
It Was Bad UX, not a “Wrong Button” in Hawaii - zonotope
https://www.washingtonpost.com/news/morning-mix/wp/2018/01/16/that-was-no-wrong-button-in-hawaii-take-a-look/
======
nsxwolf
I think this whole thing could be seen as a blessing in disguise, but I don't
hear anyone talking about it. We seem totally unprepared for this kind of
event. The message said take shelter, so why were people running around
screaming and crying in the streets?

People were throwing their kids into storm drains. Clever, but what happens to
them after that?

Where do we go? How long do we have to stay there? Who is going to pass out
the iodine pills? Where's the clean water? What will we eat? Who will come get
us when it's all over?

It seems like we gave a damn about this many years ago during the Cold War.
There were drills in schools, public service messages, people bought bomb
shelters, there was the Civil Defense. Once in awhile I see one of those
public bomb shelter placards on a building and wonder if there really still is
one or if it is just some old artifact someone forgot to take down.

We laugh at all this stuff like ironic hipsters and now we see the results.

~~~
jklowden
No one stopped caring. What we stopped doing was pretending the civilian
population could be protected against nuclear holocaust.

The bomb that obliterated Hiroshima was a toy next to a thermonuclear bomb,
which is 1000 times as powerful. If one lands on Oahu, there won't be anyone
to pass out iodine pills in Hawaii, or anyone to pass them out to.

Hawaii is just stupid to spend a nickel on an early warning system. The only
reason it exists is that too many people don't understand what they're
supposedly being warned, or that they are utterly defenseless.

Sometimes, the only protection is prevention. This is one.

~~~
nsxwolf
Looking at NUKEMAP [1] and playing with Honolulu as a target using the various
weapons that are common to nuclear arsenals your claims just sound totally
false.

It seems like there would be a great chance of survivability in many areas if
one were properly sheltered. This doesn't even take into account that Oahu is
a mountain which would shield many inhabitants from the air blast.

I frankly am glad you are not in charge of the early warning system in Hawaii.

[1] [http://nuclearsecrecy.com/nukemap/](http://nuclearsecrecy.com/nukemap/)

~~~
bonesss
And to extend this hypothetical a little: the nuclear arsenal of people
attacking the US is not as good as the one _in_ the US.

Odds are anyone dumb enough to throw a nuke at the US is doing so with some
really cunning plan in mind hoping for retaliation, and doing so with a nuke
that's far from optimal. Russia and China are better served by eating up the
US economy (and government!), than balls-to-the-wall war, so it's more likely
an country that 'also has nukes' than the players with the real budgets.

------
Chaebixi
There was a _very_ similar incident in 1971 ("code word hatefulness"). Back
then, three tapes were kept next to a EBS transmitter, two real alerts and one
for testing. One day, an operator accidentally loaded the real alert rather
than the correct test alert, and many stations prepared to tell the country
the nuclear war was imminent.

The fix was to:

> …In the past three tapes, one for the test and two for actual emergencies,
> were hanging on three labeled hooks above the transmitter… In the future
> only the test tape will be left near the transmitter. The two emergency
> tapes [will be] be sealed in clearly marked envelopes and placed inside a
> nearby cabinet.

[http://conelrad.blogspot.com/2010/09/code-word-
hatefulness-g...](http://conelrad.blogspot.com/2010/09/code-word-hatefulness-
great-ebs-scare.html)

~~~
MaxBarraclough
That's a good example. Shockingly poor foresight.

It's similar to the "A gun is always loaded" principle. Unless you can tell at
a glance that a firearm is not in a ready-to-fire state, you treat it as if it
is. People are clumsy and forgetful, and you only have to mess up once.

Leaving the live rounds right next to the blanks, in that way, is pretty
indefensible. (Ignoring of course that blanks can still kill, for this
analogy.)

~~~
qbrass
>Unless you can tell at a glance that a firearm is not in a ready-to-fire
state, you treat it as if it is

That's when you need to treat it like it is the most.

~~~
MaxBarraclough
You'd really exercise more caution with a broken-open shotgun than a closed
one?

~~~
qbrass
Not more, but I wouldn't let my guard down just because it's playing dead.

------
igitur
The article is confusing. It states that the "errant employee actually was
working with a drop-down menu on a computer program". But the photo is clearly
of a list of normal "a href" elements.

I'm asking, because if it was truly a drop-down (select element) then the UX
would be even worse. At least with a list of links, there is the odd chance
that the person would spot the correct choice. Using drop-downs, once the
incorrect choice was made, there is really very little chance of realising the
error.

