KDDI's 61-Hour Mobile Outage Made Router Change Control

Summary

KDDI says a communication failure began at 1:35 a.m. JST on 2 July 2022 and that service use recovered to the prior-week level at 3:00 p.m. on 4 July. The reported effect period was 61 hours and 25 minutes, across Japan. [1][5][7]
The initiating interruption was much shorter. During maintenance of a nationwide transport-network router at the Tama network centre, an incorrect route setting interrupted traffic for roughly fifteen minutes. Reverting the setting did not end the incident. [1][5]
Devices and equipment repeatedly resent location-registration requests. VoLTE nodes became congested, distributed processing spread pressure to other sites, and repeated authentication traffic overloaded the subscriber database. [1][5][9]
KDDI estimated that about 22.78 million voice users and at least 7.65 million data users were affected on a non-consolidated basis. Including Okinawa Cellular, the estimates were about 23.16 million voice users and at least 7.75 million data users. These are service-impact estimates, not one count of unique people. [1][5][14]
The November response to administrative guidance says the work used an incorrect procedure document, approval and rollback controls needed revision, automated congestion control was limited public evidence, damaged backup state affected some restarts, and subscriber-session inconsistencies complicated recovery. [8][9]
The official Diet record says 119 call volumes originating on KDDI were about 63 percent below normal and 110 call volumes were about 45 percent below normal during the incident, while other paths carried more calls. Those are observed volume changes, not proof that every attempted emergency call failed. [20]
KDDI announced terms-based and apology refunds and estimated an approximately 7.5 billion yen financial effect. Refund accounts, service-impact estimates, subscriptions and unique people must remain separate measures. [1][11]
Accountability does not end with identifying an incorrect setting. It follows practical control over procedure custody, expert review, approval evidence, rollback timing, abnormal-state testing, congestion observability, backup integrity, subscriber-state recovery and service-specific restoration proof.
KDDI published many corrective measures, including tighter procedure controls, congestion tools, enabled flow controls, topology changes, recovery automation work, quality governance and communication improvements. Publication of a measure is evidence of a commitment or implementation claim, not independent proof that every relevant failure class was removed. [9][10][15][17]
Japan's later emergency-roaming service creates an alternative path during major outages. It should be evaluated as a bounded resilience control, not treated as a substitute for fixing fragility inside a carrier's own network or as a policy caused solely by this event. [22]

The first accountability fact is the mismatch in time

KDDI's public chronology contains two very different clocks.

The first clock covers the initial routing interruption. During maintenance of a router in the nationwide transport network, an incorrect route setting caused part of the traffic crossing that router to stop. KDDI describes the interruption as lasting approximately fifteen minutes. The configuration was reverted. [1][5]

The second clock covers the effect on customers and services. KDDI says the communication failure began at 1:35 a.m. on Saturday, 2 July 2022. It says voice and data use returned to a level comparable with the same period a week earlier at 3:00 p.m. on Monday, 4 July. That is 61 hours and 25 minutes. A further group-level check of customer use and traffic normality was reported on 5 July. [1][7]

Calling this a 61-hour routing error would be false. Calling it a fifteen-minute outage would also be false.

The route error was the trigger. The long incident was a recovery problem involving signalling load, VoLTE nodes, subscriber authentication, inconsistent state, damaged backup material and operational decisions about which components to isolate and when. The distinction is central because responsibility for a trigger and responsibility for amplification are not necessarily identical.

An operator can make an incorrect change and still contain it quickly if the change is bounded, rollback assumptions are realistic and downstream systems tolerate the temporary failure. It can also make a short-lived error that creates a persistent condition elsewhere. Devices retry. Queues grow. Databases receive repeated queries. Replicated state diverges. Recovery actions themselves add load. Components restart into an abnormal state. Observability degrades because every alarm fires at once.

The accountable question is therefore not merely, "Who entered the wrong setting?"

It is:

Who approved the work and on what evidence?
What impact model set the rollback limit?
Which downstream behaviours had been tested?
What telemetry showed that rollback had not restored service?
Who had authority to isolate nodes and shed load?
What known-good state was available for recovery?
Which service tests defined restoration?

