BT's £17.5m 999 fine was not a 999 finding

Summary

Ofcom's final decision on the 25 June 2023 outage found that British Telecommunications PLC contravened section 105A(1)(c) of the Communications Act 2003 and Regulation 9 of the Electronic Communications (Security Measures) Regulations 2022, and imposed a fine of £17,500,000.
The emergency-access condition, General Condition A3.2, sat inside the investigation's opening scope, yet Ofcom's case record states that it did not propose to pursue making a finding on it.

The sequence matters more than the headline number. BT's own review, published on 29 June 2023 at 14:30 Europe/London, describes a previously unseen complex software issue that produced a "caching" problem: impacted calls were not routed correctly and the caller's call was disconnected (BT Group review). The same account puts the first problem at 06:24 and records that all emergency calls were being handled by the primary 999 system by 16:56 — ten hours and thirty-two minutes — with confirmation at 22:14 that the service was restored and no longer relying on the backup system. BT provisionally identified 11,470 calls that were unsuccessfully connected to 999.

Ofcom opened its investigation on 28 June 2023, three days after the disruption, and described the obligations in play as uninterrupted access, the fullest possible availability, and appropriate and proportionate measures to prepare for, prevent, remedy or mitigate network compromises. That description already contained two different animals: a duty about the service, and a duty about readiness.

The regulator's own case record shows which one it ultimately rode. The opening scope covered General Condition A3.2 and sections 105A and 105C of the Communications Act 2003; a scope update on 13 July 2023 added disruption to text relay, emergency video relay and mobile SMS access, plus General Conditions C5.8 to C5.12. The final finding, on 22 July 2024, was that "BT has contravened section 105A(1)(c) of the Act and Regulation 9". And in the same record, on section 105C, General Condition A3.2 and the C5 provisions, Ofcom writes: "At this time, we do not propose to pursue making a finding" (Ofcom enforcement case page).

Read that sentence exactly as written. It is not a statement that the emergency-access condition was outside Ofcom's powers or outside the decision's reasoning. It is a statement about what the regulator chose to pursue — and the choice is the story.

What the 999 rule actually says.

In Ofcom's unofficial consolidated version of the General Conditions of Entitlement dated 15 December 2022 — the consolidation applicable around the June 2023 disruption — General Condition A3.2 provides that "Regulated Providers must take all necessary measures to ensure: (b) uninterrupted access to Emergency Organisations as part of any Voice Communications Services offered" (consolidated General Conditions). A separate A3.4 covers free access for end-users to emergency organisations using 112 and 999.

That is the sentence most people assume the fine was built on. It is not. Ofcom's penalty announcement of 22 July 2024 states the number plainly — "As a result of BT's failures, Ofcom has decided to fine the company £17,500,000" — and the specific provisions behind it, section 105A(1)(c) and Regulation 9, are the preparation duties, not the emergency-call condition.

So what is Regulation 9? The Electronic Communications (Security Measures) Regulations 2022 are SI 2022/933, made on 1 September 2022, laid before Parliament on 5 September 2022 and in force from 1 October 2022. Regulation 9(1) reads: "A network provider or service provider must take such measures as are appropriate and proportionate to prepare for the occurrence of security compromises". Regulation 9(2) adds duties on online and offline copies retained in the United Kingdom, on replacing those copies, and on means and procedures for identifying, assessing, mitigating, responding to and recovering from security compromises.

Nine months before the outage, the instrument that would eventually price it was already on the statute book, and it was about being prepared.

Why the distinction is not pedantry.

A duty to keep emergency access uninterrupted asks one question after a failure: did the access fail? A duty to prepare asks a different and harder question: was the operator ready, and can it show that it was? The second question survives contact with a messy incident, because a fault can occur while preparation is adequate — and preparation can be inadequate even when the visible service barely wobbles.

For anyone who wants a 999 operator held to a standard they can check, that is the practical consequence. The binding record from this case is not a finding that the emergency-access condition was breached. It is a finding about preparation, and it cost £17,500,000. If you are a rival, a coroner, a customer or a board member looking for the document that proves an operator was required to have done something by a particular date, look at the preparation duty and the evidence trail behind it. The emergency-call condition on its own gave this investigation its scope and much of its language; the preparation duty gave it its verdict.

A note on scope: the emergency-access wording quoted above comes from the 15 December 2022 consolidated version. Ofcom maintains later consolidations, and the numbering or wording of that condition in subsequent versions was not read for this article, so nothing here should be read as a description of the current text. Ofcom's full decision document was also not read; every regulator statement above is taken from the announcement, the penalty page and the enforcement case page actually retrieved.