Optus executives say staff failed to escalate information regarding the severity of a 14-hour Triple Zero outage in September caused by an incorrect firewall upgrade, which was linked to more than 450 failed calls and three deaths.
CEO Stephen Rue and members of Optus senior management were grilled for more than two hours during a Senate committee hearing at Parliament House in Canberra on Monday.
Company bosses admitted to several key failures by Optus staff and its networking partner Nokia, which included workers not attending a crucial meeting, not following correct processes, and not noticing outage warnings or informing their superiors.
While Optus previously estimated Triple Zero calls from more than 600 phones failed during its 18 September outage, the company has since revised that number to 455.
Optus Chairman John Arthur told the committee the outage was a “horrendous crisis”, while Rue said what happened that day was “unacceptable”.
“The initial mistake — a human error — occurred when the wrong process plan was selected for a routine firewall upgrade,” said Rue.
“The selected plan did not divert traffic before locking equipment inside the exchange that routes Triple Zero calls.
“ … This error was not detected because control steps were not followed, and alarms were not acted on at the time.”
‘Checks that should have been done were not done’
Personnel working for both Optus and Nokia “did not act upon the information that showed that the Triple Zero calls were not going through” on 18 September, Rue said.
“Instructions were provided by Optus to Nokia personnel to do a certain change,” he told the committee.
“And then, from then, the various checks were not picked up.”
Rue said engineers “misinterpreted” alerts which had suggested some Triple Zero calls were not going through following the firewall upgrade.
The wrong procedure was used and “checks that should have been done were not done by individuals”, he said.
“… This is totally personnel failure — it’s not a design failure, it’s not a control failure,” he added.
Rue admitted Optus did not detect the outage itself, and was instead first notified about failed Triple Zero calls by the South Australian Ambulance Service.
He defended Optus’s outsourcing of some call centre work offshore, but admitted workers at a call centre in the Philippines “should have escalated” calls from Optus customers who reported they had not been able to connect to Triple Zero.
Rue said Optus was now accelerating moves to “take back in-house network activities currently performed by Nokia, both onshore and offshore”.
Liberal Senator Dean Smith asked Rue why — as Optus admitted in its detailed submission to the committee — some “required members of the Optus core networks engineering team” were not present at a crucial meeting ahead of the planned firewall update.
Rue said he did not know why those team members had not been present, and admitted “they should have been”.
He said that was “the first point of failure”.
Optus says it is adding around 300 people to its Australian call centres ‘focused on Triple Zero and vulnerable customers’. Image: Shutterstock
Government and regulator ‘left in the dark’
Greens Senator and committee chair Sarah Hanson-Young alleged the federal government and industry regulator ACMA (Australian Communications and Media Authority) had been “left in the dark” by Optus during and soon after its 18 September outage.
She accused the telco of not updating authorities quickly enough when it discovered that many more calls had failed than the 10 it first noticed had not gone through to Triple Zero.
The outage began at 12:17am AEST on Thursday, 18 September, and was fixed by 2:34pm that day, according to Optus.
The company first communicated the outage to Communication Minister Anika Wells’s office at 2:34pm as well, just minutes before Rue and the rest of the Optus executive committee were advised at 2:51pm.
At that time, Optus stated only 10 calls had been affected.
Engineers identified at 7:50pm that at least 100 customers had been affected, according to the company’s submission to the committee — but ACMA and Wells’s office did not find out about this escalation in numbers until the following afternoon.
“The information that your organisation had told them the day before was wrong, and you let it sit there being wrong — devastatingly wrong, deadly wrong — for well over six hours,” Hanson-Young told Rue.
“I mean I just don’t think that is good enough.”
Optus’s chief corporate affairs and marketing officer, Felicity Ross, said she was told at 8:05pm on the day of the outage that at least 100 calls had been affected, but did not escalate it.
“Looking back, and given what I now know — and that it had not been escalated through other parts of the company — I definitely wish I had spoken to the CEO,” she said.
Rue defended Optus and said the information it had provided authorities was accurate at the time, and dismissed suggestions that the telco had misled the government.
“The judgement I had was that it was best to get the information accurately together, and then inform the regulator, the department, and the minister’s office,” he said.
Hanson-Young criticised Rue for first informing Optus’s parent company Singtel and Optus’s board soon after he learned about the 100 failed calls and the first two related fatalities at around 8am on the day after the outage.
He said he did not accept her suggestion that it was more important to Optus to protect itself and its profits than to provide safety and transparency, but cited “escalation failures at multiple times within the company”.
“There is no doubt that the timeline shows there were delays, there were mistakes made — there’s no doubt about that,” he said.
CEO pushes back against calls for resignation
Rue used the committee hearing to again defend himself against calls for his resignation in the wake of Optus’s latest scandal.
The company famously suffered a major data breach in 2022 and a one-day nationwide outage in November 2023, under previous CEO Kelly Bayer Rosmarin.
“Understandably, there are questions arising about my position, but I firmly believe that another change of leader at this time is not what Optus needs, or what our customers need,” Rue said.
“The disruption and uncertainty could actually set back the transformation underway and create further risks.”
Rue declined to comment when asked by Liberal Senator Sarah Henderson whether he had broken any Australian laws or regulations, or whether families of the victims from September’s outage wanted to speak with him or had sought compensation.
Henderson and Hanson-Young said the Senate committee would consider whether Rue had shown contempt for it by repeatedly not answering questions about the victims’ families.
Optus Chairman John Archer defended Rue, and said he had been recruited from NBN Co in 2024 with a primary accountability “to fix this company”.
Both Rue and Archer suggested Optus would not fire people until an independent review it commissioned into the latest outage — as well as reports by ACMA and the Senate committee — had been completed and reviewed.
Hanson-Young said Optus executives would be expected to return for further hearings of the committee, which were yet to be scheduled.
Legislation which took effect on Saturday, 1 November means telcos now face fines of up to $30 million if they do not report outages to ACMA and emergency services in real time, or do not test Triple Zero during upgrades and maintenance.
