rhino369 9y agoI don't really understand how it is part of the problem. If the worker really believed an attack was incoming, confirmation screens wouldn't help at all.
- bearcobra 9y agoI guess it would depend on how that confirmation screen worked. If the design asked for a confirmation from a second user, then a single user's confusion wouldn't have resulted in the error.
- jeddawson 9y agoNot only that, but once they realized the message was sent in error they didn't have a simple way to correct course so there was a big delay between the realization and informing the terrified public. Your suggestion of having multiple user confirmations coupled with a simple way to "cancel and correct" the notice would have likely meant this never became news worthy.
- paulddraper 9y agoSure, but that's a lot different from "move these buttons around and have the user double click to be sure."
- jsjohnst 9y agoThe extra confirmation shouldn’t have been on the same user. The “two man rule” exists for emergency protocols for a reason.
- krapp 9y agoConfirmation screens might have given the operator a moment's pause to consider whether or not they were certain. A UI that makes it easy to make a mistake, even when the mistake is intended, and makes it almost impossible to correct that mistake, is a badly designed UI.
- dragonwriter 9y ago> Confirmation screens might have given the operator a moment's pause to consider whether or not they were certain. There was a confirmation screen. I have seen no suggestion how a different confirmation than actually existed would have helped, and I don't think we want to introduce more delay in the critical path of a live alert without clear and massive benefit. > A UI that makes it easy to make a mistake, even when the mistake is intended, and makes it almost impossible to correct that mistake, is a badly designed UI. The problem with correcting the mistake is not a UI problem, but a deeper planning and procedure problem.
- krapp 9y ago> and I don't think we want to introduce more delay in the critical path of a live alert without clear and massive benefit. If that delay reduces false alarms, when false alarms erode public trust in and concern about the alert system, then the massive benefit is clear. With such a system, drills and tests are going to be massively more common than actual events. Designing the UI so that the one-in-a-million option is as easy to invoke as the once-every-week option is a UI problem. Notwithstanding it not being a primary issue in this particular case, I believe it's still an issue worth discussing. Also, bear in mind that correcting the "deeper planning and procedural problems" would introduce delays as well. Anything but a purely automated system, or a big red button would introduce some delay.
- dragonwriter 9y ago> Also, bear in mind that correcting the "deeper planning and procedural problems" would introduce delays as well No, it wouldn't, because those are problems that impact after an alert is issued, and whose existence caused delays in sending an all-clear. Resolving them won't effect the path prior to an alert, and would eliminate rather than introduce delays.
- lsaferite 9y agoHow would a UI change have made the outcome different if the employee actually wanted to send a real alert?
- hinkley 9y agoWhen you're doing a post-mortem you're supposed to think about how to prevent the next one, not how to prevent the one that already happened (someone needs to tell the State Dept this). So you look at all of the contributing factors and you come up with a plan for all the ones you can reasonably address. It's been identified that a reasonable person could accidentally send a real alert even when they intended to send a fake one. So you fix that too because why the hell would you leave it once you've found it? Or to put it another way, they're already in the middle of a PR disaster. You get a second one if the press gets wind of the idea that you're cutting stupid simple corners on the remediation. And make no mistake: Fixing a UI issue with the benefit of hindsight is a stupid simple fix (avoiding it to begin with is much harder).
- Johnny555 9y agoThis is a solved problem -- the UI could require confirmation from a second employee.
- askvictor 9y agoYou have minutes before the missiles hit. Waiting around for Steve to get back from the toilet could cost a lot of lives.
- Johnny555 9y agoLike I said, the 2-man rule is a solved problem. https://en.wikipedia.org/wiki/Two-man_rule https://en.wikipedia.org/wiki/Two-man_rule What does Bob do when he goes to the toilet? He asks Steve to cover him. So if you need 2 people to send an alert, when Bob is at the console, and Steve is secondary, when Steve has to go to the toilet, he asks Jill to cover him. Alternatively a backup authorization method could be used. It does mean having 3 people available at all times, but since there are life-safety implications of real alerts as well as false alerts, it seems like a reasonable safeguard to have.
- nkoren 9y agoActually, it's even more crappy UI, just not in the visual domain. Including the phrase "this is not a drill" in something that actually is a drill could be considered a design flaw in the auditory user interface.
- ollerac 9y agoPedants, all of you.
- Cyberdog 9y agoHello. Welcome to Hacker News. Enjoy your visit!
- deleted 9y ago[deleted]
- Cyberdog 9y agoWas that addressed to me? I certainly wasn't attempting to diss the community at large. Yes, sometimes the pedantry and "um actually" nature of this place bugs me, but that's just what happens in gatherings of nerds.
- dang 9y agoOK, I overinterpreted you and will delete my comment. Sorry! (It was still an unsubstantive post though... please don't post those, even when someone else is setting a bad example.)
