KT's Premature Assumption of 'DDoS Attack'... "Initial Response Manual Inadequate"

KT Communication Outage Evoking War Memories
'DDoS Mention' Cause Investigation Inadequate
Human Error and Equipment Investment Issues Suspected
"Even 5 Minutes of Disconnection Is Serious... Detailed Explanation Needed"

[Image source=Yonhap News]

[Asia Economy Reporter Minyoung Cha] "I was at the company when both the internet and mobile phone went down, and it felt as if a war had broken out."

On the morning of the 25th, from around 11:20 AM, a nationwide KT wired and wireless communication outage lasted between 40 to 85 minutes. It was revealed that the cause was a routing (network path configuration) error. Initially, KT suspected a DDoS attack, but as it turned out to be an internal issue, public anger grew. Experts have pointed out that the initial identification of the cause was inadequate.

According to the telecommunications industry on the 26th, KT initially estimated the cause of the outage as a large-scale DDoS attack but corrected it to a routing error within just over two hours, leading experts to criticize the response as "premature."

After the incident occurred, KT initially suspected a large-scale DDoS attack as the cause of the wired and wireless internet network paralysis around noon. However, at approximately 2:30 PM, just over two hours later, KT issued an official statement correcting this by saying, "Initially, we assumed a DDoS attack due to traffic overload, but after careful verification, we identified a routing (network path configuration) error as the cause."

Routing refers to selecting the optimal path for transmitting communication data within a network. Telecom companies use this to efficiently manage large-scale traffic and ensure smooth operation of the internet network.

Telecommunications experts diagnose that it is difficult to draw a concrete picture at this stage because there are infinite variables that can cause network service interruptions. Service disruptions can occur due to various reasons, including human error such as misconfiguration by operators, software errors in network equipment, hardware failures, or issues with optical lines. Rare cases like the 2018 KT Ahyeon exchange fire, which caused loss of the exchange itself, also fall under this category.

However, since KT directly mentioned a routing problem, the industry speculates that routing-related configuration values may have been incorrectly set, causing traffic to be concentrated on a specific network. KT has not disclosed the exact circumstances under which the routing error occurred.

A telecommunications equipment industry official said, "Because there are so many different routes open, it is not easy for outsiders to draw a detailed picture just based on the fact that it was a routing problem," adding, "However, since even a 5-minute outage is a very serious situation, KT as the party involved should provide a detailed explanation directly to the public."

Professor Seungjoo Kim of Korea University Graduate School of Information Security said, "Neither the Ministry of Science and ICT nor the Korea Internet & Security Agency (KISA) diagnosed it as a DDoS attack from the beginning," and added, "The fact that KT, an insider, was wrong indicates a lack of expertise or insufficient response manuals, so a calm analysis of the cause was necessary."

The possibility of human error is also being mentioned. KT's second labor union, KT Saenod, stated, "If it is a routing error, there is a high possibility of human error according to internal employees' opinions," and criticized, "It is KT's reality that a nationwide internet outage occurs due to human error, which is unbelievable for a national backbone telecommunications operator."

There are also calls for increased investment in telecommunications equipment to prevent fundamental problems from recurring. KT, ranked second in wireless communication and first in wired communication among the top three domestic telecom companies, is urged to expand its capital expenditure (CAPEX). Especially since KT has many B2B (business-to-business) customers in national backbone networks and enterprise communications, it is pointed out that more effort should be made in managing wired networks.

KT's CAPEX scale steadily decreased from 3.313 trillion KRW in 2013 to 1.977 trillion KRW in 2018. It then increased again to 3.257 trillion KRW in 2019 before dropping to 2.872 trillion KRW last year. This year is expected to be similar to last year. KT CFO Youngjin Kim said during the earnings conference call in February, "This year's CAPEX scale is similar to last year," adding, "We plan to relatively expand resources in growth areas such as artificial intelligence (AI), digital transformation (DX), and media."

Another telecommunications equipment industry official said, "KT probably did not lack manpower," and pointed out, "Base stations need to secure spare resources at cell sites and implement redundant structures and various error-handling measures to create detours for traffic delivery."

The Ministry of Science and ICT, the supervising ministry, has formed a "Broadcasting and Telecommunications Disaster Response Situation Room" led by the Information Security Network Policy Officer as the situation room chief, following the information and communication accident crisis management manual, to confirm whether full recovery has been achieved. The cause of the incident is also under in-depth investigation with related experts, keeping open various possibilities such as system errors and cyberattacks.

The Ministry of Science and ICT explained, "We are conducting an in-depth investigation into the cause of the incident and have instructed KT to investigate the status of user damages," adding, "After the cause investigation, we plan to prepare follow-up measures such as recurrence prevention plans."

This content was produced with the assistance of AI translation services.