On a typical day in January 2018 residents of Hawaii all were informed, virtually simultaneously, that the world was coming to an end.

The statewide mass notification system issued this stark warning: “BALLISTIC MISSILE THREAT INBOUND TO HAWAII. SEEK IMMEDIATE SHELTER. THIS IS NOT A DRILL.” It wasn’t a drill, it was a mistake, one that exploded the peace of mind of many thousands of citizens, at least in the short term.

The Hawaii episode offers a grim reminder of the risks inherent in mass notification. For the most part, though, mass notifications act as intended. They give enterprise security a fast and convenient way to broadcast wide-scale alerts. In recent years, corporate, campus and civic users all have leveraged a wide range of emerging capabilities to get the most out of these increasingly sophisticated, interconnected systems.

Automation is Key

A human services agency in Western New York, People Inc. serves some 13,000 individuals across eight counties. In order to notify some 4,000 employees of an emergency – anything from a weather event to an active shooter – Associate VP & Emergency Preparedness Coordinator Thomas Ess relies on the latest automated interfaces.

A mass notification system is only as good as the data you give it, and manually updating employee records is prohibitively time-consuming, he says. Thus his Everbridge system interfaces with the HR database to automatically update contact information. “People may leave the agency or join the agency. With this feature I can know that every day at 9 a.m. I will have an accurate list of employees. If someone started yesterday, it will be in the system,” he says.

Just as Ess depends on automation to manage what goes into the system, others leverage recent innovations to automate what goes out. At Louisville (Ky.) Metro Emergency Service, for instance, city officials don’t need to wait for the latest forecast to broadcast a tornado warning.

“We get a feed from the National Weather Service that integrates automatically with our notification system,” says Public Information Officer Mitchell Burmeister. “Our system is always watching their feed, so as soon as they put it on their feed, the system sends out a notification.”

For many, the most useful form of automation comes in the form of pre-scripted scenarios. By writing detailed messaging and establishing automatic procedures for a range of potential hazards, security managers say they are able to put alerts into play sooner and more effectively.

Scripted Scenarios

At Anne Arundel (Md.) Community College, scripted messaging forms the core of the mass notification system.

“We have pre-scripted messages for a whole range of possible events,” says Deputy Director of the Department of Public Safety & Police Major Cleveland Smith. Pre-scripting enables emergency officials at the college to launch from a smartphone app if necessary, with just a few simple taps.

“You log in and then you have check boxes to divide up your people into groups. You can check the pre-scripted message – or type your own – click send, and then you are off. In less than a minute you have everybody notified by voice, text and email. It is all preset and very user friendly,” he says.

Louisville officials have about a dozen preset scenarios in play, including a set of scripts developed in cooperation with the Kentucky Derby Festival. In the two weeks before the derby, the city is packed with visitors and brimming with events, “and the Festival has scripted messages for every type of disaster you could think of, from an active shooter to an aircraft having trouble,” Burmeister says.

“Those are all predefined, and we have those same messages loaded into our Rave Mobile Safety system and ready to go. The last thing we want is to have one message going out locally over the PA system while people are getting a different message from us,” he says. “So we want to work closely with all our different partners.”

Mass notification system maker Omnilert describes scripting as the heart of what it calls automated sequencing, the idea being that a given script will contain not just the key message around an event but also instructions for the system to execute on. These may include:

• Sending custom text, email and voice messages to different groups or departments
• Notifying local first responders
• Posting to social media
• Update the corporate website with an emergency notice
• Display a scrolling message on all desktops

At People Inc., Ess says he relies on this kind of pre-defined process to help take the guesswork out of sending emergency alerts. By automating the routine, he reduces the chances for human error. “If we have an active shooter notification, we have a template for that. All we need to do is identify the group of recipients, and it goes out with a scripted message,” he says. “We have multiple users on the system, and we don’t want them to have to think through what they want to say about a given incident. It’s already set for them.”

This ability to predefine messaging and processes has been a major development on the mass notification landscape in recent years. Another significant advance involves the emerging Internet of Things.

Leveraging IoT

Scattered around most of the common areas on Smith’s campus are “text pads,” slim devices about half the size of the typical tablet. When an alert goes out, these light up – literally.