A blame-first inquiry tends to collapse this chain onto the person nearest the command line. A control-first inquiry examines the institutions that designed the work, approved the risk, built the network's abnormal-state behaviour and decided when customers could be told service was restored.

KDDI's own regulatory-response report points in that direction. It describes procedure-document management, expert checks, approval evidence, rollback criteria, congestion design, recovery procedures and quality governance. [9] The operator's account therefore supports a broader lesson: a network change is not one technician's keystroke. It is an organizational control entity.

How a route change became a signalling cascade

Mobile service depends on a large amount of signalling that customers never see.

A phone must establish that it is attached to the network and identify the area in which it can be reached. A voice service using VoLTE needs the network to know where the subscriber is registered and which control functions can set up an incoming or outgoing call. Data service also depends on subscriber authentication and session state. These operations involve messages among devices, mobile-network functions, VoLTE nodes and subscriber databases.

Under normal conditions, this signalling is a small fraction of the value a customer experiences. The visible service is a call, message or data session. The hidden prerequisite is a sequence of successful registration, authentication, policy and routing exchanges.

KDDI's technical account says the incorrect route setting caused location-registration requests to be abandoned. Devices and equipment then resent requests. The retransmissions increased rapidly. VoLTE nodes at Tama became congested, and distributed processing through the nationwide transport network spread pressure to VoLTE nodes at other sites. [1][5]

The subscriber database then became part of the cascade. KDDI explains that VoLTE nodes and mobile-network equipment query the database for authentication. Repeated signalling therefore created repeated database traffic. The system did not simply have too many customer calls. It had too many control requests generated by incomplete registration and retry behaviour.

This distinction matters for engineering and accountability.

Ordinary capacity planning may ask how many simultaneous calls, data sessions or subscribers a node can support. Abnormal-state planning asks how the system behaves when messages fail partway through a transaction and are retried by millions of devices. The latter can produce a load shape unlike peak customer demand.

A retry mechanism is usually a reliability feature. It protects users from a lost packet or temporary interruption. At national scale, synchronized or insufficiently bounded retries can become a load multiplier. A request fails; the device tries again; the network function tries again; the database sees repeated authentication traffic; slow responses keep more transactions open; and the growing queue produces more timeouts and retries.

The failure therefore crosses several control surfaces:

Routing control: whether traffic reaches the intended path.
Retry control: how devices and systems respond when expected replies do not arrive.
Admission control: whether overloaded nodes reject, delay or shape new work safely.
Database protection: whether authentication and subscriber-state systems can limit repeated demand.
Distribution control: whether load sharing contains failure or propagates it.
Recovery control: whether responders can identify and isolate the sources of excessive signalling.

KDDI says flow-rate controls were applied to reduce database congestion, but excessive signalling continued. It ultimately separated six of eighteen VoLTE nodes associated with the continuing abnormal requests. [1][5]

That action illustrates a difficult recovery trade-off. Removing capacity can reduce harmful load if particular nodes are generating it, but it can also leave less capacity for legitimate service. The decision needs reliable telemetry and authority. Responders must know whether a node is a victim of downstream congestion, a source of repeated requests or both.

The public record does not reveal every packet path, timer or threshold. It does establish that the system's abnormal-state behaviour was decisive. The incident belongs in network-infrastructure accountability because the harm followed the interaction of transport routing, signalling control, voice functions and subscriber state.

Why reverting the route was not recovery

Rollback is often treated as the safest answer to a failed change. The KDDI incident shows why that assumption needs a boundary.

Reverting a configuration can restore the condition that existed before the change. It cannot automatically erase state created while the change was active.

During the interruption, devices and systems experienced incomplete registration and generated retries. Queues and database load changed. Some nodes entered congestion. Subscriber-session information became inconsistent. KDDI's later response says some VoLTE nodes loaded damaged backup files and restarted in an abnormal condition, which caused further location-registration retries. [9]

The network after rollback was therefore not the network before the change.

This is a general property of stateful infrastructure. A stateless route entry may be restored quickly, but the services depending on that route can retain:

outstanding transactions;
retry timers;
stale sessions;
inconsistent replicas;
partial authentication state;
corrupted queues;
cached failures;
overloaded processes;
recovery actions already in progress.

