Hawaii "button pusher" refusing to cooperate with FCC, internal investigators | Hacker News Reader

Hawaii "button pusher" refusing to cooperate with FCC, internal investigators

staradvertiser.com

125 pointsmysterypie101 comments

Great, this is why we have a constitution and bill of rights - he has no legal obligation to speak to them, and of course, if by accident he said something that was incorrect (“I had tuna for lunch” when he actually had salmon) he would be guilty of breaking a federal law, “lying to a federal officer”.

Useful background info: “Don’t talk to the police” video from a law school class https://youtu.be/d-7o9xYp7eE

It seems like the speaker in the video is on stimulants

He could just be like that. He's got a bit of a carnival barker quality to him. Not that carnies don't love their cross tops.

> Great, this is why we have a constitution and bill of rights - he has no legal obligation to speak to them

That's not at all true. Now, it may be true that it is not a crime not to speak to them, it almost certainly is a legal obligation attached to his employment and he quite likely will be fired for cause if he continues to stonewall.

Sounds like he will be fired anyway. At least stonewalling may prevent any criminal action against him.

Weird, but really shouldn't almost the entire focus be on the terrible design and the people responsible for it in the first place? Why does Miyagi still have his job? Unless the "button pusher" was also the developer I don't see what having him cooperate really accomplishes. I think we all generally know what he did. He clicked the wrong thing. This was practically an eventuality.

The focus is surely going to be on finding a scapegoat to blame quickly and coming up with a story that the public can understand that makes this all that scapegoat's fault. The scapegoat will not have the word "manager" in his title. The button pusher should be only talking to his union rep and/or lawyer at this point.

Everyone "in the know" already knows HI-EMA has incompetent management because such a bad user interface was allowed to be in use. This hunt for a scapegoat just sends a signal that the management also has no intention to improve themselves.

Like Abu Ghraib before the Bush torture memos were leaked. It's easy to convict people without power, everyone else keeps doing what they've always been doing.

> I think we all generally know what he did.

We all know stories about what appeared to or was claimed to have happened that reached the media through official and unofficial channels before any internal investigation.

Hmmm, so you think it's possible that the UI was designed with the proper checks and the government officials in charge have decided not to correct the public narrative because...?

...Because "HEMA can’t publicize the actual screen because of security concerns — the system could then then be vulnerable to hackers"

http://www.civilbeat.org/2018/01/hawaii-distributed-phony-im...

(Quite a load of BS, that statement.)

My adblocker makes that page show nothing. Your article is perhaps related:

http://www.businessinsider.com/hawaii-emergency-agency-passw...

I think its quite likely there are system design, procedural, and other problems with both how the alert happened and how it remained uncorrected for as long as it did that have not been revealed yet; the reasons they haven't been probably involves a mixture of people not interested in exposing their own failings (and those people certainly have an incentive not to correct the public narrative) and even the involved people not individually being aware of the whole picture and no one having yet put all the pieces together.

I suspect that the picture of the UI problem that has become public is likely accurate as far as it goes, but is also far from a complete picture.

>...really shouldn't almost the entire focus be on the terrible design and the people responsible for it in the first place?

I was just thinking that!

I can just imagine (in my own head, of course) that this guy has been banging pots and pans talking to executives and those above him to set aside the time and/or budget to fix the terribly archaic and sensitive system. Now he's sitting there looking guilty as possible and his only way out is to throw everyone who ignored him under the bus.

Why do I assume that things are this way? I feel like I've dealt with 20-30 different situations like this in my ~12 years programming and of course they were WAY smaller in comparison but there is no "clean way out". Feelings are going to get hurt and the work place's fabric could be torn to shreds. Nobody wants to be responsible for that.

That’s just bad leadership. Leadership is about taking responsibility. “Here’s what happened, here’s what we learned, and here’s what we’re doing to make sure it doesn’t happen again.” It’s doesn’t have to end badly for anyone.

Sure, but they probably want to know who was in the room with him, what was their reaction, what was his reaction, did they realize anything was immediately wrong? did they know who to contact? etc...

If an air traffic controller was involved in a plane crash in a non-culpable manner, I'm sure people would feel very strongly that he should cooperate with investigators. Why is this situation different?

Air crash investigations cannot be used in court

I've never heard of this before. Do you know what law or precedent establishes this?

