At 8:07 on a Saturday morning in January 2018, every mobile phone in Hawaii carrying an emergency alert made the same noise and displayed the same sentence in capital letters: a ballistic missile threat inbound to Hawaii, seek immediate shelter, this is not a drill. There were no sirens, which made some people suspect a mistake. Most did not have that thought available to them, and spent the next several minutes on phone calls, in stairwells, and in car parks.
The correction arrived at 8:45. In between, a state of 1.4 million people acted on a message that was wrong, and the agency that sent it learned that being believed is not a permanent possession.
Thirty-eight minutes, reconstructed
The Federal Communications Commission published a report on the false alert in April 2018, and its timeline is the most useful document I have read on how an institution loses ground it thought was its own. A midnight shift supervisor ran a no-notice drill by playing a recording over the phone. The recording used the phrase this is not a drill, against the written procedure, and although the other officers heard the words exercise, exercise, exercise, the officer at the alert origination terminal did not register them. He picked the live template from a drop-down menu. The software asked whether he was sure he wanted to send this alert. He was.
Five minutes later the agency cancelled the alert, which sounds like the end of the story and was not. A cancellation tells downstream equipment to stop retransmitting. It generates nothing and reaches no phone already buzzing. The first authoritative correction went out on social media at 8:20, thirteen minutes in. The correction over the systems that carried the error took until 8:45, because between 8:31 and 8:44 a deputy branch chief was still composing it, and because a call to the federal alerting office asking which event code to use went unanswered.
Nobody had written the all clear in advance. The agency held a template for the worst day in the state's history and none for its own mistake.
What the switchboards recorded
The cost is visible in call volumes. Across Hawaii that morning the emergency lines took roughly 7,755 calls, against a typical Saturday range of 250 to 350, and call takers could not answer 2,660 of them. The channel for real emergencies was saturated by people verifying a message the state had sent them, so anyone with a genuine emergency was queueing behind the error.
The report also records what happened to people the system serves least well. Deaf board members of a national advocacy organisation, in Hawaii for meetings, sheltered in a windowless storage room off a school library and had no correction until 8:45, long after hearing people nearby picked the news up by voice. A false alarm lands hardest on whoever has the fewest channels for checking.
The tornado data nobody wants to read
Here is what turns an embarrassing morning into a trust problem with a price. Warnings work only if people move on receiving one, and moving is costly, so everyone runs a private calculation about whether this siren is real. Each false alarm feeds it.
The clearest measurement comes from tornado warnings. In a 2009 study in Weather, Climate, and Society, Kevin Simmons and Daniel Sutter used variation in the false alarm ratio across the country to test for the effect in casualty data from 1986 to 2004. They found it. Tornadoes striking areas with a higher false alarm ratio killed and injured more people, holding other factors constant, and a one standard deviation rise in that ratio raised expected fatalities by 12 to 29 percent.
Read that as a statement about a shared resource rather than about individuals. Nobody there decided to ignore a warning. Warnings had simply been wrong often enough that average response slowed by a margin large enough to appear in mortality statistics. The believability of a public message behaves like any other common resource: it depletes with misuse, recovers slowly, and the people who spend it are rarely the people who pay.
The opt-out is where the bill arrives
In the American system the depletion has a mechanism attached. Under the Commission's rules a subscriber may switch off imminent threat alerts and child abduction alerts, and may not switch off alerts from the president. A resident who decides the buzzing has become unreliable has a settings menu, and the switch that follows a false alarm is silent, lasting, and invisible to the agency that caused it.
That is what makes an alerting system different from most public services. A badly run bus route loses riders visibly. A warning system that spends its credibility looks healthy right up to the morning it needs everyone to move, and then finds out how many phones stopped listening.
What the regulator told every alert desk to change
The recommendations in the report are mostly cheap. Run internal tests in a closed environment rather than on the public. Require more than one credentialed person to validate high-impact messages, tests included. Keep live and test environments separate, and make the confirmation prompt name the specific thing about to be sent. Stop using phrases such as this is not a drill or real world in exercise scripts. Write standing procedures for correcting a false alert, specifying that corrections go out over the same systems that carried the error, and plan the social media response in advance.
None of that is technology. It is ordinary discipline for a service that can reach every person in a jurisdiction in one keystroke, and Hawaii instituted a two-person activation and verification rule afterwards. The lesson travels past missile alerts, because the number of organisations that can push a notification to thousands of people has grown faster than the number that have thought about what happens when one is wrong.
A checklist for anyone who can send an alert
If you can reach a whole school, congregation, or workforce, five things are worth settling before the next real event.
- Write the correction first. Draft the retraction in full before the alert, and keep it where the person on duty at three in the morning finds it in under a minute.
- Require a second pair of eyes for anything that reaches everyone, tests included, and record the approver.
- Never let drill language imitate live language. If a test script holds a sentence you would send for real, rewrite it.
- Correct on the channel that carried the error. A tweet does not undo a text message, and the people with fewest channels wait longest.
- Log every false alarm, its cause, and the minutes to correction, and read the log before the next send.
Hawaii was told the truth 38 minutes late by an agency with no words prepared for being wrong. That cost is not measurable on the morning it happened. It shows up later, in the pause before somebody decides whether this one is real, and the only way to keep that pause short is to be an institution that has never spent the belief it will need.