- deleted 9y ago[deleted]
- dang 9y agoI know how annoying it can be to run across internet comments that seem insufferably pedantic. But would you please not post unsubstantive comments to Hacker News? As much of a problem as pedantry is, empty, name-calling comments are much worse. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
- jeddawson 9y agoSure sounds like it! What is confusing is that the article still points to the UI as being a part of the problem though while they're now saying the employee intentionally sent the live message. Looks like the PR campaign is still trying to deflect blame or perhaps keep things just ambiguous enough that they'll be able to rush through some extra spending to "fix" the UI issue. Hopefully more details will continue being shared and they deal with the organizational flaws instead of pouring blame on scape goats (software and individuals).
- rossdavidh 9y agoOr, there were a bunch of potential land-mines set in this process, and eventually the employee stepped on one. Which one he stepped on is maybe less interesting to me, than the fact of the organizational culture producing multiple ones to step on.
- turc1656 9y agoYup. I called bullshit on the story we were being fed at the time (https://news.ycombinator.com/item?id=16161584 https://news.ycombinator.com/item?id=16161584) and said it seemed obvious when you think about it that they really believed they were under attack, and I'm glad to see the truth finally come out. The bad UI argument could still be valid, but it definitely was not the cause of this.
- MicroBerto 9y agoSame here, and I was called a reptilian flat eaether or something to that effect. I'll never be shamed out of questioning clear nonsense.
- davesque 9y agoWell, we've seen the UI and it is crappy and it's not hard imagine someone making a mistake that way. But yeah you're kinda right. They should still fix the UI though :/.
- emodendroket 9y agoYou can't blame people for making inferences based on the news that was reported.
- make3 9y agoI mean, I fully suspect that both suck
- MicroBerto 9y agoNo. They are getting tripped up in their numerous lies. Last time this happened, the story simply disappeared from the media altogether. Expect that to happen here too.
- everdev 9y ago> Following standard procedures, the night-shift supervisor posing as Pacific Command played a recorded message to the emergency workers warning them of the fake threat. The message included the phrase “Exercise, exercise, exercise.” But the message inaccurately included the phrase “This is not a drill.” This is just a test. This is not a test.
- Animats 9y agoEspecially since this was in Hawaii. The first message from Pearl Harbor to the fleet during the attack in 1941 was, famously, “AIRRAID ON PEARL HARBOR X THIS IS NO DRILL.”
- acqq 9y ago“The day shift warning officers received this recorded message on speakerphone. While other warning officers understood that this was a drill, the warning officer at the alert origination terminal claimed to believe that this was a real emergency” https://www.npr.org/sections/thetwo-way/2018/01/30/581853255/hawaii-missile-drill-stated-this-is-not-a-drill-resulting-in-false-alert https://www.npr.org/sections/thetwo-way/2018/01/30/581853255... Speakerphone. That can also mean it’s automatically on. So you do something else, hear something narrated as the message and the last thing that stays in your head is clear “this is not a drill.” And you probably didn’t have to answer the call and talk to the real person. You’ve just heard “this is not a drill.” So you act as you’re trained to do.
- throw7 9y agoIt makes me wonder what the message is for a real emergency. Also, the article mentions the day-shift supervisor thought the test was for the leaving night-shift operators, so he wasn't there to presumably tell his day-shift that there would be a test... but I think that this is not good for them to be warned ahead of time. You want them to be prepared to execute properly either way.
- everdev 9y agoIt's the same message the officer heard, just without "Exercise. Exercise. Exercise." at the start. Bad UI.
- colemannugent 9y agoSo who was fired for this? Someone dropped the ball by not communicating the fact that this was a test to the employee who sent the false alarm. That person should be fired. This reads like a classic tale of government incompetence. If you don't fire people in a situation like this, why should we expect anything to change?
- JumpCrisscross 9y agoWhen it comes to ballistic missile warnings, I’d rather err towards false positives over false negatives. Whomever made this mistake is highly unlikely to do so again. Throwing that away seems wasteful, ceteris paribus.
- rlanday 9y agoFalse positives and false negatives are both really bad. Now if there’s an ICBM launched at Hawaii this weekend, no one will believe it.
- JumpCrisscross 9y ago> False positives and false negatives are both really bad Everything surrounding nuclear war is bad. Choosing the lesser of two evils is the best we can do, given the domain. > Now if there’s an ICBM launched at Hawaii this weekend, no one will believe it No one? My collection from friends in Hawaii is they’re more prepared. Each of them have at least contemplated a plan and a few assembled go bags. In any case, Japan and Korea’s experiences with false alarms don’t support your claim that a few false negatives outweigh a single false negative. To be clear, I’m not saying false positives are okay. No error is better than error. But if we’re going to have errors, and we are, one kind is better than the other.
- abstractbeliefs 9y ago> go bags where are they planning to go? It's a common mistake to make up "go bags" but forget they're only supposed to last you the 24 hours that it takes to get to a new refuge should your home/wherever else you're in become unsafe. I'm not sure how that works on Hawai'i after a nuclear missile attack, so I'd love to know what the plan is for such an event for these individuals.
