FCC Report: Day Shift Warning Officer Believed the Missile Threat Was Real
UPDATE: The individual responsible for sending out a false missile alert on Jan. 13, 2018 has been terminated and the head of the agency, Administrator Vern Miyagi, has resigned. The news came as a preliminary report from the FCC was released and an internal incident investigation was discussed on Tuesday during a live press conference (video posted below). Another worker was suspended without pay. The FCC report indicates that the worker who sent out the alert believed that the missile threat was real, and did not hear the word “exercise” repeated during the test. US Senator Brian Schatz said the reports demonstrate that there were systems and judgement failures on multiple levels, and reinforce his belief that missile alerts should be handled by the federal government.
Previous Post: The Federal Communications Commission today released a preliminary report on the false ballistic missile alert in Hawaiʻi that occurred on Saturday, Jan. 13, 2018.
Hawai‘i Congressional Delegation Briefed On False Emergency Alert. Courtesy photo Jan. 17, 2018.
According to the report, the transmission of the false message was caused in part by a combination of human error and inadequate safeguards.
New information in the report states that a day shift warning officer believed that the missile threat was real, according to a written statement from the worker as relayed to the Bureau by the Hawaiʻi Emergency Management Agency. The report states that the officer heard the part of the message that stated “this is not a drill” but did not hear the part of the message that repeated the word “exercise” three times.
The report further notes that because the FCC had not been able to interview the day shift warning officer who transmitted the false alert, they were “not in a position to fully evaluate the credibility of their assertion that they believed there was an actual missile threat and intentionally sent the live alert (as opposed to believing that it was a drill and accidentally sending out the live alert).”
https://www.facebook.com/HawaiiEMA/videos/783418171858290/
“HI-EMA’s lack of preparation for how to respond to the transmission of a false alert was largely responsible for the 38-minute delay in correcting the alert,” the report stated.
The false ballistic missile alert was issued by the Hawaiʻi Emergency Management Agency at 8:07 a.m. on Saturday, Jan. 13, 2018, through the Emergency Alert System (EAS) and Wireless Emergency Alert (WEA) System. FCC Chairman Pai immediately called on the Bureau to investigate.
HI-EMA Apologizes for Missile False Alarm Alert. PC: file image HI-EMA press conference 1 p.m. 1.13.18
To date, the Bureau has interviewed key stakeholders, including: HI-EMA employees; representatives of other emergency management agencies across the country; alert origination software vendors (including the vendor who supplies HI-EMA); and wireless service providers.
In an open meeting address, FCC Attorney Advisor for Cybersecurity and Communications Reliability, James Wiley said, “Unfortunately, the individual who transmitted the false alert has refused to speak with us. However, late last week the Hawaiʻi Emergency Management Agency provided us with information from a written statement made by this individual shortly after the incident, which helped to improve our understanding of the events that led to the false alert.” *(The full text of that address as well as a timeline of events leading up to and following the false alert is included below).
Governor Ige, Major General Logan, BG Hara and Vern Miyagi at the State Emergency Operating Center on video teleconference with the four counties Emergency Operating Center during a tsunami watch earlier this month. The image shows how Emergency Managers collaborate to address statewide emergencies. PC: file (1.23.18) HI-EMA.
The FCC notes that HI-EMA has since taken steps designed to ensure that an incident such as this never happens again.
According to the FCC, the Bureau will continue its investigation and issue a final report, including recommended measures to safeguard against false alerts and to mitigate their harmful effects if they do occur.
After the issuance of the final report, the FCC will partner with FEMA to engage in stakeholder outreach and encourage the implementation of best practices.
Remarks of James Wiley
Attorney Advisor, Cybersecurity and Communications Reliability Division
Federal Communications Commission
January 30, 2018, Open Meeting
False Emergency Alert in Hawaiʻi
Thank you, Chief Fowlkes. Good morning, Chairman Pai and Commissioners.