49 C.F.R. § 835.2

> Pursuant to section 701(e) of the Federal Aviation Act of 1958 (FA Act), and section 304(c) of the Independent Safety Board Act of 1974 ( 49 U.S.C. 1154(b)) (Safety Act), no part of a Board accident report may be admitted as evidence or used in any suit or action for damages growing out of any matter mentioned in such reports.

https://www.law.cornell.edu/cfr/text/49/835.2

You may also want to read more about how we got here, too:

http://www.aircraftbuilders.com/files/2716/File/lr2000d.pdf

I would like to know why it was established.

From the link in basseq's response to my question: "The investigations are meant to be litigation neutral in order to promote impartiality and foster cooperation so that the NTSB’s mission of finding the cause of an accident can be accomplished in order to prevent similar ones from occurring."

Crucially, the National Transportation Safety Board's purpose is to make safety recommendations, not to enforce law.

That sounds like one of the best uses of public funds today.

I think that's what the law should be. Identify why something failed as opposed to trying to figure out who to punish.

This should be done in more places like hospitals and even the police

Comrad buttonpusher implicated himself as guilty before the bureaucrazy and promised to better himself in a camp through self-reinforced labour and reconditioning. "All hail mother UsSiA!" was his final statement. Seriously the guy shouldnt have said a thing at first. His bosses bailed on him, he realized to late that he was a blame sock puppet on the frontlines between federal law and local law.

The whole society is getting short-changed by the idiots trying to make a sacrificial goat out of her/him. Anybody who doesn't understand why s/he doesn't talk, should read Sydney Dekker's books (in particular, "Just Culture -- Restoring Trust and Accountability in your Organisation"). We need the NTSB to do the investigation, they are non-blaming and serious professionals concerned about the FUTURE not the PAST -- i.e. making sure it doesn't happen again.

I seriously want to give a hug to the person who mis-clicked. If you have seen that UX design, you know as well as anyone else, that indeed, most would have mis-clicked over time.

The people investigating this are making a huge mistake.

If they want a sacrificial goat, take a look at the people who both commissioned and developed that terrible user interface. I saw it on Twitter. It wasn't much better than that Far Side cartoon that put "Wings Fall Off" next to the backrest button on an airplane seat.

Yes, but what's easier to lay the blame on - the expensive system that the government commissioned and will have to publicly say isn't good enough (and thus need to commit to spending money on improving it), or the cheap contract employee who can be summarily fired.

I don't blame the guy for not talking any more - he's (rightly) scared of being crucified for misclicking.

He's an exempt member of a union, not a contractor.

This is exactly why the NTSB was created. They need people to tell the truth to understand why accidents occur. Pilot here. When the FAA calls you lawyer up. When NTSB call you talk like normal people.

Any investigator is going to be on a headhunt.

The smart move is to stfu, call your union representative, and don’t talk to the police until your lawyer makes the appropriate arrangements.

And what is there to say, really? "I clicked the wrong thing." The reason why that was likely to happen is blatantly obvious to anyone who has seen the screenshots of the interface.

Edit: And STFU is smart advice in any situation where there is even a remote chance you will be charged with something. You can always make a careful statement later on advice of counsel. Nothing is lost by remaining quiet at first.

For anyone who missed it: https://twitter.com/CivilBeat/status/953127542050795520

A "mockup" AKA Fake UI.

See

http://www.civilbeat.org/2018/01/hawaii-distributed-phony-im...

Have we actually seen the real interface? There was the first round, which was a mockup many were told was a 'screenshot', and a follow up that was a second mock up that was closer.

http://www.civilbeat.org/2018/01/hawaii-distributed-phony-im...

It's a common enough UI issue to be immediately clear to a professional how it happened though.

"HEMA can’t publicize the actual screen because of security concerns — the system could then then be vulnerable to hackers, Rapoza said."

The level of incompetence is astounding!

It's unreal.

> “We asked (Hawaii Emergency Management Agency) for a screenshot and that’s what they gave us,” Ige [Hawaii Governor] spokeswoman Jodi Leong told Civil Beat on Tuesday. “At no time did anybody tell me it wasn’t a screenshot.”

So the governor asked for a screenshot and they sent him a "mockup" instead of the actual interface?

I can only assume the actual interface was somehow even worse than the fake.

Given all of the incompetency here, including the awful UI, and the password on a sticky note that got leaked, I wouldn't be surprised if the links themselves leaked info like: "Send missile alert (confirmation password is hawaii1)".

Not claiming they are competent. However it may be the case that the real screenshot would be exactly as shown, but also includes few extra lines of "buttons" that have captions not meant for public audience. This ban may be coming from federal level. Or reveal they are using IE5 or something. Just a far-fetched theory.

However, I'd still stand with Peter here [1] and think they just could not get the "screenshot tool" installed to the machine.

[1] https://en.m.wikipedia.org/wiki/Peter_principle

Everyone is talking about interfaces and clicks. Yeah, we know he clicked the wrong item. I'd be interested to know if there was a paper manual sitting on his desk with procedure instructions for this type of situation and whether or not his mistake was either not following the procedure or following it incorrectly. For all we know, there could be a control to avoid a false alert, even given a shitty interface, that should have been followed.

Wow, that link just loads a solid white page if you have JS disabled. It even scrolls, presumably, across the actual length of the content.

Amazing.

Given that the federal and state authorities are making this public, STFU was a smart move.

at this point it is also perfectly reasonable to conclude that the wrong thing was NOT clicked as there could be another source of error

> And what is there to say, really? "I clicked the wrong thing."

There are many things say. That's probably why they want to talk to him. Was it a random mistake? Did anything else contribute? Was he on Hacker News writing a comment at the time? Was he tired, sick, under the influence? There were other people including a supervisor, did the supervisor approve, did they double check later? Did they distract him somehow?

They might conclude it was the stupid user interface but they'll still do the legwork of investigating and getting all the details. One thing they definitely don't want to do is answer the question of "Did you try to talk to the individual?" or "Nah, we saw online how everyone was jumping on redesigning the UI and assumed it had to be that so never talked to him".

> You can always make a careful statement later on advice of counsel. Nothing is lost by remaining quiet at first.

That's what he did it seems: released a written statement then STFU. Hopefully he got a lawyer cause it seems he'll need it.

> Nothing is lost by remaining quiet at first.

True. Ideally it is the best strategy. But here it is drawing more attention to the case. It's in the news again. And he is also getting death threats.

> blatantly obvious

sure the UI as shown is bad, but we got a static screenshot so no, it is not blatantly obvious to me how likely an operator error actually is.

Was it there a confirmation dialog afterward? How often was the UI in this form operated? For how long was it deployed? Was that interface something one user would see during normal operations or only accessible after a warning dialog?

> STFU

that's right tho. anything one say will be used against oneself and all that. there will be layers of cover up as with anything involving government officials and private contractors, he need to tutelate himself to even have a shot to reach a fair charge.

> And STFU is smart advice in any situation where there is even a remote chance you will be charged with something.

Maybe, maybe not. I mean if there is a remote chance you will be charged with “something”, possibly minor, whether or not you cooperate, and a practical certainty that you will lose your public employment and associated benefits if you don't cooperate (and, likely, your employability anywhere related to your chosen field), you probably want to do a more detailed consideration of the likelihood you will be charged, the likely consequences if you are, and the marginal risk of talking.

It's possibly a legal strategy... or possibly avoidant behaviour due to depression/anxiety for messing up so badly.

This guy is a button pusher at some random state government agency. Probably not the extroverted types who handle global media attention and ridicule well, let alone the guilt and shame of scaring the hell out of everyone in your state.

Especially given the phrasing of this:

> “He’s choosing not to have further engagement with other employees at the Emergency Management Agency who have attempted to reach out to him.”

It's possibly a legal strategy... or possibly avoidant behaviour due to depression/anxiety for messing up so badly.

From public accounts, it doesn't sound like he messed up badly, he just made a minor mistake than anyone could make.

Everything I've read points to a systemic issue.

But they'll try their hardest to pin this on a scapegoat and he is the obvious choice. I'm not sure I'd cooperate either, particularly as lying to the federal government (any agency) is a crime within itself (18 U.S.C. § 1001) and even omissions or a poor memory can be argued that way (even if they're ultimately found not guilty the public would have lost interest by then).

I'd get a lawyer, say very little, and maybe give a written statement of facts to the investigators, nothing more.

even omissions or a poor memory can be argued that way

That excuse seems to work for our elected officials...

I'm pretty sure those officials are careful to truly refuse to answer or fail to recall at that moment, but there are also depositions of famous people being arrogant and speaking incorrectly.

> But they'll try their hardest to pin this on a scapegoat and he is the obvious choice.

The obvious choice, if there was to be a scapegoat (which I won't prejudge the officials involved to be seeking), until now was whoever designed/build the system in question (particularly it's UI), who had pretty much already been convicted in absentia in the court of public opinion (possibly based on fabrication, as it turns out.)

Now he’s the obvious choice, but that's almost entirely a result of his own actions.

> Now he’s the obvious choice, but that's almost entirely a result of his own actions.

His own actions being following sound legal advice..?

The death threats are probably more than a little traumatic though.

No doubt he's under a lot of stress, be he shouldn't be blamed for a mistake that he was set up to make by a poorly designed system.

Choosing the wrong menu item should be expected and there should be safeguards to prevent an errant alert. If I click the "Close" instead of "Save" menu item in my editor, it asks me to confirm that I really want to close without saving. A civil warning system should have at least the same safeguards.

Yes, there are two lessons to be learned here. One is about interface design. Or maybe more broadly about system design.

The other is how to deal with being arrested, or targeted in an investigation. "Refusing to cooperate" is always the smart move. Because cooperating will always make it worse, notwithstanding claims to the contrary. And it's sad that this person is being criticized for being smart.

You have to feel some empathy for the guy. Telling millions (?) of Hawaiians they are about to die in a nuclear explosion.

IIRC it took them over half an hour to issue a correction.

I don’t think it’s the right move. There’s a difference between refusing to cooperate and willfully participating with appropriate counsel (union, lawyer, etc).

Imagine if airline employees didn’t cooperate in crash investigations. Or restaurant employees in outbreak investigations.

You shouldn’t be brash and speak without counsel, but stonewalling an official investigation will not end well for the stonewaller.

The crash investigation is legally protected. Investigators don't have as their objective "find someone to blame" but "prevent future harm". Accordingly, co-operating with them makes sense because they are trying to make everything better, not trying to pick who gets strung up.

Maybe I'm reading too much into the situation, but it's my impression that "cooperat[ing] with FCC, internal investigators" means talking with them without support from counsel and union representatives. Or at least, sharing more than they advise. I expect that it takes some time for them to negotiate on his behalf with those investigators. And in the meantime, saying nothing is the best option.

Also, "cooperating" implies some shared goal. Such as discovering the facts of the matter. But that's very likely not the case here. These investigators arguably need someone to blame, and the likely candidate is pretty clear. The "button pusher" needs to focus attention on underlying problems, and that's a huge burden for a drone. Others with expertise need to do that.

I hate to sound like a nut but I still feel like their crappy system got hacked and they don't want to admit it

When I was a teenager I realized you could set of the emergency alert system with a dtmf 4 digit code on some 144mhz with a ham radio.

I never did it, but I pretty much expect that to be still possible.

The reason I say this is because yes, it is possible someone got the wrong button, but shit software like this probably has vnc with no auth/useless auth so someone can activate remotely

4 digit code on 144mhz -- just sending a code alone triggers alert? Wouldn't it need a payload to describe the msg?

Likely multiple codes, each one triggers a specific hardcoded message.

I'm assuming this was from the past ("when i was a teenager") when the messages were much more generic and fixed than they are today.

No it was the same 4 codes, and the same message: "loud'

It definitely is from my teenage years but whenever I visit folks I drive by that tower a block away. You can tell nothing has been upgraded

This was just a siren then? Makes sense.

Smart system, really. Very simple to install/maintain and very simple to have a robust transmitter infrastructure around.

If you just substitute your 4-digit code for a longer, say, 64, digit one with some time-based component, and perhaps shift the required frequency too based on time, you actually end up with a very robust very simple system.

https://en.wikipedia.org/wiki/Security_through_obscurity

I disagree. The frequency hopping would make it harder for a signal jammer to prevent a legitimate transmission. If you can't predict the frequency on which the transmission is being listened for, you'd need to jam a broader spectrum, needing much more power to perform the attack.

He likely means emergency sirens - I also had some friends I'd hang out with as a teenager who figured this out as well.

As far as I'm aware this is still the case - but some sites are now encrypted radio. From what I've heard though, that encryption may not be the best implemented in all areas.

It was pretty recently someone set off the civil warning sirens in I believe a city in Texas via this method as well.

I'd like to say this was a one off experience in my "exploring civil infrastructure" days - but it's really just barely scraping the surface. The state of these systems makes you realize how much civilization is held together with tin cans and duct tape, and how much marketing fluff there truly is out there inspiring false confidence.

The payload was the 4 digit code, it was a large tornado warning siren. The msg was "be loud". I lived 300 yards from it, and had a dad with a police scanner. I noticed a pattern after a while... Saturday's they ran some test of the system...4 digits at noon on the radio and a blasting sound would follow

I’m not sure it was hacking, I get the feeling that these events may be intentional to kind of kick the tires on emergency systems and human reactions, perhaps because the powers that be are expecting stuff to go down in the near future. I mean we had Hawaii, then Japan, and in my neck of the woods our nuclear power plant issued a false alarm as well. It just seems really odd, all these things happening in close proximity.

