89-Minute KT Communication Disruption... Cause: "Poor Management System and Technical Issues"

Ministry of Science and ICT Emergency Briefing on 29th
KT Network Outage Investigation Results Announced
Typical Human Error... "No DDoS Attack Detected"

[Asia Economy Reporter Cha Min-young] On the 25th, the KT wired and wireless communication outage was confirmed to be a typical man-made disaster according to the government investigation results. It was explained that the accident was exacerbated by a combination of factors, including the individual deviation of the responsible worker who did not follow the work plan, KT's poor work management system, and the failure to block the network.

Investigation Results on the Cause of the 89-Minute Outage Announced

Cho Kyung-sik, the 2nd Vice Minister of the Ministry of Science and ICT, announced the investigation and analysis results related to the KT network outage incident at an emergency briefing held at the Government Seoul Office at 3 p.m. on the 29th.

The KT network outage incident started around 11:16 a.m. on the 25th, with an increase in DNS traffic followed by a network outage. KT's recovery measures were completed around 12:45 p.m., resulting in approximately 89 minutes of service disruption.

The Ministry of Science and ICT analyzed the accident log records and revealed that during the replacement work of the enterprise network router at the KT Busan office, the worker entered an incorrect configuration command, which subsequently caused a nationwide internet network outage due to routing errors.

The direct cause of the accident was a routing error. The worker omitted the 'exit' command at the end of the IS-IS protocol command input process on the router where the accident occurred. As a result, route information that should have been exchanged via the BGP protocol (Border Gateway Protocol) was sent through the IS-IS protocol. Normally, the IS-IS protocol exchanges around 10,000 pieces of information, but tens of thousands of BGP protocol information were mistakenly sent, causing errors in the routing paths.

Although IPTV service networks and voice call/text service networks are configured separately from the internet service network, they were found to be affected by traffic overload. It is estimated that traffic increased due to users resetting their terminal power, which added to the load.

KT’s Lack of Supervision and Unmonitored Work by Partner Companies

KT’s management issues were also clearly revealed. According to confirmations from KT supervisors and partner company workers, KT’s Network Operation Center approved night work from 1 a.m. to 6 a.m. on October 26, but partner company employees performed the work during the daytime.

Workers from KT’s partner companies conducted routing work without a work manager. This indicates that the work management system to prevent errors was inadequate. Additionally, the work was performed while the network was still connected, causing real-time network outages.

Technical problems were also pointed out. KT failed to detect the error during the pre-verification stage. Although the exit command to terminate the IS-IS protocol was missing in the routing configuration command script in the routing work plan, this was not caught during the script creation and pre-verification processes. Despite having one or two pre-verification stages, the system relied on manual review, which failed to detect the error.

Measures for User Compensation to Be Prepared

The Ministry of Science and ICT will collaborate with KT to prepare compensation measures for affected users. KT will investigate the status of user damages and develop compensation plans, while the Korea Communications Commission will monitor the implementation of these compensation measures. The Commission plans to review improvements to laws and user agreements to ensure effective compensation in case of communication outages.

Taking this incident as an opportunity, the Ministry of Science and ICT plans to establish a 'Network Stability Assurance Plan' that includes survival, technical, and structural measures for major telecommunication operators' networks. A task force (TF) composed of network experts, led by the Director of the Network Policy Office, will be formed.

In the short term, the network management systems of major telecommunication operators, including their network work systems and technical error prevention systems, will be inspected. A simulation system enabling operators to diagnose errors caused by network work in advance will be introduced. The Network Operation Center will establish a technical inspection system to ensure that the contents and procedures of approved work plans are followed. To minimize damage caused by routing configuration errors, measures such as limiting the number of route updates processed at once during routing work will be considered.

In the mid to long term, efforts will be made to strengthen telecommunication outage response monitoring systems of major operators, develop technologies to improve network stability and resilience, and implement structural measures to ensure network survivability, including stable network architectures.

This content was produced with the assistance of AI translation services.