Change plans should distinguish configuration rollback from service rollback.

A configuration rollback test asks whether the old bytes or commands were restored. A service rollback test asks whether users can again register, authenticate, make calls and establish data sessions without abnormal error or load. A state rollback test asks whether databases, queues, caches and node backups are consistent enough to support that service.

Those tests can produce different answers at the same time.

KDDI's published measures include revising the time allowed before rollback so that congestion in downstream services is considered. [9] That is a meaningful control change. It recognizes that waiting too long can allow an initially reversible network condition to create a stateful crisis.

Yet an earlier rollback threshold is not enough by itself.

The operator also needs a model of what can accumulate during the permitted interval. How many registration retries can be generated? Which database reaches saturation first? What portion of the network can be isolated? Which service remains available during isolation? What happens when the route returns but millions of devices retry together?

The recovery plan should specify triggers that are based on service health, not only router state:

sudden loss of registration success;
growth in incomplete requests;
VoLTE-node queue depth;
subscriber-database response time;
authentication rejection rate;
retry volume by region or node;
call setup and completion;
data-session establishment;
emergency-call success.

Rollback remains essential. The lesson is that its scope must match the system.

For a stateful national mobile network, "the old route is back" is an intermediate technical fact. It is not a restoration certificate.

A procedure document is part of the production control plane

KDDI's November report says an incorrect work procedure was used. It describes revisions to procedure-document management, expert review and work approval. [9]

This could sound administrative. It is operationally concrete.

The command entered during maintenance is produced through a chain:

an intended network outcome;
a design or change request;
a procedure template;
device-specific instructions;
peer or expert review;
approval;
scheduling;
execution;
verification;
rollback.

If the wrong procedure can be selected, the production system is exposed before anyone logs into the router. Document custody is therefore part of the control plane.

A reliable procedure system should answer:

Which template was authoritative?
Which network model and software version did it assume?
Who created and reviewed the final instructions?
What changed from the last approved version?
Which device or topology was the procedure intended for?
Which evidence proved that simulated or lab results matched production?
What risk class and approval level applied?
Which checks had to pass before the next step?
How would the procedure be stopped or rolled back?

The important word is evidence.

A second pair of eyes can become ceremonial if the reviewer sees only a final document without the intended state, topology, diff or expected outputs. Approval can become ceremonial if the approver sees a checkbox rather than the consequences of failure.

KDDI says it changed the process so knowledgeable staff would check procedures, preserve evidence of that check, and enable approvers to confirm the evidence. It also described work on a procedure-management system. [9]

Those measures should be evaluated by what they prevent.

A management system should make it difficult to:

use a procedure for the wrong device class;
execute an obsolete version;
skip a required expert review;
approve an untested command sequence;
change instructions after approval without invalidating the approval;
proceed when expected outputs differ;
lose the record of what was actually executed.

High-impact network work also needs a machine-verifiable layer where practical. Intended route changes can be compared against topology and policy. Configuration diffs can be linted. Lab or digital-twin tests can exercise expected and abnormal paths. Pre-change and post-change probes can be automated. Limits can prevent commands from touching more nodes or prefixes than authorized.

Automation does not remove human accountability. It changes the evidence available to humans.

The operator remains responsible for deciding what the automated control must prove, how exceptions are authorized and what happens when the observed state differs from the plan. A system that automatically confirms only syntax can still approve a semantically dangerous route.

The KDDI event makes procedure governance visible as infrastructure governance. The document was not paperwork adjacent to the network. It was the executable description of production authority.

Risk classification should follow blast radius, not maintenance familiarity

Routine work can carry exceptional risk.

A task may be familiar to an experienced team, use a known command and occur in a scheduled maintenance window. None of those facts determines the potential customer impact.

KDDI says it revised work-risk assessment and approval levels according to the scale of harm if a task failed. It also expanded periods in which certain work would be suppressed around important events. [9]

This is an important shift from probability alone to consequence.

Risk classification for a nationwide transport router should consider:

the number and type of services crossing it;
whether failure can affect registration or authentication;
how retries propagate;
whether load sharing spreads failure;
the independence of redundant paths;
emergency-call dependencies;
MVNO and enterprise dependencies;
the ability to observe and isolate the change;
the time before state becomes hard to recover;
the tested capacity of fallback systems.

