Katwarn Is a Design Failure

This translation was generated automatically.

Heise reports on the Katwarn disaster-alert app:

The Katwarn smartphone warning system was completely overloaded during Friday evening’s attack in Munich. “We reached the limits of our capacity,” a Katwarn spokesperson said on Saturday. “That isn’t good—the criticism is justified,” he admitted. The system’s capacity must be expanded as quickly as possible. The cause was the large number of users in Munich and other parts of the country where there were severe storms. At times the service was unavailable.

That’s putting it mildly.

Even on an uneventful day, the app is already overwhelmed by relatively harmless thunderstorm warnings. If I open a storm notification as soon as it arrives, the server is often unreachable. When a quarter of a million people all want to read the alert at once, the system is even more overloaded. The message only became available several minutes later. Every time a new wave of alerts came in on Friday, the service was unavailable again.

The way the authorities are organized also seems odd: in Munich, different organizations apparently posted similar but redundant alerts.

Munich attack—three alerts issued after 8 p.m.: two from the city and one from the Munich district. KATWARN delivered them accordingly. — KATWARN, July 22, 2016

If you subscribe to several postal codes within the city (for example, for home and work), they apparently aren’t deduplicated either. A city-wide alert triggers multiple notifications. I got about 20 notifications within a few minutes, without being able to read what they said.

I can’t judge how the system worked via SMS, but I’m happy to add details if readers get in touch.

The design of this service seems questionable on several levels, so here are a few suggestions for improvement.

On Friday, the push notification said only “special situation”, with no explanation. The more important “stay at home” warning wasn’t visible at first.

Why not use the push infrastructure in Android and iOS and send the detailed description along with the notification? If the server is then unreachable because of overload, people would at least see up to roughly 2,000 characters of text. Google and Apple’s push infrastructure would probably fail long after the server used by the authorities.

The city and district reacted incredibly slowly. Munich police had already warned people at 7:05 p.m. not to leave their homes.

+++ATTENTION+++ Avoid the area around #OEZ—stay in your homes. Leave the streets!+++ — Munich Police, July 22, 2016

Katwarn took a full hour longer, during which even more harm could easily have occurred. At least one message was also timestamped 7:45 p.m. but delivered about 20 minutes later. Why can’t the police issue a warning themselves, or have a direct channel to the district or city?

Only people who installed the app or signed up for the SMS service receive notifications.

There’s a mechanism in mobile networks that could be used for similar alerts: Cell Broadcast. One message can be sent to every mobile device in a given area. In the US, this is called Wireless Emergency Alerts and is used for weather and terrorism threats, as well as child abductions. For example, it ignores the iPhone’s silent night mode, so it’s not universally popular or entirely uncontroversial.

All of this assumes that such an alert system is useful (I think it is) and used responsibly (I hope so). If someone sends an alert into a crowd without thinking, people could just as easily trample one another in a mass panic.