Asia regional address registry APNIC calls for global response to ISP failures

In context: The Asia Pacific Network Information Centre (APNIC) is the regional Internet address registry (RIR) for the Asia-Pacific region. The nonprofit organization provides number resource allocation and registration services for providers and other internet companies, and according to its chief scientist, it should not be solely responsible for investigating major internet outages as well.

Geoff Huston is calling for the creation of a hypothetical “routing police,” a third-party organization that should thoroughly investigate internet service providers when a major outage leaves millions of users with no internet connection. The APNIC chief scientist recently published a post about an outage affecting Australian service provider Optus, the exact nature of which is still being investigated.

Optus is a large provider in Australia, Huston says in his post, and the aforementioned outage left around 10 million users, companies and public organizations without communication services for hours, or even days in some instances. It appears that one of Optus’ peer BGP networks mistakenly advertised a very large route collection to the Optus BGP network, causing the routers to malfunction in “some manner.”

If the Optus incident were a bank heist, Huston remarks, the site would “no doubt be saturated with investigators” from the police force. But this was a “routing heist,” as the BGP routing system effectively seized control of the operator’s network and put it out of action. Now we need to understand the exact nature of the triggers for this outage, Huston says, and identify if Optus was somewhat negligent and amplified a minor issue into a major incident for millions of internet users.

Internet governance organizations such as APNIC, standard bodies and network operators shouldn’t be left alone in untangling the mess related to a major routing incident, Huston added. They are not the right entities to take on the task, and the same goes for national regulatory agencies as the internet is a borderless, global inter-network communication system in nature.

Huston suggests people in power should take inspiration from the aviation industry, which can seemingly provide a better model for a potentially global incident response. Outages should not push companies and internet organizations to sweep responsibilities “under the closest rug,” Huston says.

In the airline industry, the object of an investigation is not necessarily to blame someone, but to unearth the root causes of an incident and potentially propose effective preventive measures. The global digital network has effectively become a public service, Huston suggests. Therefore, we should begin treating internet service providers and infrastructure as a matter of public safety.