Investigation into Telefónica UK Limited’s compliance with section 105A(4) of the Communications Act 2003

We have concluded our investigation into Telefónica UK Limited’s compliance with section 105A(4) of the Communications Act 2003.

After reviewing a substantial body of evidence gathered in our investigation, we did not find that O2 had contravened its obligations. We have concluded that, in the specific circumstances of the case, O2 had taken all appropriate steps to protect the availability of its network; and it acted appropriately to restore it.

However, this incident highlights that risks to, and vulnerabilities of, communications networks continue to evolve. While we have not found a breach in this particular case, it is important that providers keep pace and continue to develop and ensure availability of their services.

A document setting out a summary of our conclusions, and lessons that the industry can learn from the nature of the incident is available.

We will continue to engage with providers through our Security and Resilience Assurance Scheme and we intend to update our guidance to reflect industry learnings in due course.

Following a network outage on 6 December 2018, Ofcom has decided to open an investigation into whether Telefónica UK Limited (O2) has complied with its obligations under section 105A(4) of the Communications Act 2003 (the Act).

Section 105A(4) of the Act requires a network provider to “take all appropriate steps to protect, so far as possible, the availability of the provider’s public electronic communications network”.

As we explain in our Enforcement Guidelines, opening an investigation does not imply that we have yet formed any view about whether or not the company has breached any regulatory or legal provisions.

We aim to complete the evidence gathering phase of the investigation by May 2019.