IMDA Imposes Financial Penalty on Singtel for Fixed Voice Disruption

1. The Infocomm Media Development Authority (IMDA) has imposed a financial penalty of $1 million on Singapore Telecommunications Limited (“Singtel”) for the fixed voice disruption that occurred on 8 October 2024. The incident affected about 500,000 of Singtel’s residential and corporate users for more than four hours. The public’s access to customer service lines for some government agencies, healthcare organisations, banks and companies, and emergency call services was also affected. IMDA takes a serious view of the incident and conducted a thorough investigation.

2. IMDA’s investigation found that Singtel hosted two separate virtualised firewalls on the same hardware – one for its fixed-line voice system (“voice system”) and another for the monitoring system for home broadband routers and Pay TV set-top boxes (“monitoring system”). This meant that both virtualised firewalls shared the same hardware memory resources. As the monitoring system’s virtualised firewall did not have adequate filters installed to protect the hardware against high intensity traffic, the shared memory resources of the hardware were overwhelmed when the monitoring system faced increased traffic intensity on 8 October 2024. This caused the virtualised firewall of the voice system to also malfunction and operate intermittently.

3. Voice traffic from the affected voice system should have been fully and seamlessly redirected to a separate voice system at an unaffected site through an automatic failover mechanism. However, the failover did not happen seamlessly due to the intermittency of the affected voice system’s virtualised firewall. Calls were dropped intermittently as voice traffic alternated between the affected and unaffected voice systems. The incident was resolved only after Singtel fully swung all voice traffic to the unaffected voice system.

4. In determining the financial penalty, IMDA took into account the scale and impact of the disruption, and the time taken to restore the network. The impact of the incident was significant, as it affected the public’s access to customer service lines for some government agencies, healthcare organisations, banks and companies, and emergency call services. The potential impact on the safety and security of the public could have been very serious. IMDA’s investigation concluded that the incident was within Singtel’s control to prevent. The investigation also determined that the incident was not due to a cyber-attack. These findings were supported by independent external consultants appointed to review the incident.

5. Singtel has since taken necessary remediation measures to prevent a re-occurrence of the incident. They implemented: (i) a separate hardware for its voice system and monitoring system; and (ii) an intervention mechanism to stop network traffic from alternating between its systems during failovers.

6. IMDA holds telcos which are key service providers, like Singtel, to a high level of service reliability. These service providers are required to plan, design and operate resilient networks, and put in place measures to ensure speedy recovery and minimal inconvenience to end-users in the event of a disruption. IMDA has required other key service providers to conduct checks on their systems to avoid similar configuration weakness and to remediate where necessary. IMDA will validate the checks and remediation undertaken by the service providers. IMDA will not hesitate to take strong action under the Telecommunications Act, including imposing financial penalties, should any lapses be identified. Under the Telecommunications Act, IMDA may impose a penalty of up to $1 million or up to 10% of their annual turnover.