Optus 2023: The Routing Change That Disconnected Millions of Australians
Optus suffered a national whole-of-network outage in November 2023 after routing changes destabilized its core, disrupting millions of customers and exposing serious weaknesses in emergency-call fallback and outage communications.
The outage removed connectivity across a national carrier
On November 8, 2023, Optus experienced a whole-of-network outage that disrupted mobile and fixed services across Australia. Consumers, businesses, hospitals and government services were affected, and the event quickly became a national infrastructure issue. Government review material emphasized that modern society depends on telecommunications for far more than ordinary conversation. Payments, health services, transport coordination and emergency communication can all share the same carrier, so a core-network failure propagates into institutions that are not themselves part of the telecom industry.[1] For reliability engineering, the broader lesson is carrier resilience requires staged routing changes, truthful health signaling and end-to-end emergency fallback tests that include real device behavior during total core failure. A mature design assumes local faults will occur and asks explicitly how far they can propagate before isolation or fallback takes over.
Telecom concentration turns network faults into societal faults
Resilience has to be assessed across dependent services because the blast radius of a carrier outage includes every organization that treats connectivity as an always-available utility.
A routing change destabilized the core network
Optus publicly described the outage as beginning after changes to routing information following a software upgrade on its network. The resulting instability disconnected key network elements and required a controlled restoration. The technical theme resembles other carrier outages: routing is programmable infrastructure, and a change that is logically valid in one context can distribute harmful state at enormous speed. Core-network automation therefore needs staged rollout, route validation and explicit protections against unexpected announcements.[2] That distinction matters because critical infrastructure is judged by continuity of service, not by the sophistication of any single component. In practice, carrier resilience requires staged routing changes, truthful health signaling and end-to-end emergency fallback tests that include real device behavior during total core failure has to be treated as an architectural requirement rather than an operational aspiration.
Routing policy is executable code for the network
Operators need the same deployment discipline used for high-risk software releases: preproduction testing, canaries, telemetry gates and rapid rollback before a change reaches the whole core.
Emergency calling did not fail in a simple all-or-nothing way
The post-incident review found that some mobile handsets were unable to reach Triple Zero through alternative networks. Certain Optus base stations remained radio-visible even though they could not complete calls through the failed core, so some phones stayed attached instead of camping onto another carrier. This illustrates a subtle systems problem: a component can appear alive enough to attract clients while being too impaired to provide the service those clients need.[3] The case therefore rewards a systems view. Engineers have to examine software, network topology, operating procedures, alarms, recovery access and organizational authority together, because carrier resilience requires staged routing changes, truthful health signaling and end-to-end emergency fallback tests that include real device behavior during total core failure only works when all of those layers support it.
Failover requires accurate failure signaling
A degraded component should not continue advertising availability when doing so prevents users from discovering a working alternative. Health state has to be communicated across layers, including radio access and device behavior.
The outage exposed limitations in network wilting and fallback behavior
Australia’s review examined the practice of ‘wilting,’ in which a mobile carrier powers down radio signals during certain failures so emergency callers can attach to another network. Optus reported that some 4G and 5G elements wilted automatically while parts of the 3G environment remained live. That uneven behavior helped explain why emergency fallback did not work consistently. A backup path is only useful if the primary path fails in a way that actually releases users to the backup.[4] The enduring point is less about one historical product than about failure containment. Carrier resilience requires staged routing changes, truthful health signaling and end-to-end emergency fallback tests that include real device behavior during total core failure is what prevents a routine defect, bad update or hostile action from becoming a public-service emergency.
Fallback mechanisms need end-to-end testing
Testing a backup in isolation is insufficient. Engineers must verify that real devices detect failure, detach from the primary network and complete emergency calls through an alternate carrier under realistic outage conditions.
Communication failures amplified frustration during the technical outage
Customers and public agencies criticized the speed and clarity of information provided during the event. The Bean Review later recommended enforceable requirements for how carriers communicate during major outages. This is an operational software lesson as much as a public-relations lesson: status pages, notification systems and customer channels should be designed to remain available independently of the network they describe, and incident teams need preplanned messages for degraded connectivity scenarios.[1] For reliability engineering, the broader lesson is carrier resilience requires staged routing changes, truthful health signaling and end-to-end emergency fallback tests that include real device behavior during total core failure. A mature design assumes local faults will occur and asks explicitly how far they can propagate before isolation or fallback takes over.
Regulators found serious breaches involving Triple Zero obligations
ACMA’s investigation found failures connected to emergency-call access and later announced substantial penalties. The regulator reported that more than two thousand people were unable to access the emergency call service during the outage and that required welfare checks were also missed. Those findings make clear that carrier reliability is not measured only by uptime percentages. Specific protected services carry legal and safety obligations that require stronger engineering guarantees than ordinary traffic.[5] That distinction matters because critical infrastructure is judged by continuity of service, not by the sophistication of any single component. In practice, carrier resilience requires staged routing changes, truthful health signaling and end-to-end emergency fallback tests that include real device behavior during total core failure has to be treated as an architectural requirement rather than an operational aspiration.
The Australian response focused on ecosystem-level resilience
The government accepted all 18 recommendations from the post-incident review, including stronger outage communications, testing of Triple Zero behavior and clearer oversight of the emergency-call system. The response recognized that no carrier can promise never to fail. The practical goal is to make failures more observable, easier to route around and less dangerous to people who need emergency service. That requires coordination among carriers, regulators, device behavior and emergency-call infrastructure.[1] The case therefore rewards a systems view. Engineers have to examine software, network topology, operating procedures, alarms, recovery access and organizational authority together, because carrier resilience requires staged routing changes, truthful health signaling and end-to-end emergency fallback tests that include real device behavior during total core failure only works when all of those layers support it.
Why the Optus outage belongs in software history
Optus 2023 shows how programmable routing, mobile radio behavior and emergency-call fallback interact as one system. The initiating network change mattered, but the lasting lesson came from the secondary failures: devices that remained attached to unusable infrastructure, incomplete fallback behavior and weak communication during recovery. Reliable software engineering has to cover the whole path from control-plane change to what an end user’s handset does when the core disappears.[3] The enduring point is less about one historical product than about failure containment. Carrier resilience requires staged routing changes, truthful health signaling and end-to-end emergency fallback tests that include real device behavior during total core failure is what prevents a routine defect, bad update or hostile action from becoming a public-service emergency.
Works Cited
- 01Australian Government — Review into the Optus Outage of 8 November 2023 infrastructure.gov.au
- 02Australian Government — Optus Outage Final Report infrastructure.gov.au
- 03ACMA — Investigation Report on the Optus Outage acma.gov.au
- 04
- 05
CodeHistory is a living archive. Citations document the evidence used for this edition; later evidence may refine the account.