- Corporate Security
- Governance, Risk & Compliance
- Information Security
Governance, Risk and Compliance
By Resolver Modified February 7, 2021
On our latest episode of The Watchdog, our hosts sat down to talk with Michael Gonzalez, Operation Iraqi Freedom veteran and senior physical IT systems administrator at a large utilities company in Hawaii, to talk about his experience during the recent Hawaii false nuclear missile alert. We have the full interview for you here:
Yeah, it was about 8:03 in the morning when I got the alert on my iPhone. My girlfriend got it at the same time, so we had our phones sitting on opposite bedside tables and we both woke up to a start, thinking it was probably a flash-flood. We looked outside and saw that it was sunny and not raining, so I grabbed my phone. I looked at it and read the message: [“Emergency alert, ballistic missile threat inbound to Hawaii. Seek immediate shelter. This is not a drill.”]. My girlfriend and I both looked at each other, kind of in disbelief, and we got up and walked to the living room. I turned on the television and everything was normal. Business as usual, which kind of threw me off. Next thing I did was track down my kids.
Oh, absolutely. There was no reason to think that this was not real other than the fact that the alert wasn’t being broadcast on all the different forms of media at that particular moment. I already knew the minute I read it that I had 15 minutes and the clock was ticking.
It takes about 20 minutes for a missile to get from North Korea to Hawaii, and it takes about 5 minutes for the military to identify the launch, calculate the trajectory and make an estimate of where it’s actually going. By the time they tell us, we have about 15 minutes until impact. Both of my kids were in different places, and they were both at least 30 minutes away. There was no way I was going to get to either one of them, which was not ideal, obviously. I gave both of my daughters instructions, based on my knowledge of where they were. I told them where to go, where there was a concrete bunker or where there was some sort of protection. Told them to get some wet towels and put them under the cracks in the doors and not to come out unless it was me on the other side of that door yelling for them.
Then we said our goodbyes. I told them I loved them, got off the phone, called my parents, and then called my security operations center [at the utilities company]. I let them know that until we figure out what’s going on anybody can leave [the building], but only essential personnel are allowed in. As soon as I hung up the phone, thinking, “Whoa, this is really strange, there are no other alerts happening,” all of the channels flashed to the emergency alert warning. Then the audible sirens at Pearl Harbor, which I can see from my porch went off, saying, “Ballistic missile approaching, seek immediate shelter.” That’s when it got very, very real.
The timing of [the alert] is what freaked me out the most actually. The first week of December, I was contacted by the FBI and they brought me in for weapons of mass destruction first responder training. I took that class on December 6th. That was fresh in my mind, when we got the missile drill, so I had a pretty good idea of what to expect. I also had a pretty good understanding that there was absolutely nowhere for me to go.
It seemed that a lot of people turned to social media, mostly Twitter, for verification. Were you checking on Twitter for updates or for more information?
I was looking at basically any feed where I could get in touch with somebody who knew what was going on. I had a person who used to work in our security operations center who now works in the state civil defense and she actually knows the person who [triggered the alert]. She was one of the people that also texted me and said, “This is not real.” But I kept thinking, “Well, how come I’m hearing it from all these people and not from anybody official?”
Apparently, there is no real protocol to pull something like this back once it’s out of the bottle.
Had you received this alert or any other test alerts before? Was it something familiar to you and everybody else in Hawaii?
They had not tested the push alert to cell phones. That hadn’t been tested, as far as I’m aware. They did test the audible sirens on the first of the month, and that sounded very different than tsunami warnings or anything else. It was very eerie when they tested it the first time, everybody kind of just stopped what they were doing. I think I was in downtown Honolulu at the time, in between meetings. Everybody just stopped, and you could see the look on their faces… Even though we knew that it was coming, and we knew that it was a test, it was just eerie, because it’s not something that anybody has heard for a very long time.
Was it communicated to people that that was going to be happening, or were people literally just hearing it and not knowing what was going on?
For the most part, it was on the news and it was in the newspaper. There were some broadcasts on the radio, but I’m sure there were people that had no idea what it was. I follow the news pretty closely so I was expecting it. Not everybody was, clearly.
Has the Hawaiian government now recognized a necessity to step up in preparedness so when people do get a nuclear alert message, that they know how to take shelter, and they know where to look for verification? Has any of that changed in Hawaii?
Not really. Most of what came out of this is were hearings with the Governor and the administrators for Hawaii emergency management and a press conference that was not very useful. Let’s just put it that way – it was a lot of excuses and various explanations on how this happened, yet there was not a whole lot of information given as far as what to do in a real situation. I didn’t see a lot [of information about this] coming out of the government but I did see a lot coming out of the media afterwards, saying, “Hey, this happened and by the way, if it was real, this is what you should do.” It gave some suggestions, but in Hawaii, we don’t really have fallout shelters and our houses don’t have basements. Very few have them. There aren’t a whole lot of places to go.
It was really sad to see some of the things on the internet shortly after this drill and even on the news. I saw a clip of a guy who uncovered a storm drain and it showed him lowering his small children, five to six years old down into this hole, thinking that they were going to die. It was heartbreaking to watch.