A change with a low estimated probability of error can still require the highest approval and testing standard if its failure can create national common-mode harm.

The classification must also account for temporal risk. A maintenance window chosen for low ordinary traffic may not minimize signalling risk. Many devices can react to a failure at once regardless of whether people are actively making calls. A quiet hour for customer usage is not necessarily a quiet hour for registration storms.

Likewise, an event-suppression calendar is only one control. Major public events, severe weather or elections can increase the consequences of an outage, but ordinary nights still contain emergency calls, logistics, connected devices, transport operations and essential care.

The stronger control is an explicit blast-radius budget.

Before work begins, the operator should state:

maximum affected nodes;
maximum affected geography;
maximum service interruption;
maximum registration failure;
maximum time to rollback;
maximum downstream recovery time;
conditions that require immediate isolation;
fallback capacity available during the work.

Observed metrics should be compared with that budget in real time. If the change exceeds any limit, continuation should require fresh authority rather than an assumption that the original approval still applies.

This approach turns "routine maintenance" into a bounded experiment. It recognizes that the public does not experience the familiarity of the task. It experiences whether the network works.

Congestion control must be tested in the state that failure creates

KDDI's report says automatic congestion control did not work as needed during the abnormal condition. It later enabled or revised flow-control functions, developed more detailed detection tools and changed relevant VoLTE traffic and accommodation design. [9][10]

Congestion control cannot be evaluated only under ordinary high load.

Normal peak traffic contains many valid requests with expected timing and distribution. An incident can produce repeated, incomplete or correlated requests. It can send half a transaction through one path and lose the reply. It can concentrate load on components that ordinary balancing spreads evenly. It can cause several network functions to retry against the same subscriber database.

Testing should therefore include failure semantics:

partial route loss;
asymmetric reachability;
delayed replies;
duplicate requests;
synchronized device retries;
one-of-two path failure;
database latency and inconsistency;
node restart during high load;
lost monitoring;
recovery tool contention.

The objective is graceful degradation.

When a network cannot serve every request, it should protect essential control functions and preserve enough capacity to recover. It may need to reject work early, apply backoff, separate regions, prioritize emergency service or isolate a faulty domain.

KDDI reported changing a relevant VoLTE arrangement from a nationwide full-mesh configuration to an east-west separated design and enabling a flow-regulation function to reduce the chance that congestion would spread. [9]

The principle is fault containment.

Distribution can improve resilience when it creates independent capacity. It can worsen resilience when every node participates in the same failure. A full mesh may offer many normal paths while allowing abnormal signalling to propagate nationally. Regional separation can sacrifice some flexibility in exchange for a smaller common failure domain.

The public report does not prove the complete current topology or the result of every test. It does identify a measurable remediation question:

If the same partial route failure occurs now, how many nodes, regions and subscribers can enter congestion before control limits activate?

An accountable answer would include test conditions, observed thresholds, rejection behaviour, emergency-service performance and the maximum time to isolate the affected domain.

Without that evidence, "we changed the topology" is a design statement. With it, the change becomes a resilience control.

Backup integrity and subscriber state belong in outage planning

Backups are often discussed as a cybersecurity or data-loss control. KDDI's response shows their role in network availability.

The November report says some VoLTE nodes read damaged backup files and started in an abnormal condition. It also describes subscriber-database session inconsistencies. [9]

That makes recovery-state provenance central.

A network node does not recover simply because it restarts. It recovers when the software, configuration and operational state loaded at restart are known-good and compatible with the rest of the system.

A trustworthy recovery process should establish:

when the backup was created;
which software and configuration versions it contains;
whether it was produced during congestion or partial failure;
whether its integrity was checked;
whether it is consistent with peer nodes and subscriber state;
who authorized its use;
which service tests passed after load.

Backups created automatically during an incident can preserve the incident.

If a node writes an abnormal state and that state becomes the next recovery image, restarting may reproduce the failure. If replicated subscriber databases diverge, restoring one copy can invalidate sessions or provoke more registration. If responders cannot determine which state is authoritative, every corrective action carries new risk.

