Telstra and Optus committed to an Australian Signals Directorate brokered protocol that escalates border-gateway protocol hijack takedowns within hours, closing a gap that let brief route leaks send Australian traffic through unexpected overseas networks twice in October.
What went wrong
BGP tells the internet which autonomous system owns which IP prefixes. Misconfigured announcements—or malicious inserts—can redirect traffic through surveillance-friendly jurisdictions before operators notice. ASD’s Australian Cyber Security Centre logged two incidents this month where prefixes belonging to Australian universities and a payroll SaaS vendor were hijacked for less than 40 minutes, long enough for credential harvesting attempts.
The new playbook
Under the signed protocol, either carrier can trigger a joint war room that contacts upstream transit providers and posts corrected route objects to the Asia-Pacific Network Information Centre registry. Target response time is four hours from detection to global propagation, down from ad hoc threads that sometimes stretched overnight.
Four-hour target from hijack detection to global route correctionWhy both carriers joined
Telstra and Optus compete for mobile subscribers but share international transit dependencies. ASD argued that split responsibility slowed October responses when each assumed the other would call Hurricane Electric or Telia. The protocol names executive contacts and forbids marketing use of incident data without ACSC approval.
Limits
Smaller ISPs and cloud-only firms must still implement resource public key infrastructure filtering; the protocol does not mandate RPKI deployment dates. Critics note that four hours remains an eternity for payment traffic. ASD said it is negotiating a similar memorandum with TPG and Vocus.
Enterprise guidance
The ACSC urged firms to monitor their own prefixes with third-party BGP alarms and to dual-home DNS. Universities that suffered October leaks have enabled RPKI on campus networks as a complement to carrier action.
The agreement does not replace law enforcement investigations when hijacks are criminal, but it gives network operators a rehearsed script. For Australian internet users, the payoff is fewer mysterious latency spikes that trace back to Bucharest or Miami—not because those cities are hostile, but because traffic was never meant to pass through them.
Technical standards
Resource public key infrastructure adoption in Australia still trails the Netherlands and the United States, according to APNIC measurements. The Telstra–Optus protocol includes quarterly drills where engineers intentionally announce a test prefix to verify upstream filters drop it within minutes.
Cloudflare and Akamai, which host major Australian SaaS firms, joined observers on the first drill call. Their presence matters because many hijacks target DNS anycast ranges rather than carrier-owned address blocks.
Historical precedent
A 2019 route leak through a small provider blackholed Australian government traffic for an afternoon, prompting a Senate committee report that gathered dust until this month’s incidents. ASD’s updated threat assessment ranks BGP hijacking as “likely” for financially motivated actors testing credential capture kits.
What changes for users
End users will not install new software. Benefits accrue as fewer mysterious certificate warnings appear when logging into banking sites during peak evening hours. Businesses advertising their own IP blocks should register monitoring feeds the ACSC lists on its website.
Internet exchange operators in Sydney and Melbourne will sit in on the next drill as neutral observers, ensuring peering fabrics propagate corrected routes as quickly as transit carriers do.