> Forgotten Twitter log-in details have been blamed for delaying a public correction to Hawaii's missile alert earlier this month.

Kind of floored that twitter is what the government has to use to put a notification out to it's public to provide critical information.

But then I continued to read and the article goes on to say that twitter and other social media was used by the Governor after the emergency text message was sent out, which means it obviously isn't a primary source of information.

So actually it's just clickbait journalism. Anyone panicking in the area would have almost certainly picked up a text before getting anything over twitter.

What is pretty terrible is that the governor of Hawaii most likely doesn't have 2FA on his twitter account and keeps the password on his phone, probably in a notes app of some kind, and is willing to publicly admit that.

Actually I learned today that its maybe not a bad idea to broadcast public announcements through alternate channels like twitter.

There was a quake here in Jakarta and the resulting hug of death took the governments site offline briefly - but their twitter account was fine. It worked as a great CDN!

Semi-related - when everyone evacuated their office blocks and stood on the road it flooded the cell towers making internet browsing impossible. But whatsapp continued to connect intermittently making it relatively fine to use.

Not saying these types of channels should be used in place of the actual emergency protocols in the phone network. But no harm broadcasting if you can keep them secure.

North Dakota, USA recently sent out a "blue alert". Besides being confusing to the majority of the population, the alert requested users to go to the state website for information. The very small population of North Dakota crashed their web server. Twitter was the best place to find information.

I'm really doubting any government infrastructure these days.

You can blame private enterprise and the outsourcing mania for the sad state of .gov internet presence.

When vendors can sell crap like weblogic to an org that really only needs an easy to update static site; and the taxpayer ends up on the hook for it.

There are efforts in progress to fix things https://www.usds.gov/ but they are slow and prone to being sabotaged by the aforementioned vendors.

I really like the concept of USDS. It's a shame you have to live in DC to help. I think the pay cut I could maybe handle but not DC.

In emergency situations, if social media platforms work better than "official channels" (and they do), I'd prefer the government to use them.

I don't. Having to agree to yet more 'privacy' policies and succumb to tracking and other rights violations by the big social media platforms just to be able to recieve important messages from our government is, well, extremely stupid. The government must have a reliable way to do this. They don't, so they are trying to take the 'easy way', and that's a failure on their part.

Imagine if Russia relied on twitter to distribute missile strike notifications and the US decided to make a pre-emptive strike. Do you really think twitter would not have a mysterious outage during the strike? Or that there would be reliable information on there?

You can't rely on private companies, especially with foreign investors to provide critical infrastructure.

Raise your noses high, wrinkling in disgust on the users, who are unable to follow the unrealistic standards of safety measures and rules. All i demanded from them was to hop throgh a firey hoop- and they couldnt even do that!

Its a great way to stay out of responsibility as a security consultant or admin. Always trust for the users to poke the biggest hole, so you have something to point to when the water floats the ship.

They first accidentally sent out an emergency text message saying there was an incoming missile. Then they wanted to retract it, but the emergency message system did not have a way to send a "sorry, false alarm" message, so they relied on twitter and other media to do so (and this was delayed).

Seems problematic that they couldn’t do a custom string. Not every emergency will be something previously thought of before.

It’s perfectly rational, efficient and good policy to use social media to reach people in an emergency.

Twitter has spent billions to deploy a worldwide network that people engage with to communicate short status updates. They also have the content, and scale to have a large percentage of the population actually familiar with how to use their tool.

To get an equivalent reach and scale and level of familiarity with a government run tool would be a $100 billion project doomed to fail.

Should Twitter be the only way that government reaches the population to deliver critical updates? Of course not, but it absolutely must be one of the primary ways, and in many cases because the system design of Twitter is so much better, it will be the channel with the most accurate and up-to-date data.

I mean the best part of that is then Homeland can designate Twitter as “critical national infrastructure” and put their agents in the data centers! </s>

I'm so glad you put that </s> at the end. I definitely see them jumping to make those inroads. It's not hard to self operate this stuff now that distributed computing is cheaper (eg. $50 raspi 2018 = 10+ $2000 boxes 1998). How was Google built, lots of commodity hardware you say? Why can't a neighborhood watch-like group operate a p2p network of RasPis located in homes of volunteers, using enough replication and a signing policy with YubiKeys or something, and operating guides and maintenance kits? Self-promotion, I started working on something like this in Nov.

