“THIS IS NOT A DRILL.” Nor was it a false alarm. We have a real problem with emergency management systems in America and if we don’t fix it soon, we’re not going to need an enemy to inflict major damage to our society. We’re going to do it ourselves.
Saturday’s emergency-system-gone-haywire incident should have sounded familiar. Where have you heard something like this before? Oh yea, that night in April when warning sirens blared most of Dallas out of bed. Or perhaps you heard about that false tsunami alert that was issued on the Oregon coast last month.
The Dallas and Oregon incidents can’t hold a candle to what happened in Hawaii this weekend, however. Here are real people reacting to the text message that told them they might die in 15 minutes, courtesy of Honolulu Civil Beat’s Facebook page.
“Wife and I at kuakini doing blood tests, got down to the basement with some other hospital workers. We all shared phones that had signal and called our loved ones.”
“I’m so upset! I nearly had a heart attack! 9/11 again! I have no cement building to go to. I texted my family I loved them and grabbed my emergency bag and purse and hunkered in my shower!!
“We picked up our grandson 4 blocks away so we could die together.”
That was Saturday’s story however. And it was in a place that was far, far away. We’ve moved on, right?
Not so fast. Let’s go back to Dallas for a moment. That incident was “funny.” Hackers wormed their way into the disaster warning system of a major U.S. city and wreaked havoc for hours, triggering sirens designed to warn the population about incoming tornadoes and the like. The incident caused serious problems for Dallas. More than 4,400 911 calls were received from 11:30 p.m. to 3 a.m., that night, the city said. About 800 came right after midnight, causing wait times of six minutes. It was essentially a denial of service attack on emergency services.
In the Dallas incident, the emergency systems were managed by — it’s true — a furniture moving company from Michigan named West Shore Services. The firm is paid about $100,000 annually to make sure the system works.
A reader at the time wrote in to say that while he had no specific knowledge of the Dallas system, he knew that many such systems rely simply on the use of a particular telephone-like tones to trigger the sirens.
“It would only take a radio scanner and a recorder to once capture the tone signaling, and then recreate it on a cheap VHF hand-held radio, which explains why Dallas has asked for FCC help,” he wrote. That’s…fragile.
And what did we learn from Hawaii? An employee accidentally pushed a wrong button, causing the warning incident there. That’s a single point of failure which reveals an incredibly fragile system. Worse yet, while the mistake was easy to make. it took 38 minutes to fix it. Bad design on both sides.
False alarms are the real fake news. And they are really dangerous. People who study these things know that single points of failure create incredible opportunities for hackers or those who would do us harm. Imagine someone combining a takeover of the SMS warning systems and sirens simultaneously? Add in the resulting traffic jam of 911 services and you could have a real-world disaster on your hands.
Writing two days after Dallas, I said this:
“It’s 48 hours after a major U.S. city had its sirens blaring all night long. Are you hearing about federal investigations? Are you hearing about executive orders around critical infrastructure? (You did. But then, you didn’t.)”
And, here we are again. It’s 48 hours after Hawaii. A single employee has reassigned; but as a wise editor once told me, no one person can make a mistake like this: it takes a team. The design was bad, the fallback was bad, the incident response was bad.
As always, this mistake creates an opportunity. Not just for Hawaii, of course, but for all emergency systems in the U.S. They need a 21st Century upgrade, and fast. Hawaii, as it has before, took a bullet for the mainland U.S. But will we listen? Will we honor the suffering we put Hawaii through? Or will fail to learn the lessons of the fake missile alert? Will we ever learn?