Recently a Hawaiian civil defense employee sent an emergency alert that a ballistic missile threat was headed for Hawaii, and that residents should seek shelter. It was a mistake, a human error. Panic ensued and it took 38 minutes to correct the error. Predictable questions were asked about who should be disciplined for messing up. But what questions should have been asked about the event?

Initial information reported that the worker sent the alert by a single misstep of selecting “Missile Alert” instead of “Test Missile Alert” from a drop-down list and sending. The employee was reassigned pending the investigation -- pretty clearly signaling tentative assignment of blame, rather than analyzing the event to find out how it was possible for it to occur. Let’s think about what happens when we follow the “ready, fire, aim” approach disciplinary action.

Additional findings

Preliminary information from the initial investigation revealed additional key factors:

• The employee was not aware this was a drill, and had been counseled twice before for confusing drills for real events.
• The supervisor’s recorded message included “exercise, exercise, exercise,” but also included “this is not a drill.”
• There was miscommunication between the outgoing and incoming shift supervisors around the time of the event.
• The software in use does not distinguish between a testing environment and a live alert environment, and contained no safeguards to prevent a single person from initiating the missile alert.
• The employee has been fired, and three others have either been suspended or resigned.

Three strikes and you’re out

We see a number of factors that likely played a role in the event, including the “this is not a drill” statement and miscommunication.  Note too, this is the third time a similar error has been made.  What happened before appears to have been counseling, and what has happened now (so far) is placing the blame on the employees.  Interestingly, it appears that nothing has been done to examine and address work process issues in the face of at least two previous similar errors.

Conditions and information present at the time enabled the employee to conclude that sending a missile alert (rather than a test) was appropriate. Sending the alert was logical because it was understood this was a real event.

HOP principles

Let’s take a look at how we can likely improve the quality of learning here and the corrective actions by applying human and organizational performance (HOP) principles. 

First, let’s look at the elephant in the room – discipline – and the long-ingrained tendency to find a human culprit who erred so we can punish him or her. The problem is the employee likely never intended to make this mistake or cause the resulting panic. (Otherwise, we have a case of sabotage that the police should be investigating as a criminal act).

If the employee never intended to make the mistake or achieve the resulting outcome, we need to ask ourselves a tough question: How will disciplining the person for something they did not intend to do keep the same mistake from happening again? The answer: “practically nothing.” Discipline might make us feel better, and assure us that we took effective action, but in reality, we have done nothing to improve the work process or reduce the potential for a reoccurrence.

The right question

We should ask the worker involved and others who know the process: “How was it possible for this event/mistake to take place?” One way to do this is to use the substitution test.  Take other employees familiar with the alert process, share the conditions and information available in this situation, and ask them how they would make decisions and take actions. We don’t know if this was done here. We do know once action is taken against the employee(s) it becomes much harder to have this discussion. Why? Because other employees become reluctant to talk openly, especially if they think they might reach the same conclusions and take similar actions as the fired employee.

Triggering a missile alert to the public meets the criteria for a “critical step,” an action that once taken is irreversible without causing significant harm (panic in this case). Because a mistake at a critical step will cause significant harm, a work process design should have layered defenses in place, two or more depending on the risk.

When a single employee makes the wrong drop-down selection and clicks “send,” there is no safety margin to accommodate what we know about people. It is part of the human condition to make a mistake and, left to the same conditions, it is highly likely to happen again at some point. But if our analysis of the events looks for the factors that allowed the event to occur, one option might be to redesign the system so that sending a missile alert first triggers a second message – something to the effect of “confirming send missile alert” (as opposed to a test alert). The process might be changed to require two people for completion. Or the drill and real production parts of the software environment could be separated. This would add an additional layer of protection at precisely the point where we can anticipate a likely error at a critical step.

Accepting the two-person process improvement gives us another chance to catch the same error. What if we add the software enhancement to separate the drill and real environment? Likely a better improvement, but both actions are better yet. Still, is it possible there are gaps in our learning that leave a hidden on-going vulnerability for the organization? Is discipline appropriate, or did the system set our people up for failure?

In this case, taking disciplinary action (temporary reassignment is a form of discipline, often followed by later termination) before learning how the event was able to take place chills the learning potential. It’s less likely any corrective actions will address the actual factors involved. There is a time and place for discipline and HOP embraces accountability. But we need to take the time to learn first. Or more colloquially, to use the ready, aim (learn), fire approach and not ready, fire, aim.