~~~
jpindar
I saw (on Twitter) another image that was a dropdown with choices such as
"Missile Alert" and "Test Missile Alert" right next to each other.

I don't know which image is real.

~~~
Shank
The one in the article is sourced as from HIEMA.

------
everdev
For all developers asked to design something or not given a design - CSS
padding is your friend.

Add spacing and then add more. It won't make it a masterpiece but it'll
prevent misclicks and make the UI easier to read and understand.

Also, use headings like "Amber Alerts", "Weather" and "War".

And, use semantic titles like "[TEST] Tsunami" or "ALERT! - Tsunami"

~~~
antonkm
If a developer were in a position to actually change this, the options should
be in separate lists, or even separate pages. If only CSS and HTML is
available, they should be in two columns.

The screenshots are so bad, not even the juniors I work with would consider
deploying this. It's mind boggling.

~~~
dhruvmittal
>The screenshots are so bad, not even the juniors I work with would consider
deploying this. It's mind boggling.

Not defending the UI too much but I'm imagining this is something built and
deployed on government contract in the late 90s or early 2000s (when it was
considered high technology that they could do this from a web page in the
first place?), occasionally migrated to whatever marginally newer system is
required by law while consuming the minimal amount of funding.

It's a damn shame but a lot of govt. stuff ends up in this exact boat because
nobody wants to pay to improve something that "already works."

~~~
antonkm
I think you're a bit off with the time frame. The system sends push
notifications to citizens in a specific area, or am I mistaken? Are these
texts?

~~~
slowhands
The Wireless Emergency Alerts system
([https://en.wikipedia.org/wiki/Wireless_Emergency_Alerts](https://en.wikipedia.org/wiki/Wireless_Emergency_Alerts))
dates back to 2006, but it is quite plausible that the backend this interface
controls predates that if it was originally a desktop interface for the
Emergency Broadcast/Emergency Alert System.

------
HarrietJones
A lot of conversations seem fixated on what's the worst that could happen if
the wrong message was sent, but very few of these people are considering
what's the worst that could happen if the right message wasn't sent. Also,
it's very likely that the dropdown message text was not added by a developer,
and this addition of the messages by non-technical users should also be part
of that UX conversation.

~~~
notjustanymike
Tsunami warning: Everyone seeks high ground.

Missile warning: Everyone flees to basements.

Right next to each other, no way that'll go wrong.

~~~
ourmandave
Apropos to nothing, the actual user experience between a Tsunami and a Nuke
are quite different.

~~~
ams6110
If the nuke is off target and lands in the water you could have both?

------
bovermyer
> Ige, in his speech, deplored the fact that employees of the emergency
> management agency were getting death threats since the events of Saturday.

Sounds like they need to prosecute some people for terroristic threats to the
fullest extent of the law.

I understand being pissed off about the false alarm, but sending death threats
should be an automatic jail sentence at minimum.

~~~
getpost
The state sent out a death threat! People are just letting the government know
how they feel.

The design of this system is grossly negligent, which IS a management problem.
It does look like a web page. How is the page served? An internal secure setup
on a private network? Is the browser ever updated? Is there javascript? The
number of failure modes on this type of setup is unconstrained. How are
updates tested? It appears to me that somebody just put something together
without any design or validation process at all. This is fine in many
settings, but not for critical public safety infrastructure.

~~~
mannykannot
A warning, whether mistaken or not, is not a death threat, and a death threat
is not just a complaint.

~~~
jaclaz
>A warning, whether mistaken or not, is not a death threat, and a death threat
is not just a complaint.

I don't think there is exactly the same crime in all the states of the US, but
there is in some states (as well as in many other countries) the crime of
"false public alarm".

Example, you start crying "Fire!" in a crowded cinema or public place:

[http://mollolawfirm.com/resources/criminal-law-
resources/fal...](http://mollolawfirm.com/resources/criminal-law-
resources/false-public-alarm/)

P.S.: Meantime in Japan:

[https://www.washingtonpost.com/world/asia_pacific/first-
hawa...](https://www.washingtonpost.com/world/asia_pacific/first-hawaii-now-
japan-sends-a-false-alarm-about-incoming-north-korean-
missile/2018/01/16/d8961ef4-fac1-11e7-b832-8c26844b74fb_story.html)

but this was not the governemnet, it was the NHK and they were very fast to
send a correct message.

