“Sabotage”: several severed cables at the root of a major internet outage in France
L’Obs/Toms Guide, April 27, 2022 (excerpts)
This Wednesday morning, April 27, many French people are complaining of difficulties to connect. And for good reason: incidents are multiplying in France, following a major sabotage. An official state source confirmed to “L’Obs” that this was a “coordinated act of malice”, particularly “serious” and “very rare”. According to AFP, several French cities have experienced Internet connection cuts during the night after cables were cut. Paris, Lyon, Grenoble, Reims, Strasbourg and Lille were particularly affected.
A telecom engineer said that “around 3:20, 3:40 and 5:20, cables of several long-distance fiber networks have been partially cut.” These were cables “from Paris to Strasbourg, Lyon and Lille“. These “long-distance” fiber optic cables connect major French cities, particularly for infrastructure such as data centers. It is also through this network that fixed Internet access (ADSL and fiber) and certain telephone lines function.
The quasi-simultaneity of the outages last night (between 3:20 and 5:20) indeed seems suspicious, especially since it is not just “general public” connections that have been affected, but strategic underground long-distance links used for peering and IP transit, linking Lyon, Strasbourg, Caen, Lille, and Rennes to Paris, and on at least three locations, they were several hundred kilometers apart.
By domino effect, several local and (inter)national operators using these conduits or leasing bandwidth on these fiber links, such as Sparkle, Alphalink, euNetworks, Colt, F5, Zayo or Netalis, are affected by these events. At Netalis, the failure was confirmed this morning via a particularly transparent announcement, the operator adding that the Bourgogne-Franche-Comté region would have been for a moment totally isolated from the Internet. The major incident has in practice isolated varied transmission equipment from the Internet backbones of long distance transport operators.
It is important to understand that the locations of these cables are not very accessible. They are not cabinets that can be found in the street, but buried pipes [under covers, or along SNCF tracks, highways and VNF canals]. A source in the telecom industry tells us that the cut on the Paris-Lyon cable is located in the village of La Chapelle-la-Reine (Seine-et-Marne) and is due to “an act of vandalism”. “Le Parisien” reports that cables were cut in Fresnes-en-Woëvre (Meuse), Meaux and Souppes-sur-Loing (Seine-et-Marne), and Le Coudray-Montceaux (Essonne).
The consequences of these cuts are already very real. The Free-Reseau site, which displays the anomalies at the operator Free, lists this Wednesday midday 190 connection difficulties in France, mainly concentrated on the north and east of the country, as well as the south of Ile-de-France. Similar findings by the site Zone ADSL, which mentions 8,314 failures on the fixed Internet in the last 24 hours, and 1,123 failures on mobile networks, impacting mainly the operator Free, and to a lesser extent SFR. According to our information, Free recorded outages to 70% of its capacities. However, the operator did not want to react. On Twitter, Free reported “multiple acts of malice” on the infrastructure now “contained“.
The networks of Orange and Bouygues Telecom have been spared. “Some telecom players have reported that they have observed broken Internet links,” says Bouygues Telecom, which says it does not use the links affected by these malfunctions.
For its part, SFR confirms that “fiber lines have been cut around Lyon and in the Île-de-France region,” and are already being repaired. “This is clearly vandalism,” we are told by the operator. The return to normal is not expected before this Wednesday evening. It may be later,” said one operator. The repair work is very heavy.”
Preliminary investigation
A preliminary investigation has been opened, said the Paris prosecutor’s office. The cyber section of the prosecutor’s office has opened an investigation into the charges of “damage to property likely to affect the fundamental interests of the nation,” “obstructing an automated data processing system” and “criminal association. The investigations, the source said, have been entrusted to the DGSI, the domestic intelligence, and the Central Directorate of the Judicial Police (DCPJ).
French Telecom Federation
Finally, Arthur Dreyfuss, President of the French Federation of Telecoms (FTT) said: “We have been alerting public authorities for many months on the resurgence of malicious acts on our infrastructures. As cell phone relay antennas are usually targeted, today’s acts of vandalism on fiber optic networks are unprecedented and totally unacceptable. I strongly condemn these acts of sabotage which cause considerable inconvenience to the companies and citizens of our country. We reiterate our call to the future Government to intensify the fight and prevention against these acts of vandalism and we call for tougher criminal sanctions against their perpetrators.”
And FTT CEO Michel Combot, interviewed on France Info (27/4) responded to the question “How can you better protect these cables?” with “There are more than 50,000 masts in France, nearly 30 million homes and businesses have access to fiber so it’s a bit of an illusion to want to protect everything.”
