By now everyone's seen the screenshot going around, the one that says BALLISTIC MISSILE THREAT INBOUND TO HAWAII SEEK IMMEDIATE SHELTER THIS IS NOT A DRILL. I was making coffee on Saturday when a friend in Honolulu texted me a single word, "yeah," followed a minute later by "false alarm I think," which is not a great sequence of texts to receive before 9am on a weekend. It took 38 minutes for the official correction to go out. Thirty eight minutes is a long time to sit there wondering if you should be finding a basement.
Everybody's already writing the "can you believe this happened" post, so I'm not going to do that one. What I actually want to talk about is the interface, because once you start reading about how the alert actually got sent, this stops being a story about one guy having a bad morning and starts being a story about software design.
Here's what's been reported so far: the alert originated from an internal drill at Hawaii's Emergency Management Agency, where an employee was supposed to select something like "Test missile alert" from a menu and instead selected "Missile alert," the live one. There was reportedly a confirmation prompt, something like "are you sure you want to send this," and he clicked yes. That's it. That's the whole failure. Two menu items sitting next to each other with wording similar enough that a tired person running a routine drill could mix them up, backed by a confirm dialog that doesn't actually make you think twice, because confirm dialogs never do. We've all clicked "yes" on a popup out of pure muscle memory. I do it on my own laptop dismissing update prompts I don't even read.
This is a solved problem in interface design and it's been solved for decades. You don't put "delete everything" and "cancel" next to each other with identical styling. You make the dangerous option require something the easy option doesn't, a typed confirmation, a different color, a second person's sign-off, a cooldown timer, something. Nuclear launch procedures literally require two keys turned by two different people at the same time for exactly this reason, so it's a little wild that a state-level "tell 1.4 million people they're about to die" button apparently required one click from one person on a Saturday morning. I run a much lower-stakes system for a living, deploy scripts for personal projects mostly, and even I've built in an "are you REALLY sure, type the word DEPLOY to continue" step for the actions that can't be undone. If I've done it for a hobby project, a state emergency agency can do it for missile alerts.
And then there's the part of the story that's honestly funnier than it should be, in a grim way. Governor Ige apparently didn't correct the alert on Twitter sooner partly because he couldn't remember his Twitter password. Read that again. The governor of a US state, in the middle of what a lot of people genuinely believed was an incoming nuclear strike, was locked out of the account that could tell the public it wasn't real, because of a forgotten password. If that's not the most 2018 sentence I write all month I don't know what will be. It's a perfect little snapshot of how much critical communication has quietly migrated onto consumer platforms that were never built to be critical infrastructure, run through login systems that assume you'll remember your password or have your phone handy for 2FA, with no fallback plan for "what if the person in charge is locked out."
The FCC's opened an investigation, which is the right call. I don't think the employee who clicked the wrong option should be the main character of this story, though I get why he is one, since a name and a face are easier to be angry at than a menu design. But menus don't send themselves. Somebody built that dropdown, somebody approved that confirm dialog, somebody decided 38 minutes was an acceptable window for a correction to take. Those are the decisions I keep thinking about, three days later, more than the one click that got all the attention.