Incident: BBC Website Outage: DDoS Attack Causes Service Disruption.

Published Date: 2015-12-31

Postmortem Analysis
Timeline 1. The software failure incident of the BBC website and iPlayer happened on December 31, 2015, as reported in [57080].
System 1. BBC website 2. BBC iPlayer 3. All other digital services provided by the bbc.co.uk domain [Cited Article: #57080]
Responsible Organization 1. The software failure incident, which was an intermittent internet services outage affecting the BBC website and iPlayer, was caused by a distributed denial of service (DDoS) attack [57080].
Impacted Organization 1. BBC website 2. BBC iPlayer 3. All other digital services provided by the bbc.co.uk domain [Cited from Article 57080]
Software Causes 1. The software cause of the failure incident was a distributed denial of service (DDoS) attack [57080].
Non-software Causes 1. The BBC suffered a distributed denial of service (DDoS) attack, which overwhelmed its website with traffic, preventing legitimate users from accessing the site [57080]. 2. Users on Twitter speculated about the outage being a sign of an impending apocalypse, indicating a level of panic and exaggeration among the user base [57080].
Impacts 1. The software failure incident led to an intermittent internet services outage that took down the BBC website, the BBC iPlayer, and all other digital services provided by the bbc.co.uk domain [57080]. 2. Users experienced issues with the website showing 500 error code pages, with some parts intermittently loading and others completely offline, affecting their ability to access content [57080]. 3. The outage caused disruptions for users who rely on BBC's digital services, while the radio and television broadcasts remained unaffected [57080]. 4. The incident sparked concerns among users, with some taking to social media to express fears of an impending apocalypse due to the website downtime [57080].
Preventions 1. Implementing robust DDoS protection measures to mitigate the impact of distributed denial of service attacks [57080]. 2. Conducting regular security audits and assessments to identify and address vulnerabilities in the system that could be exploited by attackers [57080]. 3. Enhancing network monitoring capabilities to quickly detect and respond to unusual traffic patterns that could indicate a potential DDoS attack [57080]. 4. Improving communication and transparency with users by providing timely updates and information during service outages to manage expectations and reduce speculation [57080].
Fixes 1. Implementing robust DDoS protection measures to mitigate the impact of future distributed denial of service attacks [57080]. 2. Conducting a thorough technical investigation to identify the root cause of the outage and implementing necessary fixes to prevent similar incidents in the future [57080]. 3. Enhancing the overall cybersecurity posture of the BBC's digital services to prevent potential cyberattacks and vulnerabilities that could lead to service disruptions [57080].
References 1. Users complaining about iPlayer and website issues, web service down detector - [57080] 2. Sources within the BBC organization - [57080] 3. BBC press office - [57080] 4. Users on Twitter - [57080] 5. BBC News - [57080]