“If we send something out with the Omnilert system, lights will flash on it. At the same time, sirens will go off in the building and a message will go across that screen,” he says. This kind of interfacing between physical devices and mass notification systems is a growing area of interest to security professionals.

Civic users are looking at the digital signage that increasingly is visible at bus stops and in airports, for example. Corporate users likewise may already have digital signs in place in lobbies and common areas as a means to share news of the day and update workers about events. All this digital real estate can be incorporated into a mass warning system.

“We can have the usual phone and text notifications, but we can also have a form of redundancy by linking it to an electronic signboard,” says Paul Timm, PSP, and a member of the ASIS School Safety and Security Council.

“The value there is that if I am a visitor to the campus or the corporation and I am not signed up for notifications, I can still get that information,” says Timm, who is also VP of Facility Engineering Associates in Fairfax, Va. “Many companies already have these screens for scrolling announcements; they use them for parking and to announce who won the latest award. They offer us another way to get the same message going to as many people as possible.”

Getting the message out there is important – but it’s also helpful to know who did (or did not) receive it. Many security professionals also are leveraging a relatively new feedback feature, wherein mass notification systems allow recipients to confirm they’ve gotten the message.

“It’s about how we account for all our people,” Timm says. “If people don’t get your message and you have no idea, that’s a problem. Those people are still walking around in danger zones. So if you have a mechanism that allows someone to say – ‘Yes, I got this message and I am taking action’ – that’s a big help.”

Building Fences

Another recent innovation involves geofencing, the ability to partition mass notification lists by geography.

Ess used this recently when a developmentally disabled adult wandered off from a facility. “I sent a notification within a 10-mile radius of that location, with a description of what he looked like, what his was wearing, where he might be,” he says. “We found him within 45 minutes and were able to bring him home safely. We try to prevent those kinds of events from occurring, but if they do occur, we can mobilize a great number of people very quickly with this.”

Timm sees value in this for any enterprise that extends across multiple locations. “If something is happening in the administration building, maybe they get a message that other people don’t get. We want them to go to the basement because there is a tornado warning, but maybe a satellite campus doesn’t get that level of detail because they don’t need that,” he says. “If I’m away in another state, maybe I don’t need the same level of information.”

Burmeister uses this feature when the mosquito trucks go out to fog for pests. He wants to let people in the affected area know, but he doesn’t want to put the entire city on alert unnecessarily. “You don’t want to over-burden people with information,” he says. “This is a large county, about 400 square miles, so being able to pinpoint a message by location is really helpful.”

With geofencing, IoT and automated interfaces, mass notifications have seized the technological cutting edge. This raises the question: What went wrong in Hawaii, and what can be learned from it?

‘Incoming Missiles’

The FCC’s analysis found procedural gaps in Hawaii’s mass notification plan. The state’s emergency management agency didn’t have safeguards in place to prevent human error; it took too long to issue a correction to the initial warning; and, most telling, it was too easy for a single individual to send out an alert.

“They should have had more accountability,” Timm says. “It should be a two-person rule or maybe more than two people. Who has the authority to say now is the time? It should be like a threat assessment team, a whole bunch of people who all agree and nod and say it’s time.”

It’s also critical to have procedures in place to authenticate the purported emergency before blowing the whistle. “With the amount of information out there in the news and on social media and from governmental entities, it is critically important that you verify,” Ess says. “When things happen quickly there is pressure to have answers quickly, but you still need to take the time to vet the information and validate that this is really what’s going on.”
At the same time, security pros need to balance the need for accuracy with a sense of urgency: If you take too long to verify, you can miss a critical window.

 “We’d rather err on the side of caution,” Smith says. “You have to empower your people, and understand that sometimes it’s better to send it out if you aren’t sure.”

There’s no perfect formula for balancing speed and accuracy. The most effective approach may be to have solid protocols in place, a well-defined route for getting to the best answer in the shortest amount of time.

“You have to have proper procedures for messaging and approvals. If the permissions are set up appropriately, then you’ll have done all you can to broadcast the best, most accurate message,” Burmeister says.