What you need to know about emergency cellphone alerts

What would you do if your smartphone suddenly told you a ballistic missile was on its way?

In Hawaii, residents and visitors got a chance to live out that scenario after getting that message nearly two weeks ago, with people panicking as they searched for shelter and contacted loved ones.

The warning, which initially stated it was "not a drill," turned out to be a mistake -- the result of someone pushing the wrong button on a computer. To make matters worse, it took more than a half hour for officials to send a follow-up message correcting the mistake (including Hawaii's governor, who didn't know his Twitter login info), leaving millions of people fearing their lives would soon end.

How does something so crazy happen? The Federal Communications Commission, which sets the technical standards for the alert system, has already begun a full investigation into what lead to the problem. Sen. Brian Schatz of Hawaii praised the agency for moving quickly to investigate. But he and others have noted that this debacle is a wakeup call to examine issues surrounding the current alert system.

"This system failed miserably and we need to start over," Schatz said on Twitter.

On Thursday, the Senate Commerce Committee, of which Schatz is a member, held a hearing to dig into the policy concerns about the use and effectiveness of the Emergency Alert System. To help you understand how this alert system works and what the issues are, CNET has put together this FAQ.  

What were the alerts that folks in Hawaii received?

The messages people received on their cellphones on Jan. 13 were Wireless Emergency Alerts, which are notifications that pop up on cellphone screens like text messages and have distinct ringtones and vibrations to get users' attention.

The alerts, which were adopted in 2012, are sent directly by authorized federal, state or local agencies. There are three types of WEAs: Amber Alerts for missing children; alerts about imminent threats to public safety, such as weather or terror alerts; and alerts issued by the president. Some wireless carriers allow customers to block all but presidential alerts.

How do they work?

WEAs are part of a more comprehensive alert system developed by the Federal Emergency Management Agency (FEMA) called the Integrated Public Alert and Warning System, or IPAWS. IPAWS is a web-based "alert aggregator" that allows federal, state and local agencies to send prewritten and prerecorded messages related to different emergency situations all at once to devices like cellphones, TVs and radios in specific geographic areas. It's supposed to be a more efficient way of sending out alerts.

An authorized agency sends the alert through IPAWS, and participating wireless carriers push the alert to mobile devices in an affected area.

Who can get the alert?

Alerts are sent to anyone with a compatible device on a participating wireless carrier's network within a specific coverage area where the emergency is happening. This means that even if you're visiting from out of state and you're in the alert zone, you'll get a message on your WEA-capable device.

Another thing to be aware of is that wireless customers don't need to sign up to receive the alerts. They're automatic. And they're free to receive.

Who might not get an alert?

The nation's four major wireless carriers all participate in the system. But they may only offer the service in certain regions and on certain devices. So if you're out of your carrier's coverage area for the alert, you may not get it, or if you're roaming on a carrier that doesn't participate in the program, you won't get an alert. You also may not receive an alert if you're using a phone that doesn't support the service. To understand where your carrier offers the service and whether your device can receive the alerts, check with your carrier.

Another thing to keep in mind is that only the largest US carriers are required to offer the alerts right now. Smaller wireless carriers, like GCI, which operates in Alaska, have been given until May 2019 to comply with the FCC's mandate to participate in the WEA program. That's why some Alaskans on Monday night got alerts on their mobile devices warning of a possible tsunami after an earthquake while others did not, Heather Handyside, senior director of corporate communications for GCI, told a local NBC affiliate in Anchorage.

Of course, another reason you may not be receiving the alerts is because you may have turned them off. Federal law permits users from disabling some of the alerts. The only type of alert that can't be turned off is one sent by the US president. 

Who can send the alerts?

More than 1,000 federal, state and local agencies throughout the US are authorized to send alerts through the IPAWS system, according to FEMA. Agencies like the National Weather Service can send out alerts for weather, or the National Center for Missing and Exploited Children (NCMEC) may send Amber Alerts for missing children. Local and state authorities can also send alerts. In California, local officials sent alerts regarding wildfires.

The alert sent in Hawaii came from the Hawaii Emergency Management Agency, a state organization that coordinates emergency response.  

How did the issue in Hawaii happen?

Officials said the alert was the result of human error. The mistake occurred during a shift-change drill at the emergency command post.  Someone simply clicked the wrong button on the computer, according to Hawaii Gov. David Y. Ige. So instead of a test message, it was a live message that went out.

Even though the government officials immediately began posting notices on Facebook and Twitter that the alert was a mistake, it took 38 minutes before an updated alert was sent to mobile devices. The FCC confirmed during the hearing that state officials didn't need to get permission from either the FCC or FEMA to retract the message. Some people have speculated that caused the delay. But state officials have acknowledged at least some of the delay stemmed from a flaw in the system that restricts users to sending only prewritten messages. A cancellation template is being developed so that future mistakes can be corrected more quickly.  Also, the agency has updated its procedures and now requires two people to sign off before an alert can be sent.

