This Is Not a Drill: How a Dropdown Menu Terrified Hawaii

Thirty eight minutes

At 8:07 a.m. on January 13, 2018, Hawaii transmitted a false ballistic missile warning. The corrective wireless alert did not arrive until 8:45. The FCC's investigation describes confusion, fear, and people seeking shelter during that interval. Earlier corrections appeared through other channels, but they did not replace a correction on the channel that had delivered the warning.

A drill that crossed into production

The failure began with a drill whose recording mixed exercise language with a real-world warning. The operator believed a real attack was underway. The alert software placed live and test templates in the same menu, and one operator could send the warning without another person authorizing it.

There was a confirmation prompt. The problem was its generic wording: it did not clearly distinguish the live warning from a test. Describing this as an absent dialog misses the design failure. A confirmation only helps if it challenges the mistaken understanding that produced the action.

The missing recovery path

HI-EMA had not prepared a false-alert template or a sufficient procedure for promptly correcting an erroneous warning. Staff had to work out the correction while the alert was already circulating. The FCC identified inadequate safeguards, training and management controls alongside the mistaken interpretation of the drill.

The delay illustrates a separate operational requirement: the ability to initiate an emergency action is incomplete without a rehearsed way to correct it. A correction needs a prepared message, an owner, authorization rules and a tested delivery path. These must exist before an incident creates pressure to improvise them.

What the safeguards must do

The FCC report records changes including two-person authorization, a false-alert template, and work to distinguish live warnings from tests more clearly. Its recommendations address both training practices and software safeguards.

For systems with serious consequences, a confirmation should identify the action and its audience. Test and production paths should be unmistakable. A second authorized person should independently verify high-consequence actions, and the team should rehearse recovery as deliberately as initiation. Blaming one operator leaves all of those conditions in place.