Alert About Missile Bound for Hawaii Was Sent in Error, Officials Say

Just watched an interview on CNN with the Governor of Hawaii and their director of emergency management. Pretty impressed that the director didn't throw anybody under the bus. He basically said "An employee pushed the wrong button. It's my responsibility, so this is my fault. We're going to make procedure and technical changes to make sure this doesn't happen again."

This kind of accident has happened many times in the history of the Emergency Alert System (EAS)[1] and the earlier Emergency Broadcast System (EBS). The false alarm of 1971[2] actually revealed a major flaw in the EBS. During the incident, a legitimate national alert initiation message was erroneously broadcast instead of the scheduled test message. Many stations did not propagate the message as required because of confusion caused by receiving it within the time window of a scheduled test. Interestingly, this revealed a major flaw in the system in the event of a real emergency: that an adversary could time its attack with a test broadcast of the EBS, rendering the system generally ineffective.<p>[1] <a href="https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Emergency_Alert_System#Incidents" rel="nofollow">https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Emergency_Alert_System#Inciden...</a><p>[2] <a href="https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Emergency_Broadcast_System#False_alarm_of_1971" rel="nofollow">https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Emergency_Broadcast_System#Fal...</a>

If I were going to erode public trust in emergency broadcast systems in order to increase the amount of damage I would do by launching an actual missile, this is how I would do it. A series of false alarms.<p>A similar, if obviously much smaller and less disastrous example, happens at my apartment about 4 times a week: the fire alarms for entire floors of my apartment building are easily triggered by people smoking in the breeze ways or burning their dinner. The result is that I routinely ignore fire alarms because the likelihood of a real fire is has been demonstrated to be exceedingly small.

An interesting Reddit comment described a chaotic traffic situation for 20 minutes (people running lights, wrong-side-of-the-road driving, extreme speed, etc.). Human nature in these moments is very “Tragedy of the Commons” apparently.

I woke up to this this morning on the island of Oahu. People running around on the street freaking out and police &#x2F; fire engine sirens going off.<p>Everyone cheered when the “False alarm” SMS came through across the phones.<p>Secure your networks people - this electronic psyops stuff is real.

A lot of comments making fun of the &quot;duck and cover&quot; advice, but consider this: Many people suffered serious injury from the Chelyabinsk meteor when they went to a window to see the spectacle, not realizing the shock wave would follow a few seconds later and shatter the windows into their faces.<p>If they had gotten away from the windows and ducked and covered, they would have been fine.

So it took 38 minutes to send out a new message informing this was a false alert. How is that possible if this was simply a human error during a &quot;shift change&quot;?<p>You&#x27;d think the people who &quot;pressed the wrong button&quot; would be able to press the same button again?

So a test drill went wrong.<p>It makes sense to have drills right now, India (tests with war against China and Pakistan), China (Telling their soldiers to be prepared to die for China), Russia(tests against Nato), and North Korea (getting ready for war with the US) are all having military tests for basically what will quickly become another world war.<p>We are really at a big crossroads as a large amount of people are rejecting globalization in many different countries. And with such major powers willing to fight hard for resources like Ukraine, South China Sea, Oil Eu pipelines, and not even mentioning the increasing gulf between various countries on core ideologies and creeds.<p>We really are at a new and dangerous crossroads.

