Telstra outage probe tests gap in critical infrastructure rules

Telstra is under an ACMA investigation into this week’s nationwide outage after Security of Critical Infrastructure Act reviewer Jill Slay said gaps in Australia’s critical-infrastructure settings may have left the carrier without an explicit duty to deal with the timing-system weakness behind the failure. The issue has moved past what broke inside Telstra’s network. It now goes to whether the rules around a national carrier’s resilience were specific enough before the network failed.

Canberra has a harder problem than a routine outage review. Earlier ABC reporting said Telstra had been warned about vulnerabilities tied to positioning, navigation and timing systems before the disruption. That raises the prospect of regulators finding a known risk, but not a clean legal hook that forced a fix. If the investigation lands there, the fallout would not stop with Telstra’s response.

ACMA and the broader law are being tested in different ways. The regulator can examine whether Telstra met standards already on the books. Slay’s point is more awkward for policymakers: whether the Security of Critical Infrastructure framework and related telco settings were written tightly enough to require carriers to harden a timing dependency before it failed.

The technical sequence is now clearer. ABC’s earlier explainer said the outage began about 4.30am AEST on 8 July, peaked at more than 7,000 reports on Downdetector by 6.42am, and disrupted services used by about 11 million customers for roughly 12.5 hours. Telstra has said the fault involved time synchronisation across network nodes. It is a quiet dependency until a mobile network loses its shared clock.

Telstra chief financial officer Michael Ackland told ABC the timing layer sits close to the network’s basic trust functions.

“It’s one of the ways that you authenticate what’s going on in the network. And the time synchronisation in those nodes wasn’t working as it should. We don’t know why yet.”
Michael Ackland, ABC News

That explanation narrows ACMA’s task. If authentication and timing are central to whether core mobile infrastructure keeps operating, investigators will need to ask whether existing outage, resilience and critical-infrastructure rules treated that dependency as essential, or only assumed it in the background. A risk can be familiar to engineers and still fit poorly inside a legal framework written around broader service-continuity duties.

Slay told ABC’s latest report the episode reinforced arguments she had already made in her review about protecting positioning, navigation and timing systems as Australia becomes more dependent on space-based services.

“I would say it underpins my concerns expressed in the review that we should be looking at the defence of [positioning, navigation and timing] as part of our reliance on space technology,”
Jill Slay, ABC News

At her first public appearance since the outage, The Guardian reported that Vicki Brady described timing systems as “very well-known” and “critical” in mobile networks, but could not explain why back-up measures failed. Brady has separately said Telstra’s network was built with “a lot of redundancy” and that the back-up breakdown would form part of the inquiry.

The distinction is practical, not academic. A finding that Telstra mishandled a known weakness would keep the pressure on one carrier. A finding that the legal settings did not squarely capture the risk would widen the issue to every operator relying on the same class of timing and authentication assumptions. After a week in which the outage was first treated as a technical fault, the sharper question is whether Australia’s telecoms rulebook had already fallen behind the network it was meant to protect.