The answer is not to eliminate automated backup. It is to distinguish operational checkpoints from independently validated recovery points.

Critical network functions should have:

immutable or write-protected known-good configuration;
signed software and configuration manifests;
consistency checks across replicated state;
quarantine for backups created during abnormal conditions;
tested reset procedures;
a clean management path;
staged restart with service probes;
explicit rollback from the recovery action itself.

KDDI says it revised node reset procedures and developed tools to detect and relieve congestion across multiple VoLTE nodes. [9] Those measures address recovery speed. The evidence duty is to show that they also protect state integrity.

For a mobile operator, configuration, subscriber state and recovery authority are all availability assets. A backup that cannot be trusted under stress is not resilience inventory.

Impact figures need disciplined interpretation

Large incidents produce several large numbers. They answer different questions.

KDDI estimated about 22.78 million affected voice users and at least 7.65 million affected data users on a non-consolidated basis. With Okinawa Cellular included, the estimates were about 23.16 million voice users and at least 7.75 million data users. The operator explains that voice and data estimates used different methods based on call or registration differences from a comparison period. [1][5][14]

These figures should not be added together to claim more than thirty million unique people.

One person can use both voice and data. One account can contain multiple lines. A data impact estimate based on registration differences is not identical to a count of customers who attempted and failed a session. "Affected" can cover degraded, intermittent or unavailable service rather than one uniform condition.

Refund figures answer another question.

KDDI announced terms-based refunds for 2.71 million KDDI customers and 70,000 Okinawa Cellular customers who met specified service conditions. It also announced a 200-yen apology refund for 35.89 million KDDI customers and 660,000 Okinawa Cellular customers in covered service classes. [1]

Those populations reflect contract and policy decisions. They are not a technical measure of simultaneous outage impact.

The approximately 7.5 billion yen financial effect disclosed by KDDI is yet another measure. [11] It captures the company's expected business consequence under its accounting and refund assumptions. It does not measure every lost transaction, missed emergency contact, delayed delivery, disrupted connected device or customer time cost.

A sound impact account preserves all four dimensions:

Service impact: what functions were unavailable or degraded.
Observed use: calls, registrations and transactions compared with normal.
Customer remedy: which accounts qualified for which refund.
Economic consequence: direct operator cost and wider social loss.

Inflating one number weakens the analysis. The stronger conclusion does not require inflation.

The incident was national, prolonged and consequential because a core control failure affected critical mobile services and the systems that depended on them. Exact measurement should make that conclusion more credible, not less dramatic.

Emergency calls turn availability into public duty

Mobile outages become public-safety events when people cannot reliably reach emergency services.

The official Diet record provides unusually concrete evidence. It says 119 call volumes from KDDI were about 63 percent below normal during the incident. Calls from non-KDDI mobile phones and other paths rose. It says 110 call volumes from KDDI were about 45 percent below normal, while calls from other carriers and public telephones increased. [20]

These figures require careful language.

They show a large change in observed call volumes by originating path. They do not reveal every attempted call, the intent of each caller, whether a device displayed an error, whether every alternative call connected, or the outcome of each emergency.

They nevertheless demonstrate dependence.

When one national mobile network fails, emergency demand does not disappear. Some users borrow another phone, use a landline or find a public telephone. Others may not have an alternative. Increased load on surviving networks and call centres can become a secondary risk.

Emergency-call continuity therefore needs evidence beyond ordinary voice availability:

call setup to 110, 118 and 119;
caller-location handling;
callback capability;
priority and congestion treatment;
access from MVNOs;
accessibility for people with disabilities;
geographic performance;
user instructions when the primary network fails;
load transferred to alternative networks.

KDDI's response describes stronger communication with emergency-call organizations and participation in work on alternative communications and inter-operator roaming. [9][10]

Those controls address different problems.

Better notification helps authorities and users understand the failure. Alternative paths help calls leave the failed network. Neither removes the operator's responsibility to keep its own emergency-call path resilient.

The public accountability standard should be proportional to consequence. A carrier can report commercial voice restoration while emergency-call location, callback or congestion remains impaired. The service matrix must therefore isolate emergency functionality rather than treating it as one row inside total voice traffic.

