• United States



Hitting the ‘wrong button’ pushed out false ballistic missile alert to Hawaii

Jan 14, 20184 mins

Oops, emergency warning about the coming apocalypse was a false alarm.


That emergency alert was pushed out to mobile phones on Saturday morning in Hawaii; the warning also went out on TV and radio.

Panicked people took shelter, some reportedly making tearful ‘goodbye’ calls to loved ones, waiting for the missile to hit. After all, North Korea and the madman who runs it was not that far away. They waited and then waited some more; in fact, they waited for 38 minutes before a second emergency alert warning pushed out to phones informed them that the first was a false alarm.

Was the Emergency Alert System (EAS) hacked again? EAS has long been considered vulnerable to remote attacks. It’s happened before; but unlike a zombie apocalypse warning that likely didn’t cause most folks to think they were about to die, thinking a nuke missile was to hit the island would cause widespread fear.

Yet, it wasn’t a hack; it was an oops as in someone hit the wrong button. Hawaii Gov. David Ige told CNN, “It was a mistake made during a standard procedure at the changeover of a shift, and an employee pushed the wrong button.”

People went from terrified to ticked. Hawaii Sen. Brian Schatz tweeted:

According to FCC chairman Ajit Pai:

Had a person awaiting the missile strike been on social media sites like Twitter or Facebook, then they might have seen statements about the false alarm.

Some people were online, trying to stay informed, but surely not everyone would spend what might have been the last moments of their lives on Facebook? It is a travesty that the warning was blasted out as well as the fact that 38 minutes was “the lapse time before we could get a message correcting the error out on the phone platform.”

Gov. Ige added that the testing of all emergency alerts has been suspended pending a more thorough review. The process of sending the alerts will also be changed so that it will require two people authentication before an alert is pushed out.

The Hawaii Emergency Management Agency released a timeline (pdf) of what occurred:

Approx. 8:05 a.m. – A routine internal test during a shift change was initiated. This was a test that involved the Emergency Alert System, the Wireless Emergency Alert, but no warning sirens.

8:07 a.m. – A warning test was triggered statewide by the State Warning Point, HI-EMA.

8:10 a.m. – State Adjutant Maj. Gen. Joe Logan, validated with the U.S. Pacific Command that there was no missile launch.

Honolulu Police Department notified of the false alarm by HI-EMA.

8:13 a.m. – State Warning Point issues a cancellation of the Civil Danger Warning Message. This would have prevented the initial alert from being rebroadcast to phones that may not have received it yet. For instance, if a phone was not on at 8:07 a.m., if someone was out of range and has since came into cell coverage (Hikers, Mariners, etc.) and/or people getting off a plane.

8:20 a.m. – HI-EMA issues public notification of cancellation via their Facebook and Twitter accounts.

8:24 a.m. – Governor Ige retweets HI-EMA’s cancellation notice.

8:30 a.m. – Governor posts cancellation notification to his Facebook page.

8:45 a.m. – After getting authorization from FEMA Integral Public Alert and Warning System, HIEMA issued a “Civil Emergency Message” remotely.

The following action was executed by the Emergency Alert System (EAS):

1. EAS message over Local TV/Radio Audio Broadcast & Television Crawler Banner.

“False Alarm. There is no missile threat to Hawaii.”

“False Alarm. There is no missile threat or danger to the State of Hawaii. Repeat. There is no missile threat or danger to the State of Hawaii. False Alarm.”

2. Wireless Emergency Alert (WEA)

“False Alarm. There is no missile threat or danger to the State of Hawaii.”

9:30 a.m. – Governor makes initial media notification.

9:34 a.m. – Governor’s message posted to his Facebook and Twitter accounts.

A preliminary report will be issued next week. Hi-EMA added a cancellation command which can be done automatically, so any erroneous alert issued can be cancelled within seconds, instead of 38 minutes.

ms smith

Ms. Smith (not her real name) is a freelance writer and programmer with a special and somewhat personal interest in IT privacy and security issues. She focuses on the unique challenges of maintaining privacy and security, both for individuals and enterprises. She has worked as a journalist and has also penned many technical papers and guides covering various technologies. Smith is herself a self-described privacy and security freak.