- ARussell 9y agoI'm not saying the UI of their system is great, since I have never seen it, but I believe it's a better idea to have the "test" alert be very similar to the real one. When the time comes to send a real alert, the operators should be practiced. Diverging the UI could cause confusion in am actual emergency, wasting precious moments.
- deleted 9y ago[deleted]
- dragonwriter 9y agoI think the most critical problem this revealed is not in the chain of events leading to the false alert (which contains several real problems), but that the State of Hawaii apparently has no clear process for sending an all clear and informing the public of the resolution after a live alert.
- moftz 9y agoThey probably figured there wasn't going to be a State of Hawaii after a real nuclear missile so why bother with an all clear?
- dragonwriter 9y agoReal missiles can miss, malfunction (the missile), be intercepted, not have a nuclear warhead in the first place, experience a warhead malfunction, and—even if they hit somewhere in the area of Hawaii and detonate a nuclear warhead—leave much of the state intact (Hawaii is, after all, about half as far across, east to west, as the continental US.) The very last may not produce an all-clear in the short term, but it's likely to at least require lifting the “missile is likely to hit in our area soon” alert in favor of a very different emergency posture, which is a similar need.
- sean2 9y agoFirstly, why would you give an alert if everyone is going to die and there's nothing anyone can do? The reason for the alert is that most people (~98%) will be outside the fatal blast of a N. Korean Nuke assuming that it even hits it's target, which I'm not sure the likelihood of anyway. You need the all clear for the surviving 98% (or 100% of people on a miss or false alarm) who will be continuing to get things together after the attack. If the US is going to exchange nukes with China or Russia, they could decide to wipe out Hawai'i. But N. Korea has like, what 5-6 nukes? They're not known to be accurate either. Except for Honolulu Hawai'i is mostly composed of small population centers separated by miles of ocean or valley walls. If N. Korea decided that Hawai'i really had to go, I'd guess they could use their arsenal to kill/injure max: 6 missiles * 20k casualties = 100k casualties total, which would still leave 1.1million people to hear an all clear.
- idlewords 9y agoEverybody who publicly excoriated the UI (or what they thought was the UI) of the Hawaii public alert system here should think about their role in spreading misinformation. This story was catnip to computer people, and too few people waited for any kind of confirmation before deciding they knew all about what happened, and how to fix it.
- giarc 9y agoIt still is bad UI, that hasn't changed. So people didn't spread misinformation. Sure, the employee clicked the wrong button because of this audio alert, but the buttons/text are still poorly designed.
- idlewords 9y agoThere's no way to tell if it's bad UI given the publicly available information. We'd need to see the whole flow (including confirmation steps), as well as know something about how the employees were trained on this interface.
- giarc 9y agoThat's UX, not UI. The user interface is bad. The bad labelling/naming of the links makes it more likely to click the wrong button. That is bad UI. Bad UX would be the situation if even after that, there is no double check or alert to confirm that users intention.
- mrtksn 9y agoI wouldn't call spreading misinformation because that was the official statement. It just turned out that the official statement was incorrect. Besides, memes were brilliant :)
- idlewords 9y agoWhich official statement are you referring to? This is the only one I can find: https://dod.hawaii.gov/hiema/files/2018/01/20180113-NR-HI-EMA-statement-on-missile-launch-false-alarm.pdf https://dod.hawaii.gov/hiema/files/2018/01/20180113-NR-HI-EM... Everything else seems to stem from the initial Washington Post article.
- perseusprime11 9y agoAfter a few more days, we will hear that it was not the worker who sent the alert, and after some more days, we will hear that nobody sent the alert and that it was a bug. Just kidding. News such as these have to wait till the investigation is complete, otherwise we will simply be reading speculation.
- rdtsc 9y agoWhy does the state of Hawaii even need a man in the middle for issuing ICBM alerts. It would seem the military or at least something centralized at the federal level should be able to trigger this alert. Basically have it patched through directly. I can't see a benefit of an extra person in the loop. It could at best delay sending the alert, send the wrong alert. At worst is obviously missing sending the alert altogether. One might say, well one benefit is the state could prevent a bogus alert from being sent. But does the State of Hawaii have its own independent monitoring network of satellites or radar? I am guessing it doesn't.
- Psilidae 9y agoI can see value in having someone capable of issuing alerts who is geographically _on_ Hawaii, as the potential for dropped communication lines seems problematic. I don't know enough about military/federal operations to know whether having them handle it would imply keeping operations on the islands, or if they'd literally "centralize" it to somewhere on the continental US.
- dkresge 9y agoSo, more fundamental than UX, that the proper employee action for an “exercise” differs from that for a real threat doesn’t seem to be a proper test. Why not just have an administrative airgap keyswitch that enables exercises to be conducted without the requirement to disseminate the fact beforehand? Then you can test for the proper response without risk.