[For info: the map of all the major internet links -including fiber optics- can be found here :
https://www.infrapedia.com/]
Sabotage of internet cables: a small business tells of the very real impact of the cut
L’Obs, April 27, 2022
The major blackout that affected the French Internet network on Wednesday, April 27, after a “coordinated act of malice” with the cutting of several fiber optic cables in different parts of the country, resembling “sabotage“, has had very concrete consequences. Many companies have suffered great difficulties in connecting to the Internet, or even the impossibility of using the network, but this has also potentially affected their e-mail exchanges, their fixed telephone lines (a large part of which are now using voice over IP). And, for some, their digital services and other applications, hosted on data centers with limited or even cut-off access.
Several companies concerned did not wish to testify to “L’Obs”. Only Agora Calycé, a solution of digital tools for companies, agreed to be transparent about the events of Wednesday. Its service center manager, Thierry Stiegler, tells us: “Our security team, on call 24/7, received a first alert at 3:18 a.m., quickly followed by a notification from our operator Alphalink. It wasn’t until this morning, around 6:30 a.m., that we began to understand the impact: a large portion of our customers had their service severely degraded, if not completely stopped.””
Agora Calycé provides hosting solutions for websites and applications, via various data centers in Strasbourg, Paris and Lyon. The Strasbourg-based company also offers Internet connections to business customers. All these digital exchanges are carried out via three long-distance fiber cables: the Paris-Strasbourg, the Paris-Lyon, and the Strasbourg-Lyon. Bad luck: two out of three have been cut.
The result: a multiplication of breakdowns at the speed of the Internet. And redirecting traffic to other routes is not easy, since the alternative routes (such as the Geneva-Lyon) were quickly saturated. “The overloads led to additional crashes, which is difficult to manage,“ Thierry Stiegler continues. In total, a dozen people are mobilized at Agora Calycé, out of the twenty or so employees, to try to restore connections, explain the situation to customers, and reassure some of them.
In any case, the company anticipates the loss of at least one month’s turnover. “I can’t give you the exact amount, just that it’s significant,” they say. The business is now waiting for the conclusions of the investigation, which must confirm that it is indeed a malicious act, in order to bring the insurance into play. As revealed by “L’Obs”, the public prosecutor’s office has been assigned the case and an investigation is opened. It will try to determine who is behind this cable cut, which some people already call “cyberterrorism“.
Optical fiber: cables cut “intentionally” in several places in France, Internet connection disrupted
Le Parisien, April 27, 2022
The frequency of nocturnal cuts at 10-minute intervals is quite disconcerting. Internet connections have been disrupted in several French cities due to cuts in major fiber networks, including SFR/Altice France’s infrastructure that supplies the country. The Ministry of the Economy confirmed to AFP that it had been informed of the problem of “severed pipes” that could correspond to acts of vandalism.
“It is not the usual localized cut due to a blow of excavator of the construction site next door, the cables were cut on both sides in order to complicate the repairs“, notes an operator of these strategic infrastructures. These large cables are hidden in traps whose location is kept discreet. “The urgent task is to weld everything back together, which represents tens of thousands of small fiber optic cables,” he warns.
These underground cables have been cut in Fresnes-en-Woëvre (Meuse), Meaux and Souppes-sur-Loing (Seine-et-Marne) and Le Coudray-Montceaux (Essonne), according to our information. The networks supply the Paris-Lille, Paris-Strasbourg, and Paris-Lyon long-distance Internet connections. They link major French cities together, particularly for critical infrastructures such as data centers. ADSL and high-speed fiber networks also use these routes.
Internet outages across France after vandalism of fiber optic cables
France Inter, April 27, 2022
Error 404. Large-scale Internet connection failures in several cities, such as Grenoble or Strasbourg, but also in Paris or Lille, and this at several Internet operators: on Tuesday night, an incident of unprecedented magnitude has affected the Internet in France.
“This kind of incident of this magnitude, it never happens,” said a source close to the case. According to BFMTV, these cuts are related to malicious cuts of fiber optic cables, in several areas of France. Wednesday at midday, the Secretary of State for Cedric O confirmed that cables had at least been cut in Ile-de-France.
