So you accidentally told a million people they are going to die: What next? Your essential guide...

Hawaii's EMA – you’ve never seen crisis management quite like this

Analysis It's a common enough scenario: you are in charge of a critical piece of your company's computing infrastructure, and you make a simple mistake with far-reaching implications.

It could be a mail server misdirecting internal documents into journalists' inboxes, or a poorly configured border firewall. Perhaps you accidentally changed access permissions to a shared drive. It all happened so quickly, one mouse click, and now you and your department are being inundated with people demanding to know what happened.

What should you do? In the blur of such an event, it can be all too easy to make the wrong decisions, or even take the right actions but do them in the wrong order. When time is a critical factor, pressure can make it even harder to stay level headed.

Which is why we are all lucky to have reports on precisely what happened at the Hawaii Emergency Management Agency (EMA) – which earlier this month texted more than a million people on the US islands that ballistic missiles were about to rain down on their heads.

Those reports – one from the FCC and another from the state of Hawaii [PDF] – give a detailed blueprint for exactly how to handle such a crisis.

Their actions were exemplary and worthy of detailed study. We will break down the main points here in the hope that it can help serve in the event of your own emergency.

In the case of Hawaii's EMA, they faced a rather sticky situation: they had accidentally sent a phone alert to more than one million people telling them they would shortly die in a military attack, perhaps perishing in the radiant glow of a detonating thermonuclear device.

Not a great situation to be in, but one where clear thinking is essential to prevent things from getting worse.

So what's the first thing you should do? That's right: hand the problem to someone else.

Ass protection

The key to protecting your ass is to immediately inform the most important person you can quickly access outside of your department. It then becomes their problem.

So it was with EMA – the first call went to Hawaii's governor. The call went something like this.

"Hi Governor Ige, this is Bob from the Emergency Management Agency, we have a bit of an urgent situation."

"Hi Bob, what seems to be the problem?"

"Well, we just texted everyone a message that turns out not to be true."

"Everyone?"

"Yes, roughly one million people."

"Oh wow, ok, what did the message say?"

"Let me see… it said BALLISTIC MISSILE…"

"Sorry, do you mind not shouting?"

"Yes, sorry, it said: 'Ballistic missile threat inbound to Hawaii. Seek immediate shelter. This is not a drill.'"

"Oh I see. Not a drill, huh. WAIT… WHAT?!"

"Key takeaway here is: there is no missile. Anyway, lovely talking, David. All the best."

Work down the list

With that out the way, the EMA crack crisis management team hit the phones letting everyone of decreasing importance know what had happened. Start at the top and work your way down.

In this case, it was: the police; then the people that operate emergency sirens; then those in charge of the different counties. Then the TV and radio stations. But in a typical corporate situation that might be: CEO; head of security; anyone else in the IT department; then department heads; then your internal message board or Slack.

Once you have offloaded the problem, the next most important thing is to stop anyone else from bothering you. Most valuable in this case is social media: just post a message to your Facebook page or on Twitter stating succinctly what has happened. It doesn't matter if anyone sees it or not – so long as you put it out there, you can't be blamed for not letting everyone know.

What is important, however, is that you don't accept any sort of blame. In fact, if at all possible, imply that someone else was to blame and you are the one sorting out the mess. This will give some wiggle room later as well as allow you to ignore anyone asking questions until you've locked down a story. Any questions should be met with: "I'm too busy right now sorting this out."

The EMA really excelled in this respect. It posted the same message on both Twitter and Facebook: "No missile threat to Hawaii. False Alert. We're currently investigating." Textbook.

Ok, so the immediate crisis is over and you have some time to fix what the actual problem is. Do this as fast as you can while everyone is still saying "do you know what happened?" to one another over and over again. The faster the problem is fixed, the sooner you can focus your efforts on figuring out who or what to blame next.

Next page: Man vs machine



Biting the hand that feeds IT © 1998–2018