This morning I awoke to a map of my block covered in blue saying a warning had started 20 minutes ago, in a Facebook post from a foodie. I like to think those friendly warning sirens that blare at noon would tell me something, to begin with. Then those loud alerts that go to my phone no matter how many times I disable the setting. Then maybe text blast, granted I don't know all the ones I should be on. I just had a needless bpm added to my heart rate.

All notifications are disabled on my mobile except calls; much as people depend on them I won't let myself. Two days of disaster and everyone's battery is dead, along with ability to search the web for life skills and claim to have invented fire. Tangent, but for the doubters, I inspect routes before I drive and know my way around blind after just a few thousand miles in the city over 4 years (typical commuter is 10k/yr+). And literally nobody of consequence has complained about responding to things a few times per day in batches (around lunch, late afternoon/5).

People think I'm too intense, actually I think they're just addicts with no attention span. So one can see why I don't want to turn on Notifs for an advertising network in case there's something urgent. Oh hey, false alarm, buy some stuff and surrender some power... [just click here :D]

I'm not sure what the other duties of this team are, so this is more of a generic thought, not specific to the Hawaii alert bungle.

Maybe it's important not to let any career exist that exercises its capabilities so infrequently. For example, firefighters train for massive disasters that rarely occur, but they more regularly fight smaller fires, and even more regularly respond to other problems like traffic accidents. So they are deployed on a very regular basis. Contrast that with the Minuteman missile teams who, I hope, have never ever fulfilled their role in actuality. Does this make them less effective?

Also makes me think about military efficacy. You can either go to war a lot, or find other ways to practice your skills. Which is why disaster response seems like such a natural fit for military.

I read an article recently about how we know what we know about history. The big takeaway for me was that most of what we know about ancient times, we know because the information was repeated. Ancient texts were copied by scholars and monks over and over again. Even when the originals were destroyed or decayed, we retained some of the copies. This turns out to be a common pattern with almost anything in the sum of human knowledge. We only know what is newly discovered, or what is rediscovered (repeated).

In the digital sphere we have the same issue. There is a whole heap of data out there, but much of it is under threat of being lost, because it only exists on a hard drive we have lost the technology to read, unless we rebuild it (but we've also forgotten how to do that). If the platters decay without that data being copied, it's lost forever.

Just as the military knows, with its constant drilling, the same is true of human behaviours too. Repetition is the key to everything we know, and everything we do. Knowledge and behaviours that aren't repeated will be lost.

Hmm, i just assumed that all executives - even in government - have their public-facing accounts managed by their communications/public relations team. Maybe this is one of those rare times that it would have been good to have a team of people have access to the account? ;-)

Damned if you do write the password on a post-it note, damned if you don't.

Not damned if you just remember the goddamn password OR use a password manager.

Use a password manager. I'd prefer that critical government social media accounts not use passwords that a human being can realistically remember.

At least it wasn't due to a Expired SAML Certificate?

I'm a fan of Nadine Dorries's approach of just telling everyone and the interns your password. Crowd sourced memory, right? - source http://www.bbc.co.uk/news/uk-politics-42216622

As a UK citizen, I was furious about that at the time. I can't understand how that's not illegal, for someone in her position.

You say that as if those are the only two options. How about using a sandboxed browser with a password manager that auto-completes the credentials and a Yubikey for 2FA? Of course this is only to make it as "easy" as possible for them, considering they'd be moving up from post-it note passwords. But it wouldn't be ideal either in terms of security.

Write it on a post-it note and put it in your wallet. If you lose your wallet you probably have some work to do anyway to cancel cards. Just change your password first.

No need to write "password123" down

That’s not very secure. Instead, use “password124”.

That's funny, I don't know my twitter password either. Nor do I know my facebook password, or most of my other passwords.

edit: I guess my point is that the word is not getting out about good password practices.

Maybe it's snooty holier-than-thou posts by users of password managers, lacking in substance or any real argument, that lets the majority of password users remain unconvinced.

Password managers make me nervous for two reasons: (1) if someone breaches the password manager, they have all your passwords, rather than one, and (2) you have to trust the source of the password manager that it doesn't have an intentional backdoor - even if it was trustworthy, every update is the potential for a new problem.

Also, in my experience, you're not allowed to use one at work, so what do you think people do?

Nothing wrong with using twitter to spread important news around faster. But this article is as click bait as it gets honestly.. Next article on this subject will be titled something: Hawaii social media person delayed by additional 3 minutes because had to use the restroom during crisis

Wasn't it stuck to the monitor with a post-it note?

Presumably after they'd discovered it, they took this measure to prevent a repeat of the same situation.

That was just the password. Maybe they forgot the username, too.