&quot;Amid public outcry over the incident, the Hawaiian government also released a timeline of what transpired after the false alarm:<p>Approx. 8:05 a.m. – A routine internal test during a shift change was initiated. This was a test that involved the Emergency Alert System, the Wireless Emergency Alert, but no warning sirens.<p>8:07 a.m. – A warning test was triggered statewide by the State Warning Point, HI-EMA.<p>8:10 a.m. – State Adjutant Maj. Gen. Joe Logan, validated with the U.S. Pacific Command that there was no missile launch. Honolulu Police Department notified of the false alarm by HI-EMA.<p>8:13 a.m. – State Warning Point issues a cancellation of the Civil Danger Warning Message. This would have prevented the initial alert from being rebroadcast to phones that may not have received it yet. For instance, if a phone was not on at 8:07 a.m., if someone was out of range and has since came into cell coverage (Hikers, Mariners, etc.) and&#x2F;or people getting off a plane.<p>8:20 a.m. – HI-EMA issues public notification of cancellation via their Facebook and Twitter accounts.<p>8:24 a.m. – Governor Ige retweets HI-EMA’s cancellation notice.<p>8:30 a.m. – Governor posts cancellation notification to his Facebook page.<p>8:45 a.m. – After getting authorization from FEMA Integral Public Alert and Warning System, HIEMA issued a “Civil Emergency Message” remotely. The following action was executed by the Emergency Alert System (EAS): 1. EAS message over Local TV&#x2F;Radio Audio Broadcast &amp; Television Crawler Banner. “False Alarm. There is no missile threat to Hawaii.” “False Alarm. There is no missile threat or danger to the State of Hawaii. Repeat. There is no missile threat or danger to the State of Hawaii. False Alarm.” 2. Wireless Emergency Alert (WEA) “False Alarm. There is no missile threat or danger to the State of Hawaii.”<p>9:30 a.m. – Governor makes initial media notification.<p>9:34 a.m. – Governor’s message posted to his Facebook and Twitter accounts.&quot;<p><a href="http:&#x2F;&#x2F;www.washingtonexaminer.com&#x2F;hawaii-releases-timeline-of-what-transpired-after-false-ballistic-missile-warning&#x2F;article&#x2F;2645874" rel="nofollow">http:&#x2F;&#x2F;www.washingtonexaminer.com&#x2F;hawaii-releases-timeline-o...</a>

I&#x27;m surprised the discussion here hasn&#x27;t veered toward what actually happened. Technical glitch&#x2F;human error? Hacked emergency alert system? Missile actually was on the way, but being a cheap North Korean one, it fell into the ocean on the way?<p>There are lots of potential explanations...whatever happened, there is stuff to work on in the aftermath of this. Barring the idea that it was an actual missile that failed to hit its target, if these alert systems are vulnerable, that&#x27;s a bad thing. This could have caused serious chaos in a large city like New York. Techniques like this could be used to cause gridlock before a terrorist attack, suppress voter turnout on election days, etc.

Human error or crying wolf aside, it&#x27;s an interesting exercise from which residents can learn what is truly lacking in the case of such an emergency.<p>Hopefully instead of seeking to cast blame or personnel firings, etc., folks will learn what it is they lack in emergency response.

Well, it will be interesting if any researchers look into people&#x27;s actual behavior within the first few minutes of the notification before the &#x27;false alarm, never mind&#x27; message went out to see how effective this was as an emergency alert, even if unplanned.

Not a terrible thing to have happened, tbh<p>Now we get to see &amp; analyze the &quot;real life&quot; reaction to this dress rehearsal. I&#x27;m sure everyone knew without this that a real alert would be full of SNAFUs, but you don&#x27;t usually get a chance to see what they would really be if everyone actually believed the alert was real.<p>Hopefully (and I think they will ) they&#x27;ll be smart enough to use this rare opportunity.

