Posted on Jul 22, 2021, 11:46 AMUpdated Jul 22, 2021, 11:59 AM
The report is only 36 pages long, but it is harsh on Orange. The government published Thursday its investigation into the June 2 blackout at the operator which had disrupted 11,000 calls to emergency numbers (about 1 in 10) and caused, directly or indirectly, at least 6 deaths. The report was produced by Anssi (national agency in charge of information systems security), two general inspectorates (administration and social affairs) as well as the Defense Electronic Communications Commission (CCED).
“The goal is not to cast shame on so and so, but to draw the consequences so that this does not happen again”, assures Cédric O, the secretary of state for digital. However, Orange has been doubly at fault. “There were shortcomings both in the processes and in the management of the crisis itself,” explains the Minister.
Arcep, the telecoms regulator, will therefore be called upon to verify whether Orange has failed in its regulatory obligations. If so, the sector gendarme can give notice to the operator. And as a last resort, impose a fine of up to 3% of turnover.
A crisis unit “too slow”
As a reminder, the outage occurred around 4:45 p.m. on June 2 when Orange intervened on its networks to deal with an increase, observed throughout 2020, in voice traffic, in particular to emergency numbers. The intervention took place on six devices (call servers) from Italian Italtel. These devices are used to convert calls made using PSTN (an old technology used by emergency numbers) to IP, the modern benchmark technology.
However, this intervention triggered a pre-existing software bug, which blocked the equipment in question, and made it uncontrollable. However, the software bug is not the only culprit. Orange’s intervention alone would have failed calls no matter what, according to the report. “Orange has carried out somewhat risky orders, within a limited timeframe,” regrets Antoine Berthier, from Anssi. Clearly, Orange should have considered this intervention as sensitive and pre-tested it on just one of these 6 devices.
Then the group “delayed in fully understanding the effects of the dysfunction”. Given the seriousness of the situation, Orange should have alerted the Ministry of the Interior, in accordance with the law, from 5.40 p.m. Which he did only an hour later, and only after the latter had asked him for details. Then, around 6:45 p.m., Orange did indeed set up a crisis unit. But it was “too slow” to gain momentum. This penalized the feedback of information between Orange and the State services.
Notify the Samu or the police by SMS
“A certain number of prefectures and emergency services had difficulty establishing a link with Orange officials,” explains Anssi, who cites, for example, Bouches-du-Rhone, Haute-Garonne and even the sappers. Paris firefighters. Worse, once contact was established, “Orange did not provide […] real advice and decision support. Generally speaking, Orange’s messages seem above all to have been intended to reassure, even to make people wait, as one would do in a traditional commercial relationship ”.
The report also makes recommendations. For example, set up specific supervision for emergency calls, or activate a crisis unit 30 minutes after a failure concerning these numbers – as Orange suggests in its own audit. Another measure is to be able to contact the police or the Samu by SMS. In six months, a first crisis exercise simulating a breakdown will also take place between the State, the emergency services and the operators.