~~~
kevindqc
There's a difference between crying "Fire!" to willingly cause panic over
nothing (ie: intent to cause harm), and a mistake...

Text from your first link even says that:

> A person is guilty of a crime of the third degree if he knowingly causes
> such false alarm [...]

~~~
jaclaz
>There's a difference between crying "Fire!" to willingly cause panic over
nothing (ie: intent to cause harm), and a mistake...

Sure there is a difference, but - again not all states/countries Laws are the
same - it may depend on who has to prove that it was a mistake.

And of course it may be classified as an actual crime or as a minor civil
infraction.

------
datpuz
The UX in most software made for the government is terrible. At the end of the
day, I think anyone clicking any button in that list should have been well
aware of what those buttons do especially since clicking that button was a
routine part of the shift change process in that shop.

Bad UX, sure. But that person dun goofed.

~~~
derekp7
Often times a web page will have buttons that dance around the screen, if the
page is still loading elements. That can cause misclicks too.

~~~
jpindar
I hates that so much, especially on mobile sites which load so slowly that a
miss click takes ages to recover from.

~~~
sokoloff
I don't think this is at all accidental.

------
HarrietJones
I've been "arguing" with people here as to what a better interface would look
like, and it's interesting at how much disagreement there is. A lot (like too
many) seem to think adding a yes/no dialog box would make things better, but
it's well known users don't read dialog boxes.

My preference would be a mcDonald's menu style UI, showing the text that will
be sent in a 6x5 grid of buttons. Easy to press; easy to see what you're
sending; no funky "are you sure" messages that'll be auto-clicked.

~~~
kemitche
It doesn't even need that. It should start by grouping the options by severity
- separate the real alerts from the test alerts via section headers and you
solve 99% of the problem.

~~~
HarrietJones
My concern with severity groups is you have users and managers deciding which
messages go in which severity groups. That ignores the impact of politics and
short termism on the decision making process. (e.g. How severe is a missing
child?). Before you know it, everything will be in severe, and your users will
be asking for a "really, really severe" category.

~~~
james-mcelwain
Makes sense, but I would hope even the most inept manager could recognize that
"AMBER Alert" and "Nuclear Annihilation Imminent" are different degrees of
severity.

------
turc1656
This doesn't add up for me and doesn't pass the smell test. Looking at that
dashboard and the way it's set up and knowing PACOM stands for Pacific
Command, I'm not buying this story at all. Look at the way that screen is
designed. You don't just click one of those and it sends the alert off. The
link sets the type of alert (i.e. Amber) and the destination/recipients (i.e
county, statewide, etc.). It doesn't set the content. Logically, this must be
true. An amber alert needs specifics like, most commonly, the license plate of
a vehicle. That means someone clicked that link and then manually filled out
the text _" this is not a drill"_. That makes this peculiar sentence from the
article make more sense - _" I wish I could say there was a simple reason for
why it took so long to get the correction to the false alert out"_. That line
from the article struck me as odd the first time around, especially since no
explanation at all was offered from what I saw. I believe they really thought
there were incoming missiles and that's why they didn't rescind the alert
immediately. Let's also remember that when this alert went out the person who
sent it as well as anyone else working with them would have received it on
their own phones and someone surely would have said "holy shit you just sent
out a real nuclear war alert!" And then they would have gone back and filled
out different text/content for an updated alert. There is precisely zero
chance it took 38 whole minutes for everyone in that place to realize it was a
real alert and figure out how to send a follow up.

~~~
ghostly_s
It's possible the test procedure does send an authentic-looking alert to the
devices of staff at this facility? Even in that case I would think their
phones would be ringing off the phone in seconds with incoming calls from
loved ones wondering what the hell is going on...

~~~
turc1656
Exactly. No matter what, they would have been contacted by the outside world,
probably directly by Admiral Harris (the commander of the Pacific Fleet). 38
minutes makes no sense at all unless they were really trying to figure out if
they were under attack or not.

They probably viewed this admission of error as being less embarrassing as not
knowing that they weren't under attack when Japan released a statement within
a few minutes saying it wasn't true. They look even more incompetent in that
scenario.

------
heavenlyblue
Bad UX? There's no UX at all (and on that matter - please stop selling your UX
position to companies).

~~~
Bahamut
Every software users interact with has a particular UX. It’s in the words it
stands for!

