BGP route withdrawal
A network vanishing from the global routing table when its announcements stop, leaving intact infrastructure unreachable from the internet.
October 4, 2021: a maintenance command withdraws Facebook's BGP announcements, and the company, Instagram and WhatsApp vanish from the internet for about six hours, to the point that employees' building badges stop working too. BGP is the protocol by which networks tell each other which address ranges they can reach, and the global internet is nothing more than the accumulation of those announcements. When an operator stops announcing its own prefixes, through misconfiguration or through the loss of its border routers, its machines keep running but can no longer be reached. Nothing is destroyed, the network simply drops out of the routing tables, and no backup helps. The mechanism produces two effects insurance should keep separate, unavailability for customers and the operator's own inability to reach its administration systems, the latter stretching restoration far beyond the technical fix that resolves it. The same mechanism turns into a security exposure when illegitimate announcements hijack a third party's traffic, a technique used repeatedly against crypto-asset platforms to intercept transactions. For an underwriter, a routing outage is the striking case in which backups, site redundancy and the continuity plan are all intact and all useless.
On October 4, 2021, Meta withdrew the BGP announcements for its own networks through a configuration error and its services were unreachable worldwide for about six hours. Engineers had to intervene physically on site, because the internal access tools depended on the very networks that had disappeared.
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.