Federal government agencies and scientists have been warning Telstra for months that it was vulnerable to the type of bugs that brought Australia’s largest mobile network to its knees this week, the ABC reports.
For years, public warnings from government agencies and submissions from researchers have pointed to a scenario affecting telecom companies that now looks prophetic: cascading problems caused by a single point of technical failure related to timing.
On Wednesday, that risk was no longer hypothetical.
Telstra discovered the issue at around 4.30am, affecting “a number of nodes that help track time on our mobile network”.
By the time services were largely restored, the telecom company had ruled out a cyber attack as the source of the outage and instead pointed to a software bug affecting timing.
While the timing system and the satellite systems it predominantly relies on are little known to the public, they have been repeatedly cited as major potential points of failure, long before this failure, which one expert said was Australia’s first national timing infrastructure failure.
Telstra was contacted for comment but did not respond by deadline.
Why telecom companies need to know the time
- GPS is best known as a technology that helps people navigate, but it also serves a lesser-known function: transmitting time and location.
- Many industries use these time signals to ensure that various parts of their systems keep time accurately.
- Modern infrastructure depends on individual computers, payment systems, data centers, and transport networks to negotiate what happened and when.
- For telecommunications networks, this is important for functions such as transferring calls and data between mobile towers so that they reach the correct recipient.
At a press conference on Wednesday, Telstra chief financial officer Michael Eckland attributed the glitch to a “time synchronization issue” caused by “a glitch in the software that resets the GPS timer.”
Swinburne University professor Allison Kiely, an expert in positioning, navigation and timing, told the ABC it was this scenario she raised when she approached Telstra earlier this year in an attempt to gain support for a proposed critical infrastructure resilience research centre.
Professor Kiely said the proposal to telecoms companies and other critical infrastructure operators was that they needed to identify common points of failure before failures were discovered.
“We have reached out to all critical infrastructure sectors to tell them we must act now,”
she said.
The Australian Government-run Center for Cybersecurity and Infrastructure Security has also repeatedly highlighted that timing is a major issue for critical infrastructure providers.
In 2024, it issued a public warning that “Australia’s critical infrastructure is increasingly reliant on the provision of location, navigation and timing data.”
Last October, another alert from the center noted that “critical communications” depend on these timing systems, including space-based satellites. It confirmed legal obligations to provide suppliers with backups if these systems fail.
Read more about Telstra disconnection
The warning was issued around the same time that the federal government established a new legal requirement for critical telecommunications providers to maintain a risk management program covering material hazards and mitigation measures.
The government’s guidance on how to comply with this new requirement explicitly mentions preparing for anything that could cause damage to systems that rely “on satellite and navigation technology,” such as time telling.
A Home Office spokesman confirmed Telstra had provided it with its risk management programme.
Loading…
Communications Minister Annika Wells’ office declined to comment on whether she was satisfied Telstra was prepared for these types of problems.
Experts outside government have also been sounding the alarm about Australia’s dependence on GPS for almost 20 years.
Back in 2008, University of Adelaide professor Don Sinnott told a Senate inquiry that GPS was used to accurately determine time, on which telecommunications, banking and trade depend to a “little appreciated degree.”
Recently, interference has become an almost daily occurrence in the Russian-Ukrainian war and has even affected ships in the Strait of Hormuz area.
Much of the academic and government policy on GPS vulnerabilities has focused on jamming and spoofing, but experts say that same reliance on satellite signals also creates temporary risks if systems fail.
First suspected nationwide outage caused by timing issues
Professor Keeley said Mr Ackland’s explanation of what happened raised questions about the sustainability of Telstra’s timing systems.
“If one software bug can break the (time) architecture of a significant portion of their network, then there is a general expectation that they are aware of individual points of failure,” she said.
Professor Keeley gave the analogy of a wall clock and a clock on the microwave in your home. These are independent clocks, but they can still have a common point of failure.
If one watch breaks, the other will likely continue to work. But if the power goes out in the house, both may lose track of time.
Telstra is Australia’s largest telecommunications service provider and the network outage has caused widespread chaos. (ABC News: Christopher Gillette)
Andrew Dempster, a professor at UNSW’s Australian Space Engineering Research Centre, said he could not remember another timing glitch that had caused disruption on this scale in Australia.
Professor Dempster said that while the outage appeared to indicate a glitch rather than GPS manipulation, it did demonstrate how vulnerable GPS-based timing systems can be.
“People don’t realize that GPS timing is the most important thing in terms of how vulnerabilities can mess up everyday life,”
– he said.
Professor Kiely said the failure raised questions about whether Telstra’s primary and backup timing systems had a common point of failure.
Preparing for time disruptions
Professor Keeley said preventing problems like this required multiple timing sources that could be checked against each other before a bad signal or software error passed through connected systems.
Time tracking technology causes Telstra to crash
She said there was a need to test these systems more thoroughly across different sectors and to develop a framework to enable critical infrastructure providers to prepare risk mitigation plans.
She said such a function could be performed by a national time centre, similar to the UK’s recently established National Time Centre.
Professor Dempster said Australia should also remove practical barriers to GPS robustness testing, as testing systems for immunity to interference requires transmission in a protected radio band.
Australia needs to “create regimes (…) where testing can be done safely”, he said.
But Professor Kiely said liability was not limited to Telstra or other telecoms companies.
Other industries that depend on telecommunications networks have also had to realize how much their own resilience depends on how much those networks remain online.
“One system goes down, telecommunications go down, and suddenly you see a breakdown in transportation. Disruption in transport leads to disruptions in cargo transportation and logistics. The list goes on,” she said.
Loading…