Investigators are blaming human error for the panic-inducing false missile alert in Hawaii last month. They say it was sent out by a state emergency management worker who mistook an exercise for a real attack.
At the same time, the incident has exposed what may be a more widespread problem: disagreement over whose job it should be to warn the public about missile attacks.
Technically, the alerts could be sent by any federal, state or local agency that has access to IPAWS, the Integrated Public Alert & Warning System, which sends emergency alerts to TV, radio and smart phones.
But Federal officials say it's not their role to warn the public about missiles. "FEMA will tell the states that there's a missile inbound and where it's going to land," says Mark Lucero, chief of engineering for IPAWS. "And then the state will initiate any plans it has in place, one of which being issuing an alert to the public, telling them what to do."
FEMA's national warning system manual echoes that localism: Once federal authorities have used the National Warning System (NAWAS) to alert state and local authorities of the missile threat, "Local authorities sound the Attack Warning signal on public warning devices."
This comes as a surprise to many of those local emergency management officials.
Francisco Sanchez Jr., deputy emergency management coordinator for Harris County, Texas — which includes Houston — says he assumed the public message would come directly from the federal government.
"Military events are not something that we envision or have within the scope of our responsiblities to alert for," Sanchez says.
Sanchez has been active in the recent updating of the national IPAWS system, and knows the system well. He says it's good that local agencies are able to use it send out their own messages about floods and the like, but missile alerts are different. He says his agency would scramble to relay that warning to the public, but the extra step would slow things down.
"Eighteen minutes before a missile gets here? Who am I going to call at the [Department of Defense] if I get that alert on my phone to verify this is real?" he asks. "Who can I get confirmation and double-confirmation from to make sure this is an authentic alert, this isn't the result of a hack, this isn't a mistake? By the time I've done that, something's gone boom."
The false alarm in Hawaii happened in part because it was the unusual case of a state that had embraced its role in alerting the public to missile attacks, and was frequently practicing sending those messages out. It was during one such drill that a missile alert was sent out for real.
Now other state and local emergency management agencies wonder if they should also be practicing more. In the last few weeks many have been in communication with each other, and with FEMA, about improving their readiness to send out a missile attack warning.
At the same time, many say they'd rather the federal government took the lead on this. Federal authorities have the technical capacity to send emergency alerts directly to the public, including access to a never-used "presidential message" system that's so high-level, smart phone users have no way to block them (unlike other emergency alerts, which can be turned off.)
At a House hearing on the Hawaii incident last week, Benjamin Krakauer of the New York City Office of Emergency Management said the federal government should formally take on the public alerting job.
"The federal government really is in the best position to detect a threat from a state actor and issue warnings, initially, to the general public," Krakauer said. "Time is of the essence, and state and local authorities are not really in the best position to make those notifications."
There are also concerns about widely varying alerting standards, at the local level. In Hawaii, the state's system allowed alerts to be sent out by a single person — which is how one confused employee was able to trigger a state-wide alarm.
Other agencies require two people to sign off on emergency alerts, although in some cases that's just a procedural rule, not something enforced by the software.
State agencies are also at a disadvantage when it comes to correcting mistakes. It took Hawaii 38 minutes to countermand its false alarm; Lisa Fowlkes, the Bureau Chief for the Public Safety and Homeland Security Bureau of the Federal Communications Commission, told the House hearing that Hawaii's correction was delayed by their unfamiliarity with the situation.
"They had to figure out what code to issue, they talked to FEMA personnel on what was about a 45-second phone call," Fowlkes said. "Then somebody had to go and log on and write a correction message, because they did not have a template for that."
Local agencies also vary widely in the kind of software they use to upload alerts into IPAWS. The actual messages are written and uploaded in software purchased from private sector vendors. Design and functionality vary, and some of the software products are very basic.
Jared Spool, an expert in user interface engineering, says this makes it harder to fix dangerous design problems, on a national basis. For instance, he says, what do you do when it becomes clear that pull-down menus with pre-written emergency messages are laid out in a way that could lead to false missile alerts?
"Because there are 23 vendors out there, how do you get them all to the same level of understanding," Spool says. "And that's the nature of the distributed way that our government works, and that these systems work."