As Chief Fowlkes said, on January 13th, the Hawaiʻi Emergency Management Agency initiated a false ballistic missile alert, using the Wireless Emergency Alert system, which delivers alerts to consumers’ mobile devices, as well as the Emergency Alert System, which delivers alerts through television and radio.
In investigating the false alert, the Bureau to date has interviewed representatives of the Hawaiʻi Emergency Management Agency in person in Honolulu and received a demonstration of how its alert origination software initiates alerts and tests. In addition, we have interviewed representatives of wireless providers that offer service to Hawaiʻi, the President of the Hawaiʻi Broadcasters Association and the Hawaiʻi State Emergency Communications Committee, alert origination software vendors (including the vendor that supplies alerting software to the Hawaiʻi Emergency Management Agency), other state and local emergency management agencies and key stakeholders.
ARTICLE CONTINUES BELOW ADSo far, we generally have been pleased with the level of cooperation we have received, including from the leadership of the Hawaiʻi Emergency Management Agency. Unfortunately, the individual who transmitted the false alert has refused to speak with us. However, late last week the Hawaiʻi Emergency Management Agency provided us with information from a written statement made by this individual shortly after the incident, which helped to improve our understanding of the events that led to the false alert.
By way of background, and to provide context to what happened on January 13th, Hawaiʻi has been actively testing its alert and warning capabilities over the past year. The Hawaiʻi Emergency Management Agency’s ballistic missile defense drill aims to simulate a real event. It begins with a mock call from a warning officer who simulates a call from United States Pacific Command, and it ends with the transmission of a test alert message to FEMA. Under the Hawaiʻi Emergency Management Agency’s established drill procedures, the test message should be sent only to FEMA’s Integrated Public Alert and Warning System gateway – it should never actually be transmitted to consumer phones, radios, or televisions.
By November 27 of last year, the Hawaiʻi Emergency Management Agency had memorialized a checklist of procedures for initiating and conducting the ballistic missile defense drill that had been refined over months of testing through iterative practice and feedback on lessons learned. And the agency was regularly running the ballistic missile defense drill as a “no notice” drill – meaning it was commencing the drills without prior notice to the warning officers who initiate the alerts – in order to better simulate actual emergency conditions. The final version of the checklist that guided the agency through its ballistic missile defense drill on January 13th was created on January 5th.
I will now walk you through a timeline of the events as we currently understand them that led to the initiation of the false alert. In the early morning hours of January 13th, the Hawaiʻi Emergency Management Agency’s midnight shift conducted a ballistic missile defense drill without incident. The supervisor of the midnight shift also decided to run a no-notice version of the drill during the transition to the day shift. The midnight shift supervisor specifically decided to drill at the shift change in order to help train the day shift’s warning officers for a ballistic missile defense scenario at a time when it would be challenging to properly respond.
At 8:00 a.m., Hawaiʻi Standard Time, the Hawaiʻi Emergency Management Agency conducted its a regularly scheduled shift change. When the supervisor of the day shift entered the agency, the supervisor of the midnight shift orally communicated the intention to conduct the ballistic missile preparedness drill. But there was a miscommunication. The incoming day shift supervisor thought that the midnight shift supervisor intended to conduct a drill for the midnight shift warning officers only (those ending their shift) – not for the day shift officers (those beginning their shift). As a result, the day shift supervisor was not in the proper location to supervise the day shift warning officers when the ballistic missile defense drill was initiated.
At 8:05 a.m., the midnight shift supervisor initiated the drill by placing a call to the day shift warning officers, pretending to be U.S. Pacific Command. The supervisor played a recorded message over the phone. The recording began by saying “exercise, exercise, exercise,” language that is consistent with the beginning of the script for the drill. After that, however, the recording did not follow the Hawaiʻi Emergency Management Agency’s standard operating procedures for this drill. Instead, the recording included language scripted for use in an Emergency Alert System message for an actual live ballistic missile alert. It thus included the sentence “this is not a drill.” The recording ended by saying again, “exercise, exercise, exercise.” Three on-duty warning officers in the agency’s watch center received this message, simulating a call from U.S. Pacific Command on speakerphone.