So I posted something along these lines in another, now-duped thread... but I know that many folks were caught completely off guard and started wondering what they would have done in case of a real threat. Many just cracked Twitter jokes about dying in a blaze of glory.<p>For folks who want to understand the actual dangers and survivability of an ICBM strike, I strongly suggest a book from the 1960s written by one of the folks involved in the US nuclear program during the Cold War:<p><a href="http:&#x2F;&#x2F;www.madisoncountyema.com&#x2F;nwss.pdf" rel="nofollow">http:&#x2F;&#x2F;www.madisoncountyema.com&#x2F;nwss.pdf</a><p>It cuts through many of the Hollywood-perpetuated myths - the certain and painful death in case of a nuclear strike, or the 10,000-year radioactive wasteland that&#x27;s going to be left behind.<p>For example, it discusses why the oft-ridiculed duck-and-cover strategy is actually surprisingly effective. The primary threat from an air burst is very conventional - a shockwave and an intense burst of thermal radiation. Shelter - any shelter - greatly improves your survival odds.<p>The fallout from air bursts is comparatively modest (i.e., tends to be far lower than from an event such as Chernobyl) and while lethal, it decays very rapidly - dropping to reasonably safe levels in a matter of days, not centuries. Staying sheltered for 2-10 days greatly improves your odds, and the thickness of material between you and any surfaces that gather dust (roofs, ground) matters more than anything else. Here&#x27;s a handy chart:<p><a href="http:&#x2F;&#x2F;static3.businessinsider.com&#x2F;image&#x2F;58cc34b9112f7043268b4bb4-1151" rel="nofollow">http:&#x2F;&#x2F;static3.businessinsider.com&#x2F;image&#x2F;58cc34b9112f7043268...</a><p>In other words, having enough food and water in your home to weather out a nasty stowstorm also makes you well-prepared for the nuclear apocalypse. Mattresses and bulky furniture provide decent shielding when all other options fail.<p>The long-term effect of fallout tend to be exaggerated, too; water from streams, deep lakes, or wells should be safe or get safe very quickly. Removing a layer of topsoil allows relatively safe crops to be grown. Mild radiation sickness, at the levels where people start experiencing vomiting and hair loss, is actually pretty survivable and has a relatively modest impact on your odds of developing cancer later in life.<p>(Plus, keep in mind that more than 2,000 nuclear tests have been conducted so far, including around 900 in Nevada alone; while they had some statistically observable negative effects, they have not turned the world into a nuclear wasteland.)<p>Of course, don&#x27;t get me wrong - even a single nuclear strike would be awful, and a large-scale confrontation would mean untold damages and loss of life. But the important point is that a lot of people would survive and would be able to do well in the aftermath - more so if we teach them about some common-sense preparedness steps.<p>The main reason why our understanding of the nuclear risk is so lopsided is because for decades, many nuclear disarmament activists (including many prominent screenwriters, celebrities, and pundits) had a vested interested in portraying the already-awful outcomes of a potential nuclear war as far less survivable and far more hopeless than in reality; the mockery of duck-and-cover, the &quot;barren wasteland&quot; imagery in the movies, and the largely-discredited scientific theories like the &quot;nuclear winter&quot;... all helped to advance (otherwise noble) goals, but at the expense of teaching people that there&#x27;s nothing they can do save themselves.<p>Plus, of course, after Cold War, we have fewer reasons to worry. It&#x27;s hard to top the Cuban Missile Crisis. There&#x27;s plenty of politicized hyperbole around nuclear tensions right now, but the reality is that a large-scale strike on the US is a lot less likely than throughout a good part of the 20th century.<p>PS. I have a short summary of NWSS and some other points about this topic (and other, more mundane but plausible hazards) in my &quot;Doomsday Prepping for Less Crazy Folk&quot; - <a href="http:&#x2F;&#x2F;lcamtuf.coredump.cx&#x2F;prep&#x2F;" rel="nofollow">http:&#x2F;&#x2F;lcamtuf.coredump.cx&#x2F;prep&#x2F;</a>

This should not happen, yet time after time we see that critical American infrastructure and systems are run worse than a pre-revenue bay area chat startup. American infrastructure needs to invest and hire&#x2F;pay for the same quality that bay area startups do. Let four people go that are inept and less qualified and pay a single solid person market salary.<p>Besides the fear and chaos potentially caused to people in Hawaii there are financial implications if the stock market were open.

I’m in Hawaii and received it this morning. First thought: there is probably no shelter close by anyway, and if they would send a missile they would probably target Honolulu (I’m in Kauai).

I&#x27;ve read that it was a human error when someone pushed the wrong button. I feel bad for that person.

Any reason why it would take 30+ minutes to rectify the mistake?

Hopefully, THAAD and Aegis work in real life as they have practice. I guess the other comfort is that North Korea is likely a one-trick pony with a nuclear device (if they _have_ managed to miniaturize it). What is scarier is the anthrax antibodies found in the North Korean defector :&#x2F;<p>I&#x27;m hoping the withdrawal of exercises of the USA and peace talks actually get us somewhere, but we&#x27;ve been to the table 100 times, I don&#x27;t see much changing.

Pro tip: if you are conducting a drill, refrain from using the words &quot;THIS IS NOT A DRILL&quot;.

Serious question: where would one seek shelter if that notification were true?

