Optus sent the first notifications of its Triple Zero outage to an outdated and unmonitored government email address, where they went unnoticed for over 24 hours.
The government had previously said the first outage notifications from Optus, received on Thursday, September 18, were “pretty perfunctory” and downplayed the extent of the issue.
But at senate estimates, it was revealed that federal communications officials did not learn of the outage until 3.30pm on Friday September 19, after being tipped off by the Australian Communications and Media Authority (ACMA).
While Optus sent a pair of email notifications the previous day, they were to an incorrect and apparently unmonitored email address.
“We have systems in place for notification. That requires information to be sent to the right place. That email was not even sent to the right place,” deputy secretary of communications and media James Chisholm said.
“The ACMA publishes on its website the email addresses that the telcos are by law required to send notifications to … for all to see. It was not sent to that address.”
“It’s a redundant mailbox that we had told the industry not to use,” first assistant secretary Sam Grunhard added.
It appears the email address was changed sometime after July 1 this year.
New notification requirements placed on telcos led to a large volume of mixed notices being sent to a single inbox.
The department decided to set up new email addresses to better handle the volume and triage the notifcations.
Officials could not say if the old mailbox had a redirect or forwarding mechanism enabled to pass Triple Zero-related emails to the new address, and repeatedly rebuffed suggestions of a due diligence failure on their part.
When pressed on the issue, Chisholm was adamant that email forwarding on the department’s side “would not [have] resolved the Optus failure”.
Still, he said the communications department did not consider the notification process to be “completed” by Optus, due to the emailing error.
“Notification occurs when it is given to the right recipient,” he said.
“An email to an old email address in the department that incorrectly characterises the nature of an outages, does not satisfy … requirements.”
Chisholm said that the emails were only located when departmental officials searched their repositories after learning of the outage on the Friday afternoon, shortly before it was publicly disclosed by Optus.
“We were able to identify that email later when we scoured all content as part of an exercise to check whether anything had happened over that time, and we found in the old email address that someone had sent something through,” Chisholm said.
He said that telcos are required to email a number of stakeholders in the event of an outage, with the department being just one of those.
Officials added that Optus had correctly notified the department of all outages since July 1, except on this one occasion.