According to a written statement from the day shift warning officer who initiated the alert, as relayed to the Bureau by the Hawaiʻi Emergency Management Agency, the day shift warning officer heard “this is not a drill” but did not hear “exercise, exercise, exercise.” According to the written statement, this day shift warning officer therefore believed that the missile threat was real. At 8:07 a.m., this officer responded by transmitting a live incoming ballistic missile alert to the State of Hawaiʻi. The day shift warning officer used software to send the alert. Specifically, they selected the template for a live alert from a drop-down menu containing various live- and test- alert templates. The alert origination software then prompted the warning officer to confirm whether they wanted to send the message. The prompt read, “Are you sure that you want to send this Alert?” Other warning officers who heard the recording in the watch center report that they knew that the erroneous incoming message did not indicate a real missile threat, but was supposed to indicate the beginning of an exercise. Specifically, they heard the words: “exercise, exercise, exercise.” The day shift warning officer seated at the alert origination terminal, however, reported to the Hawaiʻi Emergency Management Agency after the event their belief that this was a real emergency, so they clicked “yes” to transmit the alert.
Because we’ve not been able to interview the day shift warning officer who transmitted the false alert, we’re not in a position to fully evaluate the credibility of their assertion that they believed there was an actual missile threat and intentionally sent the live alert (as opposed to believing that it was a drill and accidentally sending out the live alert). But it is worth noting that they accurately recalled after the event that the announcement did say “This is not a drill.”
At 8:08 a.m., the mobile device of the warning officer who transmitted the alert sounded the Wireless Emergency Alert attention signal – distinct audible tones that announce a Wireless Emergency Alert – providing the first indication to those in the watch center that an actual alert had been transmitted to the public.
At 8:09 a.m., State Adjutant Major General Joe Logan, Director of the Hawaiʻi Emergency Management Agency, notified Hawaiʻi Governor David Ige that the agency had transmitted a false alert. At 8:10 a.m., the Director of the Hawaiʻi Emergency Management Agency communicated to United States Pacific Command that there was no missile launch, confirming what Pacific Command already knew. The Hawaiʻi Emergency Management Agency also notified the Honolulu Police Department that there was no missile launch.
At 8:12 a.m., the Hawaiʻi Emergency Management Agency used its alert origination software to cancel retransmission of the false alert. The cancellation is an instruction to downstream Emergency Alert System and Wireless Emergency Alert system equipment to cease retransmission. Notably, a cancellation message does not generate an “all clear” message. It also does not “recall” messages that have already been transmitted and displayed on televisions or mobile phones.
From 8:13 a.m. to 8:26 a.m., the Hawaiʻi Emergency Management Agency conducted outreach to Hawaiʻi’s county emergency management agencies and radio and TV stations to inform them that the alarm was false. The agency’s phone lines also became congested with incoming calls from the public asking about the nature of the alert that they just received. Some calls to the agency did not get through. The agency also notified its staff of the false alert so that they could help to respond to community inquiries.
At 8:20 a.m., the Hawaiʻi Emergency Management Agency posted on its Facebook and Twitter accounts that there was no missile threat to Hawaiʻi. At 8:24 a.m., Hawaiʻi Governor David Ige retweeted the agency’s notice that there was no missile threat. The Governor has stated that he was unable to do this earlier because he did not know his Twitter password.
At 8:27 a.m., agency staff met to discuss options for sending a second, corrective message using the Emergency Alert System and the Wireless Emergency Alert system. The agency determined that a correction of this false alert best met the criteria for a Civil Emergency Message, which is one of the event codes used to initiate alerts over the Emergency Alert System. At 8:30 a.m., the agency called FEMA and, on its second attempt to reach FEMA, reached a FEMA IPAWS Program Management Office employee. After 45 seconds, all on the call agreed that the correction met the criteria for use of the Civil Emergency Message event code.
