The breakdown of emergency numbers on Wednesday June 2, 2021 revealed shortcomings at Orange. To the point that the government is asking the Telecoms Regulatory Authority to check, in essence, whether the operator is doing its job correctly. Orange's lack of responsiveness and understanding of the issues clearly appears on reading the report which has just been submitted to the Prime Minister. Six reported cases of death can be linked to the event. The breakdown affected the emergency numbers 15 (Samu), 17 (police), 18 (fire brigade) and 112 (single European number). Too much time to make key decisions The Orange teams took far too long to make key decisions during the degradation of their telephony services despite the messages coming from their customers. People from Orange have broadcast inaccurate messages about the time to return to normal. In addition, some Orange managers designated as people to contact in a crisis situation were difficult or even impossible to reach. The audit report was drawn up by Anssi (National Agency for the Security of Information Systems) with the assistance of IGAS (General Inspectorate of Social Affairs), IGA (General Inspectorate of administration), the CGE (the General Council for the Economy) and the CCED (the Commissariat for Defense Electronic Communications).The failure is due to the malfunction of the call servers, supplied by Italtel, the configuration of which was modified by an Orange technician on Wednesday June 2 at 4:44 p.m. The very significant impact of this failure is due to a manufacturer's computer bug, acknowledges the report. Nevertheless, the actions carried out by the technician would have in any case caused an unavailability of the service because the order of execution of the configuration commands was not the correct one. Without the equipment manufacturer's software bug, this unavailability would however have been short-lived, a maximum of 15 minutes. The way of modifying the configuration of the equipment in production by the operator is singled out. There was no test phase of the new configuration and it was installed simultaneously on all the call servers. The operations that led to the software bug on the call servers were not tested on the pre-production platform, because Orange did not consider this operation to be sensitive. In any case, this pre-production platform does not have equipment to simulate the increase in telephone traffic. Malfunctions were visible within 5 to 10 minutes after the configuration change.
It took 1 hour to become aware of the impact on emergency numbers The report is surprised that the implementation of a crisis management system by Orange adapted to the scale of the problems was slower than that of the state. One would expect Orange to have more accurate and responsive monitoring of its network. In particular, Orange took nearly 1 hour to become aware that the breakdown affected the emergency services in particular, 2 hours to inform the authorities and nearly 3 hours to set up a suitable system. “This is due to several internal dysfunctions at Orange” underlines the report.No crisis exercise simulating a software failure or a computer attack impacting the emergency number service has been carried out by Orange or organized by the State. Feedback on an incident in May 2018 did not benefit the operators or the call server project management team when a software bug was also the cause of the incident. There is a lack of detailed understanding of Italtel's product by Orange partly due to the fact that this technology is aging and therefore difficult to train. The explanations provided by Orange during certain interviews may have proved to be inaccurate. The crisis which significantly affected telephone communications on June 2 and 3, 2021 showed that the existing crisis system within Orange needed to be improved to take specifically take into account any malfunctions affecting the emergency services, in terms of response times on the one hand, and relations with the public authorities on the other.
No special measures were taken for emergency numbers In the Orange crisis management system, the quality of the subscriber – in this case the emergency services – is in no way an element of assessment used by the operator to characterize a crisis situation. There is therefore no particular measure planned for subscribers as sensitive as the emergency services, apart from a possible reinforced commercial approach with information via dedicated teams, and this only for those of them who have signed a contract. specifically with Orange Business Services.
Sequence of events at Orange: