Transcript: ABC Insiders 11/10/25
https://iview.abc.net.au/video/INCL2025105880406
David Speers
Well, the Triple Zero Network is one of those essentials in life that many of us have probably taken for granted. After last month’s Optus outage, however, we’re discovering more about the complexity of this system and where the vulnerabilities lie. Optus is under enormous pressure over its failures and on Tuesday the government introduced legislation to strengthen the powers of the new watchdog known as the Triple Zero Custodian. But what will change as a result of all of this and will these changes stop outages happening again in the future? We’ve heard plenty from the politicians this week, particularly the Senate estimates hearing into this. I’m keen to hear now the perspective of the telecommunications industry on all this. I’m David Spears on Ngunnawal country at Parliament House in Canberra. Welcome to Insiders on Background.
Well, Luke Coleman is the CEO of the Australian Telecommunications Alliance, the peak body for the telecommunications industry, and joins me now. Welcome. So, Luke, let’s start with that major Optus outage last month. We know it lasted for about 13 hours. We know more than 600 triple zero calls couldn’t connect. We know three people died. But do we know yet what actually went wrong?
Luke Coleman
We know some of the details that have come out publicly in the aftermath of the outage. Now, there are two investigations underway, so I don’t want to pre-empt what the outcomes of those investigations might be. But what Optus has come out and said is that there was what appears to be a relatively routine network upgrade to put a new firewall in place, so a cybersecurity upgrade, which appears to have cut off access to the triple zero system. So the normal phone network appears to have been operating as it usually is, phone calls were fine. As a result, it looks like this hasn’t set off an alarm in Optus to say ‘we’ve got a problem here’ because the network all appears to be working as normal.
So it’s quite unusual circumstances, what has happened here. When they have discovered that what appears to be a firewall upgrade has cut off access to triple zero, they’ve acted very quickly to try to change that. I wouldn’t want to go into a great amount of detail beyond that, but I think something interesting that it has revealed through this is that the triple zero ecosystem – I use the word ecosystem quite deliberately – because it is an ecosystem of multiple networks. You’ve got Telstra, Optus, TPG, Vodafone. You’ve got devices, your Apples, your Samsungs, your Google devices, and of course the role played by the emergency services operators themselves. All of those moving parts in the ecosystem need to work perfectly, and there are different regulatory obligations on different parts of that ecosystem. So I’m sure that that’s what these two investigations are going to get into the details of.
David Speers
Yeah, so they’re going to look at why. As you say, regular calls were still okay, but the emergency calls weren’t. Is it unusual that 12 or 13 hours goes by before this is realized? I mean, this isn’t the first outage, but is it, is that, is that unusual that it takes that long to work this out?
Luke Coleman
Emergency call volumes, as I understand it, can fluctuate a lot day to day. And so it might not have been immediately apparent that there was an outage, because the call volumes had dropped off. That’s really a question for either the emergency call person, which is operated by Telstra, or the operators themselves.
David Speers
Obviously, some customers were starting to ring and say, ‘We’ve got a problem.’
Luke Coleman
That’s right, that’s right. But as you would understand, if there are instances where it could just be a device issue or something unrelated to a network outage, when those calls might have gone into the call centre, and this is not at all to downplay how serious those circumstances are. But it would not immediately be apparent to a call centre operator that, oh, we’ve got a triple zero issue here. It could simply be that you’ve got a problem with your handset connecting to the network or other things. Obviously, that did come out through the process with tragic circumstances.
It wouldn’t immediately be apparent to someone working in a call centre that they’ve got a routine complaint from a customer that there was a widespread triple zero issue.
David Speers
And again, this will be something that the investigations will look at, but it appears the calls, just explain to us, they’re meant to, if the Optus network is down, they’re meant to redirect or camp on, as it’s called, to Telstra or another network, and that didn’t happen here? Is that clear?
