The Hawaii Alert, 2018
broke: constraint & confirmation-of-consequence documentedOn the morning of 13 January 2018, an operator at Hawaii's Emergency Management Agency intended to run the routine internal test of the ballistic-missile alert system and instead sent the live warning — BALLISTIC MISSILE THREAT INBOUND TO HAWAII. SEEK IMMEDIATE SHELTER. THIS IS NOT A DRILL — to every phone in the state. Thirty-eight minutes passed before the official correction.
The official post-mortems (FCC; state) describe the interface: the live alert and its test sat as near-identical items in the same menu, the confirmation step was the same reflexive are you sure? that guarded both, and — the detail this building exists for — there was no way to un-send. Every floor of the Institute is present in the failure: a menu without separation of consequence (Floor 3), a confirm where the stakes demanded ceremony (the Undo vs Confirm entry's limit case), no recovery flow (Floor 4), and a whole system (Floor 5) where one dropdown was load-bearing for a state's peace of mind.
Why documented: The FCC’s own public report on the 13 January 2018 false alert.