They could have just an a confirmation window with the the text that was about to be sent.

"Everyone is going to die. Run but it won't help"... Is that want you wanted to send [Yes] [No]

If that confirmation window is on every message drill or not, then it would be completely useless. Users have been trained to click past/ignore pop-ups.

I say this as someone who watches people log in on PCs and click past a useless (for them) Citrix dialog that includes a "stop asking" checkbox. Citrix added that checkbox some time ago, so these folks have been vacuously ignoring the entire thing at least once per business day for at least a year.

Perhaps a captcha style prompt could be added (basic math with random values?) to critical/damaging operations but I'm sure that would get pushback of its own.

"You can't require that our people do basic arithmetic when they need to send an alert! It'll slow them down!" Suggested response: "Are you telling me that you're allowing this kind of operation to be done by people who can't handle single digit arithmetic?"

Dialog blindness is very real and problematic.

They could consider a different UI response between a drill and active alert. Since drills are the majority of their workload they'd get dialog blindness to the drill confirmation, and then you'd design the active alert confirmation to be a-typical of the drill (for example a different color dialog, and have an "I agree" checkbox on the active, but none of the drill).

I ended up with a checkbox plus a mandatory input field requesting a reason for one irreversible action in a system I worked on.

Just adding a checkbox and later a popup with an additional warning wasn't enough.

An undo function is obviously best, but ufortunately while technically possible, it took a while - possibly a day - to restore due to ripple effects in other systems, and it normally wasn't the person clicking the button that had any reason to notice something was wrong.

Undo is definitely the ultimate UI safeguard.

Unfortunately a lot of organizations don't want to invest the time/resources into creating it. Particularly when it gets into discussing exactly how the underlying data should be handled during the undo window (e.g. does it exist? Is it just flagged deleted? What about relations? Do all of our queries that touch this data check that? Etc).

> If that confirmation window is on every message drill or not, then it would be completely useless. Users have been trained to click past/ignore pop-ups.

That would apply to something that's used routinely, I'm not sure this system is actually used that often. Do these emergency systems send out "this is a drill" messages really that regularly? As a non-US person that sounds like a quite scary way to live.

Even if it is something that gets used regularly, adding additional levels of confirmation, depending on the kind of alert that's gonna be sent out, would already go a long way of preventing this kind of mistake.

For the real deal add some bold and flashing text along the lines of "This is the NOT A DRILL message, are you sure about sending this?" which pops up as a second confirmation screen, while drill messages have only one confirmation screen.

> That would apply to something that's used routinely, I'm not sure this system is actually used that often. Do these emergency systems send out "this is a drill" messages really that regularly? As a non-US person that sounds like a quite scary way to live.

Per the explanation provided by the agency, this is a drill that is conducted at every shift change, so presumably multiple times a day. I gather it does not send any actual alert to the public, just simulates it (perhaps sends to a small pool of test devices?) But it's appearing more and more likely that we've been giving a misleading explanation for this incident so who knows.

People are taking popups more seriously when it comes to payment... or sending a nuke.

Hmm, "Enter your credit card payment information to send this alert."

Nah, real world experience shows that people who supposedly have common sense will happily put their payment info just about anywhere.

Biggest issue is that the system probably doesn't have a flag Test /Not Test.

The Test Records probably do the same thing just to a smaller list than the real one.

So there is no real way to separate them.

> a forward thinking developer saying "hey should we at least have colored buttons

Accessibility becomes an issue for colourblind people then.

Government standards never allow only color distinction. There always must be an additional factor than just color.

For instance, here's some icons from NATO, which used to be MIL-STD-2525. You'll notice that all the icons differentiate in both color and form. The NTDS standards for Naval systems are similar.

https://en.wikipedia.org/wiki/NATO_Joint_Military_Symbology#...

Well, in addition to the color coding I suppose the text would still be different?

To me, the screenshot looks more like a list of user-defined presets than something that went through the original software development process. Maybe something along the lines of only superuser can define new presets, but lower users can activate them. That way, at least random "I love you honeybunny" pranks would be avoided, but the risk of skipping a real warning because of insufficient permissions would be avoided.

A physical UI would have an openly accessible switch for "drill" and "not a drill" protected behind a seal that needs to be broken, this is difficult to replicate in software.

I did think of the covered switches that are common in movies. I think the equivalent in software are confirmation dialogs, but those are not as effective as the physical counterparts due to click-through-itis disease. [0] This could actually be one of those types of things that might benefit from a different presentation, such as a silly skeumorphic design involving a graphical cover.

[0] Which, to be fair to users, is a disease introduced by putting too many switches under covers which shouldn't be.

They could use an actual covered switch. Maybe something this important should have a bit of physical infrastructure associated with it. Doing everything in software can be great, but it's not always the best solution.

> You'll notice that all the icons differentiate in both color and form.

Good stuff but I think they could probably have gone with something else for "Neutral" - the distinction between a 16:10 rectangle and a square could easily be missed in a hurry, especially at small sizes.

Hadn't seen this, it's brilliant.

Not necessarily. Colorblind doesn't mean "everything is grey" it means you have trouble distinguishing between between a few, usually fairly specific colors. There are plenty of color schemes out that that are perfectly fine for colorblind folks, especially when you only need 2-3 distinct colors.

Nope. Dichromatic color deficiency is the most common form of color blindness, but about one in 20,000 people are completely unable to perceive color due to a variety of ophthalmic and neurological deficits. Even among dichromats, you can only reliably expect all users to be able to distinguish red and blue. It's probably not worth worrying about too much in most circumstances, but it is a relevant factor if you're designing safety-critical systems with a large user base.

Achromatopsia affects one in ~33,000 people. By comparison, any form of colorblindness affects one in 8 men and one in 200 women.

I'm not sure "someone using this system might see everything as the same shade of grey" is a realistic concern at those levels of incidence.

If you're going to worry about that, wouldn't you be more concerned about the operator being fully blind? And simply justify not hiring the vision impaired for this particular position?

"safety-critical systems with a large user base"

Surely a missile warning system would be operated by a very, very small number of people, on the order of twenty or thirty?

Black, blue, yellow, and white is usually a safe palette. Yellow-and-black diagonal striping is a fairly clear "exercise caution" indicator.

I am not an expert, but you should not hire colorblind people to operate a nuclear warning system.

You're saying that people should be prevented from getting jobs they're capable of performing because the alternative is to crack open decades old usability texts? There are multiple suggestions in this thread which could be easily implemented at little-to-no extra cost without sacrificing accessibility.

No, its because for certain jobs you need certain qualities. They might upgrade this system, but who knows what else lurks in their basement. Its the same reason why you would not train a severely short-sighted person to be a sniper.

There’s a big difference there: for a sniper, vision is a core skill.

For someone sending alerts, color vision is not — things like keeping cool under pressure, following procedure, interpreting chaotic information, etc. are.

Ok, you've hired William because he's got 20/20 and full colour vision.

One problem: William's in the toilet. He had a bad taco for lunch and honestly, he's going to be in there for a good 10 minutes. And there's a missile coming. Luckily Frank the IT guy is there and knows what to do but ... he's colourblind!

Oh dear. He's just sent out a dummy warning by mistake and now half of Hawaii is going to die. Well done.

That's not a huge obstacle if you know what you're doing. Color is only one tool in the arsenal - shade, shape, pattern and outline can all be used to visually distinguish UI elements.