Software Taxonomy of Faults

Category Option Rationale
Recurring one_organization (a) The software failure incident having happened again at one_organization: The BBC has experienced similar incidents before. In 2011, the broadcaster's bbc.co.uk domain went offline for an hour due to technical problems [57080]. Additionally, in 2014, the iPlayer was offline for almost a whole weekend due to a database fault [57080]. (b) The software failure incident having happened again at multiple_organization: There is no specific mention in the provided article about similar incidents happening at other organizations.
Phase (Design/Operation) design, operation (a) The software failure incident in the BBC outage can be attributed to the design phase. The incident was initially reported as a technical issue, with sources within the organization mentioning it was a distributed denial of service (DDoS) attack. However, the BBC press office refrained from confirming the cause and simply referred to it as a "technical issue" [57080]. (b) The software failure incident can also be linked to the operation phase. Users started complaining about issues with the BBC iPlayer and website, indicating problems with the operation or use of the system. The outage affected various digital services provided by the bbc.co.uk domain, leading to the website showing error pages and parts of it intermittently loading or completely offline [57080].
Boundary (Internal/External) within_system, outside_system (a) within_system: The software failure incident reported in the article was initially attributed to a distributed denial of service (DDoS) attack, which is a type of cyberattack that overwhelms a website with traffic originating from outside the system, causing it to go offline [57080]. However, the BBC press office referred to the incident as a "technical issue" without providing further details on the cause, indicating that there may have been internal system issues contributing to the outage as well.
Nature (Human/Non-human) non-human_actions, human_actions (a) The software failure incident in this case was attributed to a distributed denial of service (DDoS) attack, which is a non-human action. The BBC reported that sources within the organization indicated it was a DDoS attack, overwhelming the website with traffic and taking it offline [57080]. (b) On the other hand, the BBC press office referred to the incident as a "technical issue" and did not provide further details on the cause, indicating a human action could also be a contributing factor to the failure [57080].
Dimension (Hardware/Software) hardware (a) The software failure incident occurring due to hardware: - The BBC experienced an intermittent internet services outage that took down its website, the BBC iPlayer, and all other digital services provided by the bbc.co.uk domain [57080]. - The outage was initially reported as a distributed denial of service (DDoS) attack, which is a type of cyberattack that overwhelms a website with traffic [57080]. - The BBC press office referred to the incident as a "technical issue" without providing further details on the cause of the outage [57080]. (b) The software failure incident occurring due to software: - The BBC press office mentioned that the outage was a "technical issue" without specifying the exact cause [57080]. - In previous incidents, the BBC had faced software-related issues such as cyberattacks in 2012 and a database fault in 2014 that caused the iPlayer to be offline for almost a whole weekend [57080].
Objective (Malicious/Non-malicious) malicious (a) The software failure incident reported in Article 57080 was malicious in nature. The incident was identified as a distributed denial of service (DDoS) attack on the BBC's website and digital services. The attack overwhelmed the website with traffic, preventing legitimate users from accessing the services. The BBC initially reported it as a technical issue but sources within the organization confirmed it was a DDoS attack, which is a deliberate attempt to disrupt services and harm the system [57080]. (b) There is no information in the articles to suggest that the software failure incident was non-malicious.
Intent (Poor/Accidental Decisions) accidental_decisions (a) The software failure incident at the BBC, which resulted in an outage of its website and digital services, was initially reported as a distributed denial of service (DDoS) attack. However, the BBC press office referred to it as a "technical issue" and did not provide further details on the cause of the outage [57080]. (b) The incident could also be seen as an accidental decision, as the BBC press office downplayed the incident as a "technical issue" without explicitly confirming it as a DDoS attack. This lack of transparency or clarity in communication could be considered an unintended decision that contributed to the confusion surrounding the nature of the outage [57080].
Capability (Incompetence/Accidental) unknown (a) The software failure incident related to development incompetence is not explicitly mentioned in the provided article. The outage experienced by the BBC's website, iPlayer, and other digital services was attributed to a distributed denial of service (DDoS) attack, which is an intentional act to overwhelm a website with traffic [57080]. The BBC press office referred to the incident as a "technical issue" without providing further details on the cause [57080]. (b) The software failure incident related to accidental factors is not explicitly mentioned in the provided article. The outage experienced by the BBC's digital services was primarily attributed to a DDoS attack, which is a deliberate and malicious act rather than an accidental occurrence [57080]. The article does not provide information suggesting that the incident was accidental in nature.
Duration temporary The software failure incident reported in Article 57080 was temporary. The BBC website, iPlayer, and other digital services provided by the bbc.co.uk domain experienced an intermittent internet services outage. Users started complaining about the issues in the early hours of the morning, and the website was showing 500 error code pages with some parts intermittently loading and others completely offline. The services were restored and operating normally shortly before 11 am on the same day. The BBC initially reported it as a distributed denial of service (DDoS) attack but later referred to it as a "technical issue" without providing further details on the cause of the outage [57080].
Behaviour crash, other (a) crash: The software failure incident in the BBC article can be categorized as a crash. The incident resulted in the BBC website, iPlayer, and other digital services provided by the bbc.co.uk domain going down, showing 500 error code pages, and being intermittently offline before coming back online [57080]. (b) omission: There is no specific mention of the software failure incident being caused by the system omitting to perform its intended functions at an instance(s) in the articles. (c) timing: The software failure incident did not involve the system performing its intended functions correctly but too late or too early. (d) value: The software failure incident did not involve the system performing its intended functions incorrectly. (e) byzantine: The software failure incident did not involve the system behaving erroneously with inconsistent responses and interactions. (f) other: The behavior of the software failure incident in the BBC article can be categorized as a distributed denial of service (DDoS) attack, which overwhelmed the website with traffic, preventing legitimate users from accessing the services [57080].

IoT System Layer

Layer Option Rationale
Perception None None
Communication None None
Application None None

Other Details

Category Option Rationale
Consequence property, delay (d) property: People's material goods, money, or data was impacted due to the software failure The software failure incident at the BBC resulted in the outage of its website, the BBC iPlayer, and all other digital services provided by the bbc.co.uk domain [57080]. Users experienced issues with the website showing 500 error code pages, with some parts intermittently loading and others completely offline [57080]. This outage would have impacted users' ability to access content, potentially affecting their viewing experience and interaction with the BBC's digital services.
Domain information, entertainment (a) The failed system was intended to support the information industry. The BBC website, BBC iPlayer, and all other digital services provided by the bbc.co.uk domain are part of the BBC's information dissemination platform [57080]. The outage affected the ability of users to access news, videos, and other informational content provided by the BBC.

Sources

Back to List