Could this happen elsewhere?

In theory, this mistake could happen anywhere. While IPAWS is a program established by FEMA, it still requires national, state and local agencies to set up and manage their own systems through certified IPAWS vendors.

"Some local authorities are very sophisticated and experienced about alerts, and some are not," said Jamie Barnett, a partner at law firm Venable and a former chief of the FCC's Public Safety and Homeland Security Bureau. "Training, exercises and strong management protocols can be encouraged by IPAWS, but it's still largely up to the local and state jurisdictions."

Still, Barnett said the incident in Hawaii is likely a wakeup call for officials around the country.

"It is possible for a mistake like this to happen elsewhere," he said. "But it was more likely to happen in Hawaii or a territory closer to North Korea and China. And it is much less likely now that the furor has blown up over Hawaii's mistake."  

Didn't this happen in Japan?

Days after the Hawaii gaffe, Japanese public broadcaster NHK issued a warning that North Korea had launched a missile, but corrected the alert within five minutes. The government hadn't issued an alert, and NHK blamed the error on its own equipment.

What is the FCC doing to make sure this doesn't happen again?

FCC Chairman Ajit Pai said the agency has opened an investigation into what happened. Pai called the false alert "absolutely unacceptable" and added that it appeared "the government of Hawaii did not have reasonable safeguards or process controls in place to prevent the transmission of a false alert."

But in truth, there isn't much the FCC can actually do to ensure that government agencies implement best practices. The FCC doesn't regulate state and local agencies. It also doesn't control the funding to ensure that these agencies have up-to-date and functioning systems.

Lisa Fowlkes, chief of the Public Safety and Homeland Security Bureau at the FCC, acknowledged in her testimony Thursday that the FCC has no authority over who decides when a message should be sent.

"We aren't involved in any way with who issues an alert," she said.

Schatz said it makes little sense that a state agency would be issuing such an alert. As a result, he said he plans to introduce legislation that will specifically spell out that federal officials instead of state officials should be responsible for issuing alerts on ballistic missile threats.

"A missile attack is federal," Schatz said. "A missile attack is not a local responsibility. Confirmation and notification of something like a missile attack should reside with the agency that knows first and knows for sure, in other words the people who know should be the people who tell us."

One thing the FCC can do is offer a detailed accounting of what happened and suggestions to help prevent mistakes. What's more, since the FCC is in charge of setting the technical standards for WEAs, it can also push to update the system and make it more effective. And it can force wireless carriers to implement the changes more quickly.

What are the bigger issues with Wireless Emergency Alerts?

Public safety officials have complained almost since the system was introduced in 2012 that it needed updates. Some of the biggest issues are that the alerts are not targeted enough geographically, so alerts are often sent out too widely, causing fear among people who don't need to be alerted. For example, officials from Harris County, Texas, told the FCC that they were frustrated during Hurricane Harvey because the were forced to send alerts countywide instead of to more specific parts of the county where people were being affected by the storm.

Also, alerts are currently only available in English and the messages are limited to 90 characters and do not allow for pictures, links or phone numbers to be displayed.  

Next week the FCC is expected to approve updates to the alert system to improve its location-targeting ability.  The current standards mandate targeting at the county level. But the new standard will require wireless carriers to allow officials to get more granular in their geo-targeting down to the cell-sector so that they minimize over-alerting.

"An appropriately targeted WEA message can mitigate the possibility that an alert will cause distress or panic in areas not actually at risk and enhance public confidence in the emergency alert system," Scott Bergmann, senior vice president at CTIA, the wireless industry's trade association, said during his testimony.

Bergmann said the new standard the FCC is considering will require wireless providers to harness location capabilities within phones.

"Once available, this capability will give local alert originators an additional tool to minimize the possibility that someone will receive an irrelevant Wireless Emergency Alert," he said. 

The FCC also adopted updates in 2016 that require carriers to allow messages to be sent in multiple languages. The character limit for messages was also increased from 90 to 360. And messages will be able to support hyperlinks and multimedia.  But those changes won't take effect until next year. Public safety officials complain this is taking too long, while the wireless industry says it needs time to implement the changes. Bergmann said the industry is committed to meeting the FCC's aggressive timelines for the updates. 

"CTIA and the wireless industry are proud of the critical role that Wireless Emergency Alerts play in our nation's emergency alert system," he said. "And [we] are committed to continue working collaboratively with public safety professionals at every level of our government to maintain public confidence in Wireless Emergency Alerts."

First published Jan. 25, 5 a.m. PT.
Updated 1:41 p.m. PT: This story was updated with additional information from the Senate hearing. 

CNET Magazine: Check out a sample of the stories in CNET's newsstand edition.

Special Reports: CNET's in-depth features in one place.