Practical control was divided, but not evenly

Network incidents involve many actors. Accountability should follow what each could actually prevent, detect, limit, disclose or repair.

KDDI

KDDI controlled the maintenance process, procedure custody, work approval, route configuration, rollback criteria, network monitoring, VoLTE-node operation, subscriber-database recovery, service measurement, customer communication and evidence supplied to the regulator.

This does not mean KDDI controlled every product behaviour or could prevent every failure. It means the operator held the broadest practical authority over the production environment and recovery.

Equipment and software suppliers

Suppliers may have controlled node software, database behaviour, retry characteristics, high-load documentation, backup formats and technical support. KDDI's response says it obtained information from vendors and tested high-load behaviour. [9]

The frozen record does not disclose the complete supplier map, contracts or defect findings. It would be irresponsible to assign blame to a named vendor. The accountable requirement is that the operator know which supplier evidence it needs and retain authority to protect service when a product behaves unexpectedly.

The Ministry and review bodies

The Ministry of Internal Affairs and Communications received the serious-accident report, issued administrative guidance and used review structures to examine the incident and broader telecom-accident problems. [3][8][9][21]

Regulatory authority includes requiring evidence, setting reporting expectations and developing sector resilience rules. It does not operate KDDI's routers or recover subscriber state.

Emergency services, MVNOs and enterprise customers

These actors hold dependency and impact evidence. An MVNO can observe its users' inability to attach or call. An enterprise can report failed connected devices or logistics functions. Emergency organizations can measure changes in call volumes and locations.

They do not control the failed KDDI core. Their continuity planning can reduce harm, but it does not transfer primary infrastructure responsibility away from the operator.

Customers

Users can keep alternative contact methods where practical, but many cannot economically duplicate a national mobile service. Public telephones, Wi-Fi, a second carrier or a landline can help. Those are bounded mitigations, not a fair answer to systemic core failure.

This allocation prevents two errors.

The first is blaming the nearest person or component for a system shaped by many control decisions. The second is spreading responsibility so widely that no institution remains accountable.

KDDI carried the strongest accountability burden to show why a short routing problem became a prolonged national incident and how the same chain is now bounded.

Remediation should be tested as a linked evidence package

KDDI published a substantial corrective program. The November report and later disclosures describe:

stronger procedure-document management;
expert review with preserved evidence;
revised approval methods;
clearer service-normality criteria;
rollback timing that considers congestion;
impact-based work-risk classification;
broader work-suppression rules;
detailed congestion-detection tools;
traffic-path and topology changes;
enabled flow regulation;
inspection of other mobile systems for similar failure modes;
revised reset and recovery procedures;
multi-node congestion-relief tools;
quality-governance changes;
large-scale exercises;
improved public and stakeholder communication. [9][10][15][17]

The list is meaningful. It should not be mistaken for proof by enumeration.

Controls interact. A stronger procedure process may prevent the same route error but not a semantically different command. Flow control may protect VoLTE nodes but not another system with similar retry behaviour. Regional separation may reduce propagation while leaving a shared database or management identity. A recovery tool may act faster but load the same untrusted state.

The remediation package should connect each observed failure to a control and a test:

Observed failure	Corrective control	Required proof
Wrong procedure selected	Versioned procedure custody and expert review	Attempted use of stale or wrong-device procedure is blocked
Risk underestimated	Impact-based classification	National/common-mode work receives required approval and test depth
Rollback too late for downstream state	Service-aware rollback threshold	Test shows rollback occurs before retry and database limits are exceeded
Partial route failure caused repeated signalling	Abnormal-state retry and flow controls	Load test shows bounded retries and protected essential functions
Congestion spread nationally	Regional fault domains and topology change	Failure injection remains inside the defined region or capacity budget
Harmful nodes were hard to identify	Per-node incomplete-request telemetry	Detection identifies the source within a defined time
Recovery loaded damaged state	Validated recovery points and reset procedures	Staged restart rejects corrupt state and preserves consistency
Subscriber sessions diverged	Database consistency and reconciliation controls	Recovery test proves authoritative state and bounded re-registration
Public information was limited public evidence	Incident communication templates and dedicated team	Exercise produces timely service, emergency and recovery information
Alternative communication was limited	Cross-carrier and other fallback paths	Activation test proves bounded voice, data, SMS and emergency functions

Evidence should be current and deployment-bound.

