Six weeks after the incident that caused an outage in the routing of emergency numbers on June 2, the government released its investigation report on Thursday.
He does not blame Orange excessively for the origin of the failure, but nevertheless denounces its crisis management marked by failures in the transmission of information.
"Do not cast shame on anyone, rather draw lessons for the future": the Secretary of State for Digital Cédric O did not want to blame Orange excessively, concerning the incident of June 2 on the breakdown of emergency numbers, when the Anssi report on this event was published on Thursday.
Unveiled six weeks after the blackout which had prevented some of the calls to 15, 17, 18 and 112 from being routed, this report, conducted jointly by the National Information Systems Security Agency with several state agencies, details the origin of the incident and still puts Orange on the hook for its "slowness" in crisis management.
>> Find Europe midi in replay and podcast here
Responsibility shared between Orange and its equipment manufacturer
Thanks to "around thirty interviews" carried out over the past few weeks, the various bodies in charge of the assessment report have shown that the failure was due to "hazardous orders" initiated by Orange "to allow an increase. calling capabilities ".
Concretely, the memory of the equipment responsible for accumulating calls was full "after a few hundred calls", thus preventing the last connected from entering into contact with the emergency services, according to the explanations provided to the press by a representative of Anssi.
What does Orange be responsible for?
It is not that simple.
Indeed, the actions taken by the operator triggered "a pre-existing software bug on the equipment".
"This bug then blocked the equipment and made it uncontrollable," says the report.
The equipment manufacturer, whose name has never been revealed, therefore also has its share of responsibility.
This failure affected "within a very short time" all of Orange's six "call servers" dedicated to emergency calls, an unprecedented scenario and for which Orange is singled out for "the absence of a device. specific in the event of a national breakdown ".
The outage potentially caused six deaths
However, the report does not charge the operator, who alone manages all calls to emergency numbers dispatched on his old copper network. Cédric O also stressed that the conclusions of the State report largely overlapped with the one conducted internally by Orange and made public on June 11. The Secretary of State thus highlighted the good reactivity of the operator in identifying the incident. On the other hand, Anssi tackles, in its report, the "too slow rise of the Orange crisis system, given the criticality of emergency numbers".
"Orange took nearly an hour to realize that the outage affected the emergency services in particular, two hours to inform the authorities and nearly three hours to put in place an appropriate system. This is due to several malfunctions. internal to Orange, ”notes the document. In total, nearly 12,000 calls could not be routed. The company is also criticized for its "lack of technical advice" to the authorities during the crisis.
The General Inspectorate of Social Affairs, a stakeholder in the report, thus specified that the outage, triggered around 4:45 p.m., had potentially caused six deaths.
A balance sheet that could have been higher without "the remarkable resilience of the emergency services", applauded by Cédric O. However, the solution of temporary ten-digit numbers, implemented quickly after the start of the crisis, did not , it seems, not very helpful.
"In these work-around attempts, it is necessary to underline an ambiguity on the distribution of the 'ten-digit' numbers (...) revealed when this solution did not constitute a workaround and without the operator having advised against this solution when it is necessary. has had knowledge. "
Areas for improvement in the event of a future crisis
Last point of the state report: the future. The goal is that this kind of incident does not happen again. "The plan will include, in particular, the implementation of specific technical supervision and a specific alert escalation system for emergency calls as well as the implementation of a collaboration structure with third-party operators in the event of an emergency. 'urgency,' the document reads. The legal framework will also evolve "in order to strengthen the resilience and security obligations applicable to electronic communications operators with regard to the routing of emergency calls."
The government also wants to impose the organization within six months, then regularly over the next few years, of a crisis exercise involving Orange, other operators and state services. It will also seize the Arcep, the telecoms gendarme, so that it assesses "the good respect by the operator of its regulatory obligations in force". This authority could, if necessary, put the operator on notice and force him to change his practices, if he does not do so by himself by then.