Luke Coleman
So this is what’s really unique about the circumstances here, and this is where we get into the interplay between the networks and the devices themselves. So with the devices, yes, there’s something called Camp On. So this is a standard in your mobile device, whether you’ve got an iPhone or a Samsung or a Google handset. That if it is unable to connect to its home network, so you’ve got an Optus SIM card in your phone, it’ll automatically try to connect to Optus. If it can’t connect to Optus, it then starts scanning for any other available network. So it will look at different frequency bands that are available. It’ll find an available operator where there is one. And it’ll try and jump onto Telstra’s network to make that call.
David Speers
And all handsets should do that?
Luke Coleman
All handsets should do that, but I say ‘should’ because it is not an instant process. That process can take 15 to 30 seconds to occur. Different handsets can behave differently during an outage. We learnt this in the Optus outage which occurred back in 2023. It appears to be the case that it may have happened again here. Again, don’t want to pre-empt what might come out during the investigation.
David Speers
But this would mean if it was the handsets… That means more than 600 handsets had a problem. That seems unlikely.
Luke Coleman
Not necessarily. We really need to get into the detail of the investigation there. And we cannot say definitively if that was an issue across the board here.
David Speers
So at the moment, it’s unclear whether this was the failure to camp onto another network was an Optus problem or a handset problem.
Luke Coleman
So there’s a few things to keep in mind here. The point is right – we need to figure out what part of it was a network-related issue, what part was a device-related issue. What we would have seen, imagine yourself in a circumstance where you’re facing an emergency, you need to call triple zero. Your usual network is out of service. So you’re desperately trying to call triple zero and that process of camping onto another network might take 30 seconds, could even potentially take longer. That must feel like an absolute lifetime when you’re facing an emergency. So what do you do? You probably hang up and you try again. So what we don’t know yet, and again, what will hopefully come out during the course of these investigations is, were the issues due to phones’ inability to camp on to another network? Or was it Optus? Could it be because Optus’ usual network was still operational and available, and a phone might not have sought to have camped on to another network again? I don’t know the details. I’m not going to claim that I do, but there are a multitude of factors that could be involved that will need to be investigated.
David Speers
Then, after the outage is resolved, in the hours after all of this, this is on September 18, Optus emails the Department of Communications and others to let them know. It sent the email to the wrong address at the communications department we now know. And it said in the email that only 10 calls were impacted. We know it was actually more than 600. Is it clear yet how it got that so wrong?
Luke Coleman
Having worked in a telco myself in the past, I’ve been through a few outages. And in the middle of an outage, you are just trying to figure out what has happened. It is the fog of war when you’re in an outage. There is no perfect information.
And so while I don’t know the precise timeline of who was informed and when, that will again be a factor of these investigations.
David Speers
But presumably, it was some sort of log that it’s looked at and said, ‘Oh, it’s only 10 calls.’
Luke Coleman
It takes time to go through call logs to figure out how many devices have sought to connect to the network. You do not have all of that information up front. And so they would have been doing their absolute utmost to provide whatever information they had at the time. As things develop, as you get more clarity about the exact nature of the adage, that unfortunately takes time. And so that would be the rationale for why they’ve sought to communicate with the best information that they had available at the time. More information has come to light over the next 24 hours.
David Speers
But it’s true, isn’t it, that telcos are required to provide real-time information? To the authorities, to the department, to the regulator ACMA?
Luke Coleman
The information that is available to them at the time. So there’s a couple of regulatory instruments in play here: Telcos have an obligation to communicate with customers during an outage. And we need to make a distinction here between a network outage and a triple zero outage. They might sound like the same thing, but they are two different things. That during a network outage, operators have an obligation to message customers, depending on the scale of the outage, how long they’re expected to be out for. There are new rules coming into force on the 1st of November this year that put new obligations on carriers to also communicate with a range of regulators. So that would be the ACMA, as you would expect, with the department. I believe it’s with the TIO, the Telecommunications Industry Ombudsman.
David Speers
But they’re not required to do that now?
Luke Coleman
Those rules do not come into effect until the 1st of November. So there are a range of different rules…
David Speers
This is interesting because the government’s been arguing that Optus failed in its existing obligations to let the authorities know. You’re suggesting they had no obligation to do that.
Luke Coleman
There are other existing obligations. There’s layers of different regulatory protections here. So I couldn’t comment with authority on precisely which ones the government has said Optus has failed to uphold in this instance. But I can say there are new rules that are coming into effect on the 1st of November, which add further obligations on operators in the exact nature in which they communicate with government and regulators.
David Speers
All right, but I mean, yeah, this really goes to, I mean, obviously there’s the outage, but then what follows, providing incorrect and delayed information to the government and to the regulator ACMA. And this does seem to be where the anger, the fury from the government is being directed at Optus. But you’re saying maybe they didn’t have that obligation.
Luke Coleman
What I’m saying is that, due to the nature of the information that would have been available in the immediate aftermath of the outage, they wouldn’t have been able to say exactly what had occurred and the scale of what had occurred. What I’m also saying is that new obligations coming into force on the 1st of November. I can’t comment with authority on what existing obligations they may or may not have met during that outage.
David Speers
Surely there should be clear though to industry. Surely, what its obligations are in a triple zero outage.
Luke Coleman
There are a range of new rules that have come into place. Following the last major Optus outage, these new rules, a number of them come into play on the 1st of November.
David Speers
But right now, and last month when this was all happening, it is unclear what the rules are. Whose fault is that? The industry doesn’t know what the rules are.
Luke Coleman
No, no, no – I don’t think that’s right to say that they don’t know what the rules are. There are certain rules that are coming into effect on the 1st of November. But last month when this was happening in September there are already a range of obligations on carriers with triple zero that ACMA has the authority to enforce for non-compliance. This is what occurred after the last Optus outage. Optus copped a $12 million fine from memory after the last Optus outage. So there are existing rules in place. We have a regulator in place in the ACMA that enforces those rules. There are additional rules coming into play, but they don’t formally come into place until the 1st of November.
David Speers
Okay. So, given there was an outage, there was the failure to let authorities know until a full 24 hours later, there was a bit of incorrect information about 10 calls rather than more than 600 calls. What do you think? Given that you mentioned the penalty they copped last time, there was an outage that no lives were lost last time, but on this occasion there were. What sort of penalty would be reasonable for Optus to cop now?
Luke Coleman
I wouldn’t put a dollar figure on it, but I would expect that the nature of ACMA’s investigation, similar to the last Optus outage, they will look at what legal obligations does Optus has during an outage and will enforce accordingly to that.
Now, interestingly, on the question of what’s an appropriate fine, this has come up during this week, during Senate estimates in particular – there is a bill before parliament right now, which is going to give ACMA much stronger enforcement powers and the ability to impose much larger fines. Now, that bill, it is currently before parliament, hasn’t passed through parliament yet. That’s called the Enhancing Consumer Safeguards Bill. So it is already the case, well before this particular incident occurred, there was already legislation before the parliament that is going to give the ACMA much more heft when it comes to the way that it can impose fines.
David Speers
And do you think the Optus CEO, Stephen Rue should survive? Should he go?
Luke Coleman
Stephen Rue is the right guy to be running Optus. Yes, he should absolutely stay. He’s been in that role for less than a year. You can’t expect an individual to completely change a company as substantial as Optus in less than 12 months. He is absolutely the right man to stay in that role.
David Speers
Should he be doing more, though, to explain what happened?
Luke Coleman
I think Stephen Rue has done a great job of seeking to explain what’s happened. If you look at what occurred, within 24 hours, he was fronting the media. He was in front of the cameras, explaining with the information that was available to him at the time. And I think that there is a good reason why you would wait until that Friday afternoon.
David Speers
You know, there’s been a lot of questions about why didn’t you front the cameras on Thursday?