When you hear that the responsible parties are between a rock and a hard place, need to find a better way to get these notifications out, don’t know how they’re going to do it, that there are all these challenges in the way, etc. – as someone who’s now walked through this false alert scenario, is that satisfactory? Is that an okay answer given what just happened?
It’s hard to say what’s an okay answer in a scenario like this, because people are going to have wildly varying reactions to what’s going on and varying needs as to what kind of information they need. Some people will freak out no matter how much information they’re given and some people, even with all the notifications, may not even know what’s going on. I talked to lots of people who slept through this entire thing and woke up afterwards to find out that they just missed the world almost ending and they were very surprised and upset to know that they could have slept through that.
It really just depends on the person, I guess.
Do you think that the situation will be different if this alert message comes through again? Has this experience eroded your confidence in whether it’s the real deal?
I think that the next time I’m going to be a little bit more suspicious right off the bat. If I see a message like that and I flip on the T.V. and it’s not happening everywhere, I’m going to automatically assume it’s a false alarm again. The expectation is that you get the notification on every conceivable media, right? In a real event, you would expect that it would be simultaneous. I think a big part of the problem here was that when they pushed out the alerts, they canceled it mid-stream, so it didn’t go out to all carriers, which caused even more confusion. It would have been a lot better if they could have pushed out an alert to all carriers and then pushed out a retraction immediately to all carriers and figured out the rest later. That would have calmed a lot of people down.
I think that’s what Japan got right –they understood the need to retract [the message] as soon as possible and sent a notification through all the [channels] that the first notification was sent through to rescind it. People can get hurt, you know? I think there was something like 16 accidents in that 15 minutes on the freeway, because people were going well over 100 mph to get wherever they needed to go. People were running traffic lights, everything. It was pretty crazy for a minute there.
Turned into a kind of free-for-all. Our reputation in Hawaii is to not really be in a big hurry and to not get excited about too many things. I think that we probably had a more mellow experience than a lot of states may have had if they had been in our position, just because of the nature of how people are over here. The accepting nature that there is absolutely nothing that we can do about it. A lot of people just accepting their fate, which was weird to watch.
You mentioned, prior to this, one of the things that impressed you during this whole debacle was that your security team didn’t drop the ball and run away and leave everything for sudden death. They actually stood by their post, locked down what they had to and did their job. Can you tell us a little bit about that?
Yeah. I was at home and I called our security operations center and [the employee on duty] was very calm. He said he got the alert, he saw it on the T.V., he saw it on his web alerts, he got it on the phone, and so he checked in with all of his people [on duty]. We had well over a dozen people on duty at that time in various places and everybody did exactly what they were supposed to do. They locked down their gates, anybody who wanted to leave could leave, nobody was coming back in unless they were essential personnel. Everybody handled it very professionally, and I’m very grateful for that because that could have gone very badly.
Has there been something big you learned here? Did you dig your own basement?
Well, we can only be so prepared for an event like this. It really got me thinking about my own security operations center and thinking through our designs and if somebody can click through multiple warnings and do something like this. It’s a lot easier to do when there’s less impactful situations. I looked at my own user interfaces and our security operations center and I looked at the best practices that we had going on. The Hawaii Emergency Management Agency was one of the first [agencies] to get this missile warning back up and running after the Cold War, and with that comes a lot of responsibility. It seems to me like they got caught off guard or didn’t fully appreciate the impact that something like this would have.
I saw an interview by pure coincidence—I think it was MSNBC who was actually in the state civil defense office interviewing people [from the agency] a couple of days before this incident. When you look back at the recording of those interviews, one of the things that popped up was the password for the computer that controls these alerts was on a sticky note on the monitor in the background while this guy was being interviewed. You could clearly read it.
Not only could you get into that computer and into that network with that password, you could prevent a real alert from going out, for example. Things like that, they really need to pay attention to and lock down, because when you’re playing at this level, you can’t afford to be making stupid mistakes. It really drove home for me the need to go and re-evaluate all the things that we’re doing and just not be those guys.
I will tell you one thing I was very impressed about was Vern Miyagi. He was a major general in the national guard and [at the time of the alert], he [was] the administrator for emergency management [at the Hawaii Emergency Management Agency]. Moments after this happened, there was a press conference and the reporters were out for blood. They wanted to know who did this, what was going to happen to him, what kind of discipline there was going to be, and they wanted to hold somebody accountable. Vern Miyagi looked at the camera and said, “If you want to hold somebody accountable, it’s me.” He spelled out his name. They asked him, “Well, where were you, what were you doing?” He said, “I was at home and I was asleep, but it’s on me.” I have a lot of respect for the man for that.
Are there any last things you want to throw out to our audience?
Hopefully we can all learn from [this experience] so it doesn’t have to happen to anybody else. We are kind of on our own out in the middle of the ocean, here [in Hawaii], and there’s only a million people in this state. To think of this happening in somewhere like California or another state with millions and millions of people, the possibility for people to get injured and for things to go very wrong when you’re dealing with that many panicking people [is much higher]. So hopefully we can all learn from this and keep it from ever happening again.