Presentation on Preliminary Report on Hawaii False Emergency Alert

Excerpt from Remarks of James Wiley, Attorney Advisor, Cybersecurity and Communications Reliability Division, Federal Communications Commission, January 30, 2018, Open Meeting, False Emergency Alert in Hawaii

…I will now walk you through a timeline of the events as we currently understand them that led to the initiation of the false alert. In the early morning hours of January 13th, the Hawaii Emergency Management Agency’s midnight shift conducted a ballistic missile defense drill without incident. The supervisor of the midnight shift also decided to run a no-notice version of the drill during the transition to the day shift. The midnight shift supervisor specifically decided to drill at the shift change in order to help train the day shift’s warning officers for a ballistic missile defense scenario at a time when it would be challenging to properly respond.

At 8:00 a.m., Hawaii Standard Time, the Hawaii Emergency Management Agency conducted its a regularly scheduled shift change. When the supervisor of the day shift entered the agency, the supervisor of the midnight shift orally communicated the intention to conduct the ballistic missile preparedness drill. But there was a miscommunication. The incoming day shift supervisor thought that the midnight shift supervisor intended to conduct a drill for the midnight shift warning officers only (those ending their shift) – not for the day shift officers (those beginning their shift). As a result, the day shift supervisor was not in the proper location to supervise the day shift warning officers when the ballistic missile defense drill was initiated.

At 8:05 a.m., the midnight shift supervisor initiated the drill by placing a call to the day shift warning officers, pretending to be U.S. Pacific Command. The supervisor played a recorded message over the phone. The recording began by saying “exercise, exercise, exercise,” language that is consistent with the beginning of the script for the drill. After that, however, the recording did not follow the Hawaii Emergency Management Agency’s standard operating procedures for this drill. Instead, the recording included language scripted for use in an Emergency Alert System message for an actual live ballistic missile alert. It thus included the sentence “this is not a drill.” The recording ended by saying again, “exercise, exercise, exercise.” Three on-duty warning officers in the agency’s watch center received this message, simulating a call from U.S. Pacific Command on speakerphone.

According to a written statement from the day shift warning officer who initiated the alert, as relayed to the Bureau by the Hawaii Emergency Management Agency, the day shift warning officer heard “this is not a drill” but did not hear “exercise, exercise, exercise.” According to the written statement, this day shift warning officer therefore believed that the missile threat was real. At 8:07 a.m., this officer responded by transmitting a live incoming ballistic missile alert to the State of Hawaii. The day shift warning officer used software to send the alert. Specifically, they selected the template for a live alert from a drop-down menu containing various live- and test- alert templates. The alert origination software then prompted the warning officer to confirm whether they wanted to send the message. The prompt read, “Are you sure that you want to send this Alert?” Other warning officers who heard the recording in the watch center report that they knew that the erroneous incoming message did not indicate a real missile threat, but was supposed to indicate the beginning of an exercise. Specifically, they heard the words: “exercise, exercise, exercise.” The day shift warning officer seated at the alert origination terminal, however, reported to the Hawaii Emergency Management Agency after the event their belief that this was a real emergency, so they clicked “yes” to transmit the alert.

Because we’ve not been able to interview the day shift warning officer who transmitted the false alert, we’re not in a position to fully evaluate the credibility of their assertion that they believed there was an actual missile threat and intentionally sent the live alert (as opposed to believing that it was a drill and accidentally sending out the live alert). But it is worth noting that they accurately recalled after the event that the announcement did say “This is not a drill.”

At 8:08 a.m., the mobile device of the warning officer who transmitted the alert sounded the Wireless Emergency Alert attention signal – distinct audible tones that announce a Wireless Emergency Alert – providing the first indication to those in the watch center that an actual alert had been transmitted to the public.

At 8:09 a.m., State Adjutant Major General Joe Logan​, Director of the Hawaii Emergency Management Agency, notified Hawaii Governor David Ige that the agency had transmitted a false alert. At 8:10 a.m., the Director of the Hawaii Emergency Management Agency communicated to United States Pacific Command that there was no missile launch, confirming what Pacific Command already knew. The Hawaii Emergency Management Agency also notified the Honolulu Police Department that there was no missile launch.

At 8:12 a.m., the Hawaii Emergency Management Agency used its alert origination software to cancel retransmission of the false alert. The cancellation is an instruction to downstream Emergency Alert System and Wireless Emergency Alert system equipment to cease retransmission. Notably, a cancellation message does not generate an “all clear” message. It also does not “recall” messages that have already been transmitted and displayed on televisions or mobile phones.

From 8:13 a.m. to 8:26 a.m., the Hawaii Emergency Management Agency conducted outreach to Hawaii’s county emergency management agencies and radio and TV stations to inform them that the alarm was false. The agency’s phone lines also became congested with incoming calls from the public asking about the nature of the alert that they just received. Some calls to the agency did not get through. The agency also notified its staff of the false alert so that they could help to respond to community inquiries.

At 8:20 a.m., the Hawaii Emergency Management Agency posted on its Facebook and Twitter accounts that there was no missile threat to Hawaii. At 8:24 a.m., Hawaii Governor David Ige retweeted the agency’s notice that there was no missile threat. The Governor has stated that he was unable to do this earlier because he did not know his Twitter password.

At 8:27 a.m., agency staff met to discuss options for sending a second, corrective message using the Emergency Alert System and the Wireless Emergency Alert system. The agency determined that a correction of this false alert best met the criteria for a Civil Emergency Message, which is one of the event codes used to initiate alerts over the Emergency Alert System. At 8:30 a.m., the agency called FEMA and, on its second attempt to reach FEMA, reached a FEMA IPAWS Program Management Office employee. After 45 seconds, all on the call agreed that the correction met the criteria for use of the Civil Emergency Message event code.

At 8:31 a.m., the Deputy Chief of the Hawaii Emergency Management Agency’s Telecommunications Branch logged into the agency’s alert origination software and created correction messages for the Emergency Alert and Wireless Emergency Alert systems. At 8:45 a.m. – 38 minutes after the false alert – the agency issued a correction over the two alerting systems.

Based on our investigation to date, the Bureau believes that a combination of human error and inadequate safeguards contributed to this false alert….

read … FULL REPORT

PDF: Hawaii State DoD Report Jan 30, 2018

WaPo: Hawaii’s false missile alert sent by worker believing attack on U.S. was imminent 

Variety: FCC Blames Human Error, Poor Safeguards for False Hawaii Missile Alert

SA: HI-EMA worker believed state was under attack, report says