I actually wonder why this warning can be send in the first place. As this unwanted &quot;test&quot; has shown, people have absolutely no idea what to&#x2F;where to go in that situation. Instead there was a lot of panic. If there is the possibility that you will send out such a message it would be a good idea to give some advice on what to do.

<a href="https:&#x2F;&#x2F;www.nytimes.com&#x2F;2017&#x2F;04&#x2F;08&#x2F;us&#x2F;dallas-emergency-sirens-hacking.html" rel="nofollow">https:&#x2F;&#x2F;www.nytimes.com&#x2F;2017&#x2F;04&#x2F;08&#x2F;us&#x2F;dallas-emergency-siren...</a>

There you again: it is useful to have a testing environment.<p><a href="https:&#x2F;&#x2F;nwschat.weather.gov&#x2F;p.php?pid=201801131825-PHFO-NOHW40-PNSHFO" rel="nofollow">https:&#x2F;&#x2F;nwschat.weather.gov&#x2F;p.php?pid=201801131825-PHFO-NOHW...</a>

So either this was a security breach, a human mistake or a psyops&#x2F;test on a small isolated American population.<p>In the first case, we&#x27;ll probably only be told about it if they actually make an arrest and the system is patched.<p>The second is an interesting case, we&#x27;ll come back to.<p>The final one: it was intentional and used to track what happened on the islands, and to also watch that information propagate back to the mainland. I feel like all of America has forgotten about PRISM&#x2F;the NSA. With their immense data collection architectures and ties to large tech companies, they could easily filter the keywords and images they want, and get measurements of how quickly this information propagates and how people react.<p>Even more freaky, they can use language processing to even get numbers about what people might be feeling! I think we&#x27;ve all forgotten about this and it should be a chilling affect.<p>In the final case, we will, of course, never know. Anyone who suggests it will be called a conspiracy theorist (even though there is evidence the US government has preformed operations like this in the past, e.g. COINTELPRO) and the official line will be either reason 1 or 2 .. possibly with a patsy to arrest if need be. The truth will be declassified in 30~40 years so some people will be able to say &quot;I told you so,&quot; but long beyond the time period anyone will actually care.

Serious question: for those of you reading this, how would you have responded in those 30 minutes?

Every public warning system processes will be under scrutiny Monday morning. I wonder what the military was thinking when they saw that message, like &quot;what dumbass sent this out&quot;?

Why was ‘test’ button even attempted only to worker ‘hitting’ wrong button, it’s not the 1st of the month ( usual test day for alert siren test)?

I was just thinking they are testing the network on one of the smallest areas in the US. You know with NK threatening to press the button

damn man.. we have a more robust process in place for releasing our CRUD web app than they have to triggering a nuclear alert. That entire vertical branch of gov agency needs a heavy dose of slap in the face

