After confusing claims from leadership in Hawaii, FCC says path forward is clear.

A preliminary report released on Tuesday from the Federal Communications Commission details the events leading up to a false missile alert sent to mobile phones and television and radio broadcast stations in the state of Hawaii earlier this month. The report (PDF) suggests that the employee who sent the alert did not hear a recording notifying staff that an announcement regarding an incoming missile was simply a test. Instead, the employee apparently thought it was the real thing, according to the FCC.

The missile alert was not corrected for 38 minutes, sending residents of Hawaii into a panic. After the situation was rectified, Hawaii officials, including Governor David Ige and Hawaii Emergency Management Agency (HI-EMA) Administrator Vern Miyagi, attributed the mistake to "human error," saying that the employee knew the missile alert was supposed to be a test but had designated that the alert was supposed to be an "event" rather than a "test" by accident.

The employee did not agree to be interviewed by the FCC but instead issued a written statement to the federal commission. The letter said that, contrary to explanations made by Hawaii officials, the employee didn't issue an alert warning by fumbling through a software menu by accident. Instead, the employee meant to send the warning, believing the internal announcement about an inbound threat was real.

The FCC's preliminary report notes that the midnight shift supervisor decided to run a spontaneous version of an inbound ballistic missile alert drill as the day shift team members were transitioning to their places in order to practice handling such a crisis at a hectic time of day.

The shift change occurred at 8am, and the midnight shift supervisor told the day shift supervisor about the decision to run the test at shift change. But the day supervisor thought that this test was for the midnight shift only, not for day shift officers as well. "As a result, the day shift supervisor was not in the proper location to supervise the day shift warning officers when the ballistic missile defense drill was initiated," the FCC wrote.
At 8:05, the midnight shift supervisor played a recorded message over the phone saying “exercise, exercise, exercise.” But the second part of the call "did not follow the Hawaii Emergency Management Agency’s standard operating procedures for this drill," the FCC wrote.

Instead, the recording included language scripted for use in an Emergency Alert System message for an actual live ballistic missile alert. It thus included the sentence “this is not a drill.” The recording ended by saying again, “exercise, exercise, exercise.” Three on-duty warning officers in the agency’s watch center received this message, simulating a call from U.S. Pacific Command on speakerphone.
The written statement from the HI-EMA employee who placed the false missile alert indicated that the employee thought the message was real: "the day shift warning officer heard 'this is not a drill' but did not hear 'exercise, exercise, exercise,'" the FCC wrote, adding:

The day shift warning officer used software to send the alert. Specifically, they selected the template for a live alert from a drop-down menu containing various live- and test-alert templates. The alert origination software then prompted the warning officer to confirm whether they wanted to send the message. The prompt read, “Are you sure that you want to send this Alert?” Other warning officers who heard the recording in the watch center report that they knew that the erroneous incoming message did not indicate a real missile threat, but was supposed to indicate the beginning of an exercise. Specifically, they heard the words: “exercise, exercise, exercise.” The day shift warning officer seated at the alert origination terminal, however, reported to the Hawaii Emergency Management Agency after the event their belief that this was a real emergency, so they clicked “yes” to transmit the alert.
The FCC notes that it couldn't fully verify the credibility of this account without an in-person interview of the employee who sent the alert in the first place, though the commission's report said other employees who were interviewed also recalled the internal announcement saying "this is not a drill."

Slides shared by the FCC (PDF) conclude that "a combination of human error and inadequate safeguards contributed to the transmission of this false alert" and that "HI-EMA has taken steps designed to ensure that an incident such as this never happens again." After the fiasco, HI-EMA announced that it introduced a two-person process to send out missile alerts to the state and created a process to cancel an alert in case of an error. The lack of an automated "cancel" message caused the 38-minute delay in getting correct information to the terrified citizens of Hawaii.

The news does seem to contradict statements made by officials in the immediate aftermath of the crisis. HI-EMA blamed the mistake on a human working through confusing software and sent two confounding mock-ups of the alert software out to the press via the governor's office.

But if the FCC's preliminary report holds up, it seems miscommunication, not software design, was ultimately to blame.