Telco sent notification to wrong government email address

Similarly, Liberal senator Sarah Henderson, with ACMA investigating the outage, said her concern was “like putting Dracula in charge of the blood bank”.

Loading

It was not until 19 September that the minister, the department and the ACMA became aware of the extent of the outage and the loss of life associated with the network failure.

Speaking at Senate estimates on Wednesday, department secretary James Chisholm told Senators that “it would not complete the notice if it was sent to the wrong place. So it happens when the notice is given to the correct recipient. That was not the case.”

Hanson-young grilled Chisholm because the email remained unread for more than 24 hours, as department officials confirmed several times that her email inbox was not monitored. Authorities only discovered communications from Optus after they were notified of the outage by ACMA on September 19.

The department told Telcos that the old email address would still be monitored, but should not be relied upon as a viable reporting channel.

Loading

“This communication… was sent to the wrong address, which we told the industry several times. It would not be used as a source of reporting. We were not properly notified of the outage and in this case it was made by the regulator by Friday afternoon,” Chisholm said.

Chisholm repeatedly refused to answer a question from Hanson-Young about why an email forwarding system was not set up from the invalid email address. The assistant secretary said this was fine, but Optus had failed to report the correct address.

Kathleen Silleri, Assistant Secretary of the department’s Emergency Communications Division, said all telcos, including Optus, are aware of the correct email address, noting that the telco “uses the correct email address for all other outages.”

According to the department, Optus was notified of the changed email address on September 11 and confirmed to the department that it had updated its IT systems to integrate the change on September 12. Official testimony showed that 272 emails were successfully sent from Optus between September 11 and October 8.

During her testimony, ACMA chief Nerida O’Loughlin said the $12 million fine against Optus following an outage in November 2023 was not enough of a deterrent despite it being the biggest breach the watchdog has imposed.

“We would expect a significant penalty to make a difference to a company the size of Optus, which is clear at the time. We were confident at the time, and with the assurances Optus gave us that they had made changes to their systems and processes that gave us confidence that they would move forward and not be breached again,” O’Loughlin said.

The release of the emails during Senate estimates led to a fiery political attack against Wells during question time. Opposition leader Sussan Ley described the emails as “confidential” and suggested Wells had been caught in a lie about when he was aware of the outage.

Wells and his office repeatedly pointed to the Sept. 22 press conference. [the 18th] afternoon.” At the time, Wells said he was not aware of the extent of the outage or the deaths involved until the next day, in line with the testimony of both the ACMA and his department.

Wednesday’s line of attack followed question time on Tuesday, when the Coalition criticized Wells for only enacting triple zero custody 17 months after an independent review made the recommendation.

Hanson-Young will lead a Senate investigation into the event later this month following the failure of the initiative in the House of Representatives.

Cut through the noise of federal politics with news, views and expert analysis. Subscribers can sign up for our weekly Inside Politics Newsletter.