Luke Coleman
You need to know, with some authority, what has transpired – and that takes time. And so, as soon as they had that information, he fronted the cameras. He did it again the next day and the next day and the next day. I think the transparency that we have seen from Stephen Rue is bang on— that he’s gone above and beyond in communicating. And so, yes, I do think he is the right man to stay in the role.
David Speers
But in fairness, we still don’t know from Optus why incorrect information was initially provided to authorities. Why it was sent to the wrong email address, why exactly this happened at all. There’s still a bit we don’t know.
Luke Coleman
That’s right, and that’s why we’ve got two investigations underway. There’s the ACMA investigation that will look into Optus’s responsibilities when it comes to compliance with the rules. There is the independent Kerry Schott investigation, I don’t want to pre-empt the outcomes of either of those things.
David Speers
Let’s look at what the government’s doing. The legislation it introduced on Tuesday, as you indicate, does seek to strengthen triple zero safeguards. There’s this triple zero custodian that’s now being written into law. Is it clear to you what exactly this triple zero custodian will do?
Luke Coleman
So this was one of the recommendations of the Bean Review. So the Bean Review, after the 2023 Optus outage, former ACMA chair Richard Bean was asked to do an investigation.
David Speers
Deputy chair.
Luke Coleman
Yeah, deputy chair, well, and he was acting chair for a period. But you’re correct, he was the deputy chair. So, he performed this review, came up with 18 recommendations, from memory, which are being brought into force. One of those key recommendations was the establishment of a custodian. Now, the reason that this recommendation was made, what was revealed during that review process, was there are a range of different regulatory obligations on different elements of the triple zero ecosystem. There are the responsibilities of the network operators themselves. There are standards, technical standards that apply to device makers such as camp-on, which we discussed earlier. Of course, there is the role that is played by the emergency services operators and Telstra as the operator of the triple zero service itself. So there are different regulatory and legal obligations throughout that ecosystem.
So the triple zero custodian was proposed to have an end-to-end overview of that ecosystem and responsibility for that ecosystem. So the function to establish the triple zero custodian was established within the Department of Communications in March of this year. The legislation to give that custodian legal teeth is currently before the Parliament.
David Speers
And does anything change when this law passes?
Luke Coleman
So what the law will allow the new custodian role to do… it will have powers to compel telcos to share information, for example. So at the moment, there are powers that exist within the ACMA that compel telcos to share information or record-keeping rules. That currently don’t exist within the department because it is not a regulator. So that is one of the features of the custodian that will basically give greater legal powers to the custodian role within the department. To compel that sharing of information, along with a range of other things.
David Speers
So this custodian, in the example of what happened in September, it could say to Opus during the event or immediately after the event, ‘We want all the information about your upgrade, what testing was done or not done beforehand, emails that went back and forth.’ It can compel anything.
Luke Coleman
We’ll have to see exactly how it is established once the legislation has made its way through Parliament, assuming that it will be passed through Parliament. But you have a situation at the moment where the department may well ask an operator for very sensitive information when it comes to the operational nature of their networks during an outage. But there is no legal requirement on that operator to provide that information. You might say, ‘Well, why wouldn’t they just share it anyway?’ Well, first of all, is it going to be commercially sensitive? Is it going to come up in a legal case? Are there any protections around that information so that if there is a legal case? Down the line, could it potentially be used? Those protections exist within the regulators so operators do have, I shouldn’t use the word ‘safe harbour’ because that is not the exact case here, but they have a degree of legal protection around the nature of the information that they’re sharing that would exist within that custodian that currently doesn’t exist within the department’s
David Speers
Right, OK, so it can compel all of that information.
Luke Coleman
The legislation will go into the nature of how that occurs, but yeah, there are existing examples of how that that happens today.
David Speers
Can it direct a company, a telco like Optus, to do something? Either, you know, you can’t proceed with that firewall upgrade or you must do this. Can it compel?
