Optus used wrong email address to inform gov of Triple Zero outage

Optus sent the first notifications of its Triple Zero outage to a recently-retired and unmonitored government email address, where they went unnoticed for over 24 hours.

The government had previously said the first outage notifications from Optus, received on Thursday, September 18, were “pretty perfunctory” and downplayed the extent of the issue.

But at senate estimates, it was revealed that federal communications officials did not learn of the outage until 3.30pm on Friday September 19, after being tipped off by the Australian Communications and Media Authority (ACMA).

While Optus sent a pair of email notifications the previous day, they were to an email address that had been replaced the previous week.

“We have systems in place for notification. That requires information to be sent to the right place. That email was not even sent to the right place,” deputy secretary of communications and media James Chisholm said.

“The ACMA publishes on its website the email addresses that the telcos are by law required to send notifications to … for all to see. It was not sent to that address.”

“It’s a redundant mailbox that we had told the industry not to use,” first assistant secretary Sam Grunhard added.

Grunhard said that the new email address was created on August 27, and telcos were advised of the change on September 11 - only a week before the Optus outage.

However, he said Optus informed the department on September 12 that they "had conducted an IT upgrade to change the address where notifications would be sent to the correct [new] address."

Grunhard also said that Optus managed to correctly send 272 notifications to the new address.

"The one that was sent to the wrong address is the one that we've been discussing," he added.

There were repeated questions over the extent to which the old address and mailbox was monitored during the transition.

Officials could not say if the old mailbox had a redirect or forwarding mechanism enabled to pass Triple Zero-related emails to the new address, and repeatedly rebuffed suggestions of a due diligence failure on their part. 

Chisholm said the communications department did not consider the notification process to be “completed” by Optus, due to the emailing error.

“Notification occurs when it is given to the right recipient,” he said.

"An email to an old email address in the department that incorrectly characterises the nature of an outages, does not satisfy ... requirements."

Chisholm said that the emails were only located when departmental officials searched their repositories after learning of the outage on the Friday afternoon, shortly before it was publicly disclosed by Optus.

“We were able to identify that email later when we scoured all content as part of an exercise to check whether anything had happened over that time, and we found in the old email address that someone had sent something through,” Chisholm said.

He said that telcos are required to email a number of stakeholders in the event of an outage, with the department being just one of those.