At 8:31 a.m., the Deputy Chief of the Hawaiʻi Emergency Management Agency’s Telecommunications Branch logged into the agency’s alert origination software and created correction messages for the Emergency Alert and Wireless Emergency Alert systems. At 8:45 a.m. – 38 minutes after the false alert – the agency issued a correction over the two alerting systems.
Based on our investigation to date, the Bureau believes that a combination of human error and inadequate safeguards contributed to this false alert.
With respect to human error, due to a miscommunication between the midnight shift supervisor and day shift supervisor, the drill was run without sufficient supervision. In speaking with the Bureau, other emergency management agencies stressed the importance of proper drill supervision, and that conducting a drill without proper supervision would not be tolerated. Further, the midnight shift supervisor initiated the drill by playing a recording that deviated from the script of the agency’s established drill procedure and included the phrase “This is not a drill.” And finally, the warning officer at the alert origination terminal apparently failed to recognize that this was an exercise even though the other warning officers on duty understood that this was not a real emergency
With respect to inadequate safeguards, most importantly, there were no procedures in place to prevent a single person from mistakenly sending a missile alert to the State of Hawaiʻi. While such an alert addressed a matter of the utmost gravity, there was no requirement in place for a warning officer to double check with a colleague or get signoff from a supervisor before sending such an alert. Additionally, the State of Hawaiʻi appears to have been conducting an atypical number of no-notice drills, which heightened the potential for an error to occur. The Bureau’s investigation so far has revealed that while other emergency management agencies use no-notice drills under special circumstances, their common practice is to schedule drills in advance for a set date and time.
It is also troubling that Hawaiʻi’s alert origination software did not differentiate between the testing environment and the live alert production environment. Hawaiʻi’s alert origination software allowed users to send both live alerts and test alerts using the same interface, and the same log-in credentials, after clicking a button that simply confirmed “Are you sure you want to send this alert?” In other words, the confirmation prompt contained the same language, irrespective of whether the message was a test or an actual alert. The confirmation prompt also did not offer the officer another opportunity to review the text that is about to be sent. Further, Hawaiʻi’s reliance on prepared templates stored in their alert origination software made it easy for a warning officer to click through the alert origination process without sufficient focus on the actual text of the alert message that he or she was about to send. In contrast, the Bureau’s investigation so far has revealed that common industry practice is to host the live alert production environment on a separate, user-selectable domain at the log-in screen, or through a separate application. Other alert origination software also appears to provide clear visual cues that distinguish the test environment from the live production environment, including the use of watermarks, color coding, and unique numbering.
Once the false alert was sent, the error was worsened by the delay in authoritatively correcting the misinformation. The Hawaiʻi Emergency Management Agency had not anticipated the possibility of issuing a false alert and, as such, had failed to develop standard procedures for its response. It first sent out a correction using social media, rather than the same alerting systems that it used to transmit the false alert. Indeed, the agency was not immediately prepared to issue a correction using these systems. The agency also did not maintain redundant and effective means to communicate with key stakeholders during emergencies.
The Bureau is pleased that the Hawaiʻi Emergency Management Agency has already taken steps to help ensure that an incident like this never happens again. It has created a new policy that supervisors must receive advance notice of all future drills. It will require two credentialed warning officers to sign in and validate the transmission of every alert and test. It has created a false alert correction template for Emergency Alert System and Wireless Emergency Alert system messages so that warning officers are more readily prepared to correct a false alert, should one ever occur again. It has requested that its alert origination software vendor integrate improvements into the next iteration of its software to more clearly delineate the test environment from the live production environment, helping to safeguard against false alerts. And finally, it has stopped all future ballistic missile defense drills pending the conclusion of its own investigation.