FEMA considered supplying local emergency agencies with a free, standard message-sending system, but people inside the agency say software makers pressured FEMA not to compete with emergency messaging products sold by the private sector.
The Hawaii incident has now focused new attention on what one local emergency management official calls "the planning gap," when it comes to sending out public missile alerts. Some state and local agencies are now following Hawaii's lead, thinking through what their procedures would be, and consulting with FEMA about what their emergency alerts should say.
But the incident has also inspired those who want to get the states out of the missile-alert business altogether. Hawaii Senator Brian Schatz has introduced legislation making the public warnings the sole responsibility of the federal government.
RACHEL MARTIN, HOST:
OK. Remember back to that false alarm that went off in Hawaii last month. This is one that sent an alert to people's phones warning of an inbound missile. Investigators say that warning was sent by a state employee who mistakenly believed the exercise was an actual attack. NPR's Martin Kaste reports that the mishap exposed a deeper problem in the nation's missile alert system, uncertainty over whose job it should be to warn the public.
MARTIN KASTE, BYLINE: If a missile's headed your way, you're supposed to get an emergency alert. That's the warning that's accompanied by the shrill, two-tone alert sound. You've heard it - this is a test, this is only a test. I'm actually not allowed to play the sound here because I'd get NPR in trouble with the FCC. The government wants people to take that sound seriously, and it's using it on phones now, too. Here's a FEMA public service announcement about that.
(SOUNDBITE OF FEMA PUBLIC SERVICE ANNOUNCEMENT)
UNIDENTIFIED ACTRESS: (As narrator) Wireless emergency alerts. Real-time information directly from local sources you know and trust. With the unique sound and vibration, you'll be in the know wherever you are.
KASTE: But who sends out the message in the event of a missile attack? If you ask the feds, they say it's not them. At FEMA, Mark Lucero is chief of engineering for the public alerting system which goes by the acronym IPAWS.
MARK LUCERO: FEMA will tell the states that there is a missile inbound and where it's going to land and to issue protective actions. Then the state will initiate any plans it has in place, one of which being issuing an alert to the public telling them what to do.
KASTE: And this is echoed by FEMA's national warning system manual. It says the feds notify state authorities and then, quote, "local authorities sound the attack warning signal on public warning devices." For this local official, that comes as a surprise.
FRANCISCO SANCHEZ: Military events are not something that we envision or have within the scope of our responsibilities to alert for.
KASTE: Francisco Sanchez is deputy emergency management coordinator in Harris County, Texas. That's the Houston area. He knows the national emergency alert system pretty well because he played a role in the system's recent upgrades, and yet until NPR contacted him, he did not realize that the feds expected these public missile warnings to come from local agencies like his. He says if that happened, they'd have to scramble.
SANCHEZ: Eighteen minutes before a missile gets here, who am I going to call at the DOD if I get that alert on my phone to verify this is real, we should re-share it? Who can I get confirmation and double confirmation from to make sure this is an authentic alert that isn't result of a hack or that isn't a mistake? By the time I do that, something's gone boom.
KASTE: And NPR got similar reactions from other emergency management agencies around the country. Some of them do have missile attack warnings and instructions ready to go, but others had assumed that those messages would be sent straight to the public from higher up. The feds do have the technical capacity to send out those warnings themselves, and Benjamin Krakauer says they should make it clear that they will. He's with New York City's Office of Emergency Management, and this is him speaking about this at a congressional hearing last week.
(SOUNDBITE OF ARCHIVED RECORDING)
BENJAMIN KRAKAUER: The federal government really is in the best position to detect a threat from a state actor and issue warnings initially to the general public. Time is of the essence, and state and local authorities are not really in the best position to make those notifications.
KASTE: The big irony here is that the false alarm happened in Hawaii because it's the unusual case of a state that was actually focusing on its responsibility to warn the public about missiles and was frequently practicing sending out those missile alerts - until one of them slipped out for real. As a result, Hawaii Senator Brian Schatz now says it's time to hand that job over to the federal government exclusively. He's introduced legislation to do that. But for the time being, warning the public about inbound missiles is still up to local and state officials, and more of them are now realizing that they need to be ready to send that message out.
Martin Kaste, NPR News. Transcript provided by NPR, Copyright NPR.