------
soapdude
Did anybody read about or see the NBC segment where they were exploring the
exact D.O.D. bunker in Hawaii where the emergency phone, and I assume alert
system computer, were held. Did this actually happen? Was NBC actually in the
same room as the computer where the alert originated before the alert actually
was sent out?

Let me know if I'm being misinformed by low-life YouTube conspirators.

------
nsxwolf
Why are we talking about dropdown boxes and modal confirm messages? Shouldn't
it be basically impossible for the same system that sends test messages to
also send real messages?

If it takes two people turning two keys to launch a missile, shouldn't it take
the same to send a missile warning?

~~~
theandrewbailey
> If it takes two people turning two keys to launch a missile, shouldn't it
> take the same to send a missile warning?

Hell no. A missile launch involves a large expenditure of resources, and
(sometimes) lots of destruction. A missile warning should not.

------
jack6e
In some ways I think the poor design decisions start with making a system of
this nature, with this purpose, digital in the first place. With the current
state of weapons systems, multi-domain tactics, and the technical capabilities
of near-peer rivals, or the types of state actors capable of launching a
ballistic missile, a massive cyber/electronic attack will almost certainly
precede the kinetic weapons wave. Really, I would want a ballistic missile
warning system to be as simple, physical, and reliable as, literally, a big
button that sets off the warning broadcast over loudspeakers. It is impossible
to prepare for every contingency that may arise from an unexpected all-out
attack, but the obvious ones with clear solutions should be mitigated.

------
Rudism
Their solution to the problem was to add an additional "BDM False Alarm" entry
to the list of alerts which will send out the message that the previous alert
was a false alarm and there is no threat.

Perhaps they should also add a "false alarm that this was a false alarm, there
really is a threat after all" option in case the "false alarm" option is
selected accidentally after warning about a real threat. /s

I don't know how anyone in Hawaii can be expected to trust or take these
alerts seriously after this.

------
Overtonwindow
Could be both. The UI looks like a home-built web 1.0 page from 2001.

~~~
masswerk
No, it's mobile first... ;-)

------
AtTheLast
Adding some color and better labeling would be good. Also I would have a
confirmation dialog box to confirm what will happen when the button is
pressed.

------
nolo
Taking the opposite side side of the argument, good UX only matters for
inexperienced employees. People that mindlessly click are going to mindlessly
click "yes" on the confirmation dialog

~~~
yoz-y
Experienced employees will not mindlessly click on Yes, because they have
experience with it going wrong.

Having yes/no labels on buttons, or this kind of random labeled links in
haphazard order is always bad. Experienced users may not do errors, but their
life would still be better if the UX was good. UX is the same as
accessibility, if it is good it does not bother you but it can always help,
even if you think you do not need it.

------
dsjoerg
At _each_ level, people with grave responsibilities did not take their
responsibility seriously enough. From the top to the bottom.

Button-pusher: obviously.

Interface designer: clearly.

Manager responsible for project: also

The manager's manager: yes

The whole department head: how is this person making decisions?

The people who set the budgets and procedures: How do they know that work is
being done well enough?

Vern Miyagi: From decades in the army, your process designers should
understand best practices in the design of emergency systems, and yet they
clearly did not. Why?

Arthur "Joe" Logan: Same question.

Ironically [http://dod.hawaii.gov/hiema/hawaii-emergency-management-
agen...](http://dod.hawaii.gov/hiema/hawaii-emergency-management-agency-
statement-on-missile-launch-false-alarm-january-13-2018/) fails with a
Javascript error about "superclick is not a function".

Anyway it goes all the way up, apparently through the military chain of
command. So I say Thanks Obama.

~~~
abakker
What? I think you need to balance your list's narrative with the reality that
delegation includes some abdication of understanding. It is necessarily an
abstraction from the work itself. While responsibility may lie with a superior
for the error itself and the process that gave rise to it, it is a
responsibility of seniority - owning the outcomes of the organization you run
- not responsibility for the act itself.

Moreover, there is another dimension in that inertia in the org structure
itself can't be pinned on any one person. Organizations by their very nature
are supposed to be tolerant of changes and gaps in the knowledge of their
members. This tolerance leads to inertia. the Inertia of the military is
extreme and difficult to change. The more abstraction between the leader and
the actual work, the more difficult it is to evaluate and enact the right
change in the right way in the right timeframe.

So, while your comment may in essence be right that there is a chain of
command failure around this issue, it also strains credibility to claim that
this failure belongs to Obama, one year into his successor's presidency, when
the structure that this event took place in is much older than either of them.