The operators have not yet communicated the exact nature of the incidents, but according to several sources, around 4am, incidents began to be identified along three major fiber lines, linking Paris to Lyon, Lille and Strasbourg. At least two operators are concerned: Free, which has recognized “multiple acts of malice” on its lines, and SFR, which has confirmed “several cuts of fiber” especially around Lyon. According to other sources: Three of Free’s four arteries, which constitute the backbone of their network, have been cut.
What are the consequences on the network?
The most direct consequence is that Internet connections at home are cut off. According to the DownDetector site, Free is the one who has gotten the most reports of malfunctions, with a peak around 9:30 am Wednesday morning. SFR, Bouygues and Orange are less affected overall. But this is not the only consequence: the fiber cables also feed mobile relay antennas, so also leading to connection problems on some cell phone networks.
Finally, even for those who do not have a clear Internet outage, slowdowns could be observed, caused by the “detour” set up to circumvent the malfunctions: “It’s a bit like if highways were cut and traffic had to be redirected on national roads: it works, there may be small cuts here and there but the Internet works,” analyzes Sami Slim, general manager of Telehouse, which manages data centers in France.
Who is behind these acts?
“We don’t know who it is yet,” said a source close to the case. The newspaper L’Obs quotes a government source as saying “a coordinated, serious and very rare act of malice,” suggesting that the perpetrators planned their attack to take place at the same time in several areas of France.
“It’s clearly sabotage, and the public prosecutor’s office has been consulted,” L’Obs also reported, “it could be militant mischief-makers or something much more serious”. The possibility of cyber-terrorist attacks has not been ruled out, but for the moment there is nothing to confirm a motive that could have led the perpetrators to dig into the ground to cut these cables, which are buried.
“This is major sabotage”: internet disrupted in Burgundy-Franche-Comté after acts of malicious damage to fiber optic lines
France3 Bourgogne Franche Comté/AFP, 27 April 2022
Wednesday, April 27, slowdowns and outages in Internet access occurred in several major French cities, including Grenoble, Besançon, Reims and Strasbourg. The origin of these malicious acts is not known, but they are of an unprecedented scale.
It was a long night for this alternative operator, which provides internet to several tens of thousands of professionals in Burgundy-Franche-Comté. “Last night, our supervision center noted the successive loss, spread out between 3:20 am and 5:20 am, of several major arteries providing links between Paris and Lyon as well as Paris and Strasbourg. This major incident, unprecedented in its scope, has now been resolved by the implementation of alternative connections. The judicial authorities will be consulted”, says the operator Netalis in a press release.
The latter will file a complaint with a civil action to request the opening of a judicial investigation to shed light on this coordinated act of malice.
Nicolas Guillaume, director of Netalis had never experienced such an attack. The Internet network is complex, a huge mesh of fibers throughout the territory. To better understand what happened, Nicolas Guillaume explains that it was the highways carrying the fiber that were attacked. “At a few minutes interval” he says. “This is unprecedented, we do not know who is behind these acts of maliciousness, we had already experienced damage on pylons, but here, they reach the major highways… The coordination of attacks on the cables was well done, by people who inevitably know the network ” he said. The alternative operator and its technical teams were able to restore power to their customers quickly. This Wednesday at the end of the morning, the situation had returned to normal. However, professionals already know that corrective actions will have to be taken, so as not to depend in the future on a single major transport flow.
According to initial findings, it is the inter-regional “long distance” fiber optic cables that run along highways, railroads and waterways, which have been deliberately cut in several places, including the Paris-Lyon and Paris-Strasbourg link.
The Zone ADSL website has counted 9,156 breakdowns on the fixed Internet in France over the last 24 hours, mainly affecting customers of the operator Free and to a lesser extent SFR. “The attacks took place last night at 4:00 am,” said the operator Free, which hopes that the network will be “restored during the day”. “Three of Free’s four arteries,” called “backbone” and which constitute “the backbone of their network were vandalized,” said other sources. The “backbone” is used to interconnect Internet traffic between different geographical areas through very high-speed fibers. “It’s a kind of fiber hub,” said one industry insider. “When you cut that, you cut off access to a whole region.” A cut can be circumvented, however, thanks to the interconnection of networks, and operators can provide a degraded service.
In [May] 2020, telecom cables were intentionally cut in Vitry and Ivry, in the Val-de-Marne department, temporarily depriving tens of thousands of Orange subscribers of Internet access. Data centers had seen their activities disrupted by these Internet cuts. A complaint was filed and an investigation opened, but one of the parties to the case told AFP on Wednesday 27 April that they had had “no news from the authorities” on the subject.
[Via Sans Nom]