That said, there is more work to be done. The Bureau will continue its investigation and issue a final report, including recommended measures to safeguard against false alerts and to mitigate their harmful effects if they do occur. And once we have developed these recommended measures, we intend to partner with FEMA to engage in stakeholder outreach and encourage implementation of these best practices. Among other avenues, we are considering convening a roundtable with stakeholders in the emergency alerting ecosystem to discuss the lessons that should be learned from this incident as well as developing a joint webinar with FEMA to further educate stakeholders. And of course, as always, the Bureau stands ready to implement additional actions as directed by the Commission.
____
*(Below are timelines provided by the FCC of events leading up to and after the false alert)
Events Leading Up to the False Alert
Time Events
8:05 a.m.
• HI-EMA’s midnight shift supervisor begins a no-notice ballistic missile defense drill at
a shift change by placing a call, pretending to be U.S. Pacific Command, to the day
shift warning officers.
• The midnight shift supervisor plays a recording over the phone that properly includes
the drill language “EXERCISE, EXERCISE, EXERCISE,” but also erroneously
contains the text of an EAS message for a live ballistic missile alert, including the
language, “THIS IS NOT A DRILL.” The recording does not follow the script
contained in HI-EMA’s standard operating procedure for this drill.
• The day shift warning officers receive this recorded message on speakerphone.
• While other warning officers understand that this is a drill, the warning officer at the
alert origination terminal claimed to believe, in a written statement provided to HIEMA,
that this was a real emergency, not a drill.
8:07 a.m.
• This day shift warning officer responds, as trained for a real event, by transmitting a
live incoming ballistic missile alert to the State of Hawaiʻi.
• In doing so, the day shift warning officer selects the template for a live alert from a
drop-down menu, and clicks “yes” in response to a prompt that reads, “Are you sure
that you want to send this Alert?”
8:08 a.m. • Day shift warning officer receives false WEA on mobile device
8:09 a.m. • HI-EMA notifies Hawaiʻi Governor of false alert
8:10 a.m. • HI-EMA to U.S. Pacific Command and Honolulu PD: no missile launch
8:12 a.m. • HI-EMA issues a cancellation, ceasing retransmission over EAS, WEA
8:13 a.m. • HI-EMA begins outreach, but its phone lines become congested
8:20 a.m. • HI-EMA posts on Facebook, Twitter – “NO missile threat to Hawaiʻi”
8:24 a.m. • Hawaiʻi Governor retweets notice that there is no missile threat
8:27 a.m. • HI-EMA determines that an EAS, WEA Civil Emergency Message (CEM) is the
best vehicle for correction
8:30 a.m. • FEMA confirms HI-EMA’s view on CEM; Hawaiʻi Governor posts correction on
Facebook
8:31 a.m. • HI-EMA supervisor logs into alert system, begins to create false alert correction
8:45 a.m. • HI-EMA issues correction through EAS and WEA that there is no missile threat
Events After the False Alert
8:08 a.m. • Day shift warning officer receives false WEA on mobile device
8:09 a.m. • HI-EMA notifies Hawaiʻi Governor of false alert
8:10 a.m. • HI-EMA to U.S. Pacific Command and Honolulu PD: no missile launch
8:12 a.m. • HI-EMA issues a cancellation, ceasing retransmission over EAS, WEA
8:13 a.m. • HI-EMA begins outreach, but its phone lines become congested
8:20 a.m. • HI-EMA posts on Facebook, Twitter – “NO missile threat to Hawaiʻi”
8:24 a.m. • Hawaiʻi Governor retweets notice that there is no missile threat
8:27 a.m. • HI-EMA determines that an EAS, WEA Civil Emergency Message (CEM) is the
best vehicle for correction
8:30 a.m. • FEMA confirms HI-EMA’s view on CEM; Hawaiʻi Governor posts correction on
Facebook
8:31 a.m. • HI-EMA supervisor logs into alert system, begins to create false alert correction
8:45 a.m. • HI-EMA issues correction through EAS and WEA that there is no missile threat
Sponsored Content