A number of folks have asked if anyone knows more details on how a false alert could have been issued. I had some exposure to conversations about these alerts a few years ago, so a few thoughts. This isn&#x27;t based on extensive experience, but provides a bit more background than you&#x27;ll get from the news stories I&#x27;ve seen, and if you&#x27;re burning with curiosity this should give you some jumping off points to research it further.<p>Although FEMA is actively developing more robust controls for their IPAWS system, the controls on user behavior and what functions can be triggered in the system have limited capabilities to enforce restrictions (one would be the requirement for a digital signature to accept a CAP message as valid). If you listen to the press conference [2] Hawaii says they will now be using a &#x27;two person rule&#x27; which indicates that the most significant controls they have are manual&#x2F;behavioral (not automated in the system by user roles or automated workflows based on state policies). Few information systems do much more than have a few coarsely-permissioned user roles, though, so it&#x27;s not like FEMA or Hawaii has tried to cheap out on the functionality - it&#x27;s just not a very common capability and emergency alerts isn&#x27;t a mission where you want to be using &#x27;interesting new tools&#x27; that aren&#x27;t well tested.<p>There are several alerting systems - the Emergency Alert System (EAS), the Wireless Alert System (WEA), and Non-Weather Emergency Alerts (NWEM). States use FEMA&#x27;s IPAWS system for sending alerts, which [1] this one seems to have been sent through (localities don&#x27;t necessarily participate in IPAWS, which is voluntary, but the Hawaii EMA was the one that sent this). Some questions I would have about this would be: - IPAWS messages must have a digital signature to be accepted by the system, however based the Hawaii EMA press conference and articles which say &#x27;an employee made an error&#x27; I would guess that the digital signature is not used in a way that is actually tied to the official authorized to declare the alert but to is accessible to their whole emergency Operations Group. - Are they sending test messages with that signature? With a &#x27;two-person rule&#x27;, it sounds from the press conference that it isn&#x27;t enforced by the machine (not like having two keys which both have to be turned to send the message) but by the first person stepping away from the machine and letting the other person push the &quot;are you sure you want to send this?&quot; button. That doesn&#x27;t seem much better, but changing the system to do that gets away from the basic CAP architecture and isn&#x27;t likely to happen soon.<p>The FCC is currently working on a proceeding regarding updating WEA to allow more geographic targeting of alerts, the way the other alerts can be targeted at specific locales. The current system dates back to 2011 or 2012, and is pretty coarsely-targeted, which is probably why you&#x27;re getting Amber Alerts on your phone for a town that is 6 hours away just because it&#x27;s in your state. You can find it at Proceeding Numbers 15-91 and 15-94 [3].<p>[1] You can see the message here, which archives messages sent via IPAWS: <a href="http:&#x2F;&#x2F;ipawsnonweather.alertblogger.com&#x2F;?p=18764" rel="nofollow">http:&#x2F;&#x2F;ipawsnonweather.alertblogger.com&#x2F;?p=18764</a> [2] <a href="http:&#x2F;&#x2F;dod.hawaii.gov&#x2F;hiema&#x2F;press-conference-missile-alarm-live-stream&#x2F;" rel="nofollow">http:&#x2F;&#x2F;dod.hawaii.gov&#x2F;hiema&#x2F;press-conference-missile-alarm-l...</a> [3] <a href="https:&#x2F;&#x2F;www.fcc.gov&#x2F;fcc-announces-comment-dates-rulemaking-strengthen-wireless-emergency-alerts-public-safety-tool" rel="nofollow">https:&#x2F;&#x2F;www.fcc.gov&#x2F;fcc-announces-comment-dates-rulemaking-s...</a><p>This gives some more technical details on IPAWS and the Common Access Protocol that these messages use: <a href="https:&#x2F;&#x2F;www.fema.gov&#x2F;pdf&#x2F;emergency&#x2F;ipaws&#x2F;ipaws_cap_mg.pdf" rel="nofollow">https:&#x2F;&#x2F;www.fema.gov&#x2F;pdf&#x2F;emergency&#x2F;ipaws&#x2F;ipaws_cap_mg.pdf</a>

Hackers?

ENV=prod is never a good default…

I received a second alert just over an hour ago. <a href="https:&#x2F;&#x2F;i.imgur.com&#x2F;Rc8cfO7.jpg" rel="nofollow">https:&#x2F;&#x2F;i.imgur.com&#x2F;Rc8cfO7.jpg</a>

Not to sound crude but if a nuclear bomb what can people on an island really do?

Nice going fools. Next time people will just ignore it. Hope somebody gets fired for this.

Superfluous but still somehow angering part of the article:<p>&quot;Per White House pool reports, Trump was out on a golf course when the alert was sent.&quot;

Meanwhile, Trump went ahead and finished his 18 holes of golf while 1.5 million Americans were told a ballistic missile was headed their way.

Classic destabilization tactics.

I will go out on a limb and say someone hacked the system and decided to prank an entire state.<p>Fun fact, in my small hometown you could and possibly still activate the tornado warning system using DTMF and a transmitter on some frequency in the 149mhz range.<p>To clarify, I never actually attempted it but I had a uniden radio scanner in my teens and noticed the pattern for the 12:00 test.

Ok, I hope that the people who got scared shitless by this emergency start doing something against nuclear weapons. It&#x27;s ludicrous: We can all die any day and ICAN, the people who helped to pass the ban on nuclear weapons and got Nobel prize for it are raising money at a rate of $50 a day.

Doesn&#x27;t everyone know that the best defense against such an attack is: &quot;duck and cover&quot;? Further, the desks of school children could be used as shelter&#x2F;cover since everyone knows that these desks are made of the most powerful adamantium&#x2F;vibranium alloy.