Luke Coleman
I’m simply not in a position to answer that at this point until the legislation’s passed and the office is established. There is precedent – I would point you towards other pieces of legislation, like let’s look at the Security of Critical Infrastructure Act, for example, or the SOCI Act, which telcos are also subject to. So within other pieces of legislation, there are powers to compel operators to do certain things, whether you’re a telco or another critical infrastructure operator, that that can occur. This triple zero custodian will be established just with overview of the triple zero network. But again, I don’t want to hazard a guess on what might happen.
David Speers
One of the other recommendations of that Bean review after the 2023 Optus outage was for telcos to provide temporary disaster roaming during natural disasters, like a bushfire, a flood, whatever, so that people affected can stay connected. Why hasn’t that happened yet?
Luke Coleman
There are layers of protections in place during an outage and temporary disaster roaming is a very high technical standard to meet compared to other things like camp-on that we’ve discussed already. So camp-on is a very basic protection that exists. Temporary disaster roaming is extremely technically complex to implement. The operators have had discussions about how you would implement it, but we shouldn’t simply think this is a matter of flicking a switch to implement.
Let me give you an example: let’s say you’re in a disaster area. There’s a flood and that flood has taken out the Telstra Tower in that area. Let’s say there’s 10,000 people connected to that Telstra tower that immediately need to roam onto an Optus tower. Now, that Optus tower has been configured for, you know, they usually expect maybe there’s about 10,000 people in that area. So it’s got the capacity for those 10,000. All of a sudden, 10,000 users jump onto that network – now, that could potentially have a domino effect where you overwhelm that network with all of these additional users going onto it, and there have been examples around the world of where this has occurred. You get an influx of new users onto a network, and instead of having just one network down, you wind up with both networks down.
David Speers
So you’re saying there’s a risk that if you do this, you could have a cascading impact on the networks that bring the whole thing down.
Luke Coleman
What I’m saying is it’s something that network operators need to very carefully plan and account for. Because when you’re investing in your network, when you’re building a new base station out in a country town, you know how many people are in that town, how many trucks drive through on an average day. So you build enough capacity in that network for a certain amount of usage. You aren’t necessarily configuring your network to also have all of your competitors’ customers come onto your network for a short amount of time. There are ways of engineering the network so that every telco is going to build additional capacity in their network. But do you need to have enough capacity to all of a sudden take all of your competitors’ customers onto your network? That’s going to cost a lot more. Where’s that money going to come from? Well, does that mean the prices have to go up? These things all need to be taken into consideration.
David Speers
If this happens, it’s likely customers will have to pay more for that redundancy.
Luke Coleman
It will really depend how system is ultimately designed. If there were obligations on telcos to build substantially more capacity into their networks than they currently have, well, the reality is that costs money. That needs to come from somewhere.
David Speers
Final question, Luke Coleman, given the steps that the government’s taking, that the telcos are taking, what’s your best assessment of the likelihood of another triple zero outage occurring?
Luke Coleman
Something that’s really important to remember is network outages occur every day. Every day. They are usually on a very small scale. It’s usually in a local area. They’re normally fixed within a couple of hours, I should say. Every network outage is not necessarily a triple zero outage. There are layers of protection. There are alternative networks available. If you’re at home and you’re on the NBN on your Wi-Fi, you can make calls via Wi-Fi. So I think it’s important for Australians to remember there is no bulletproof network that is always going to be up 100% of the time. There are layers of protection in place through alternative networks that you can get access to.
But every telco wants the triple zero system to be as robust as possible. This has been a huge reminder of that this week. And I think it’s quite right that we’ve got investigations underway that are saying, well, where were the flaws that occurred this week? What new protections do we need to put in place to ensure that it is as robust as possible? The triple zero custodian is going to play a role in that as well. But it is safe to say, industry is absolutely united in their approach to saying we will work together to make triple zero as robust as it can be. And to be as trusted as it can be for Australians when they’re facing an emergency.
David Speers
Luke Coleman, really interesting to hear the industry’s perspective on all of this. Thanks for talking to us.
Luke Coleman
Thanks so much for having me.