No need for malice when ignorance (or bad design in this case) will suffice.

The timing is very convenient and it's really much more effective than a pre-announced drill.

The government would be stupid not to do this on purpose.

This would make a bit of sense. I think someone on here mentioned how the whole incident really highlighted that the general public has no fucking idea what to do if they receive a message like this.

While it's worryingly similar to crying wolf, I would hope that this does lead to more of the general public (even outside of Hawaii) actually thinking about how they'd handle and react to an imminent threat.

If you wanted to really sound like a nut you could posit that perhaps he was paid or blackmailed to click the wrong button.

Reminds me of "Don't talk to the cops": https://thisistrue.com/dont_talk_to_the_cops/

By now pretty much everyone knows the technical reason for mishap and probably excessive resources are assigned to fix it.

Mandatory witch hunt is failing apparently due to good union/legal firewall.

Wish we could see that more often.

Too many good people fallen to that.

He's probably doing that on the advice of his lawyer, and I totally agree. Politicians are in witch-hunt mode, and as he stated, he already gave a statement and doesn't want to get goaded into making a statement that might be used against him. I think that's smart.

The top comment on the article is screaming for button-pusher blood:

> So, as it turns out, the culprit who induced panic among over a million Hawai'i citizens isn't nearly as contrite about his mistake as his superiors would have us believe. In spite of legions of supporters who have urged us to drop demands for his dismissal, he now has the audacity to be uncooperative in the investigation into the serious event that he alone triggered? Then TERMINATE him....

Bloody obvious why cooperation is being withheld.

The guy should get a lawyer.

This was a poorly designed software interface.

This person in incredibly well advised.

Operators should not be blamed for government-mandated, piss poor alert systems. The government is responsible for this fiasco, not the button pusher.

They have nothing to gain and a lot to lose by complying with an investigation.

Not necessarily, they could have just gone into some 'fight or flight' mode of 'freeze'. They could be at home, under the duvet, totally afraid to look at the phone or email. Every day could be the day it is faced up to but the duvet chosen instead. They could also have run off to stay with a friend not seen since a long time ago and able/willing to harbour them.

If they had clicked the wrong button in a moment of distraction then that might not be the end of the world, that could be fessed up to. However, what if they were pissed off with their micro-manager and thought that their 'accidental click' would result in the manager's scalp? A whole lot of things would then need to be looked into and it might not be a simple accident at all, but the visible result of a lot of festering office politics.

I think refusing to cooperate is generally the smartest play. Investigators aren't asking questions to help you exonerate yourself, they're aiming to get you to incriminate yourself as deeply as possible.

An officer asks you, "Do you know why I pulled you over today?"

- Yes = admission of guilt. You're screwed.

- No = indication of disregard for law, recklessness, and no situational awareness. You're even more screwed.

- Good afternoon officer, I'd rather not answer any questions. Would you like to see my license and registration? = Bingo.

> The employee has since been reassigned to an unspecified job at HI-EMA but has not returned to work since the incident, Anthony said.

>The employee has not been disciplined but faces the possibility of punishment, which could include termination, Anthony said.

Is this normal in the US. Govt. that you can not go to work for 2 weeks and there has been zero disciplinary action?

> Is this normal in the US. Govt.

HI-EMA is not part of the US Govt.

> that you can not go to work for 2 weeks and there has been zero disciplinary action?

It's true most places, not just in the US and not just in the public sector. They did not indicate whether he was away with or without leave, and if he was on leave for medical (including psychiatric) reasons, there are privacy considerations which might prevent revealing that.

OTOH, if he is away without leave consequences are near certain, but the disciplinary process in the public sector may be slow (and it may deliberately be deferred in this case to maintain leverage for his cooperation in the investigation, which probably had more critical importance—especially if it's not a hunt for a scapegoat—than an attendance problem.)

I think it's fair to say that this is not a normal situation.

Are we all operating off of a single screenshot, or has there been a public video of what the process looks like, start to finish, including any confirmation steps?

(Bonus points if the video is not of the actual live interface.)

Legal advice, most like. Or he could have done it on purpose, mentioned his plan to someone, and is scared as hell now. I mean, we don't know anything.

Reply on news.ycombinator.com