A policy approved after the incident does not prove the production network implements it. A lab test from one software release does not prove a later topology. A training attendance record does not prove that responders can isolate nodes under ambiguous telemetry.

Useful evidence includes:

signed procedure versions;
approval records;
configuration and topology hashes;
test manifests;
failure-injection results;
per-service probes;
recovery time measurements;
exception records;
independent review;
residual-risk decisions.

The burden is not absolute secrecy versus complete public disclosure. KDDI can keep command syntax, credentials and sensitive topology private while still publishing the failure class, control objective, scope of testing and assurance result.

For a national operator, durable repair should be legible to regulators, executives, technical teams and critical customers. It should remain understandable after staff and suppliers change.

"Restored" needs a service-specific matrix

KDDI used traffic levels compared with the same time period a week earlier as part of its recovery confirmation. [1][7]

That is useful and incomplete.

Aggregate traffic can return while important transactions remain impaired. Data volume can look normal because working users generate more traffic, even if some devices cannot register. Voice minutes can recover while call setup fails in one region or emergency callback remains affected.

A national mobile restoration matrix should include:

Domain	Minimum evidence
Device registration	attach and location-update success by region, device and network generation
VoLTE voice	call setup, completion, inbound reachability, handover and error rates
Emergency calls	110, 118 and 119 setup, location, callback and congestion treatment
Mobile data	authentication, session creation, DNS and public/private reachability
SMS	submission, queue age, delivery and failure reason
Subscriber database	latency, consistency, session reconciliation and replica health
MVNO service	attach, voice, data, SMS and support-path measurements
IoT and enterprise	representative device registration, telemetry and private-network reachability
Interconnection and roaming	inbound/outbound call and data transactions across partners
Customer communication	status page, support channels and accessible alternative instructions

Each domain should have functional and capacity thresholds.

Functional recovery means a representative transaction succeeds. Capacity recovery means the service carries expected load without unstable queues or repeated degradation. Stability means the result persists. Remediation means the initiating failure class has been addressed and replayed.

These stages should not share one timestamp.

Independent observation is also important. If the monitoring system depends on the same subscriber database or management plane being recovered, it can report a partial view. External probes, MVNO measurements, interconnecting carriers, emergency organizations and sampled user transactions provide independent evidence.

KDDI's current network-quality description says nationwide network conditions are centrally monitored from operation centres and that it uses standards for capacity, redundancy and distributed facilities. [19] The accountable question is how those general controls measured this specific failure class after remediation.

The objective is not to deny recovery until every customer confirms service. It is to define a statistically and operationally credible boundary.

When the public hears "the network is back," that statement should mean more than traffic is rising. It should mean critical functions have passed named tests, capacity is stable and residual exceptions are visible.

Emergency roaming is a fallback, not absolution

In March 2026, Japan's major mobile carriers announced a nationwide emergency-roaming service for major disasters and outages. The service includes a full mode with voice, limited data and SMS, and an emergency-calls-only mode. [22]

This is relevant later resilience evidence.

It creates an alternative access path when one carrier's network is unavailable. It can reduce the chance that a customer with one subscription is completely isolated. It also recognizes a public fact exposed by several incidents: retail competition does not automatically give each user redundant access.

The service has boundaries.

An alternative carrier must have coverage and capacity. Devices must support the required behavior. The roaming service may provide lower data speed. Emergency-only mode has limited functions and no callback through the described outgoing-only path. Activation requires coordination and public information. A disaster can affect several networks at once.

Emergency roaming also does not repair the failed network.

It should not weaken:

internal change controls;
congestion protection;
subscriber-state recovery;
emergency-service design;
restoration evidence;
operator accountability for the primary outage.

The public record does not establish that the 2022 KDDI event alone caused the 2026 service. The Diet record shows that inter-operator roaming was discussed after major telecom incidents, and the later launch reflects multi-year, multi-operator and government work. [20][22]

The accountable view treats roaming as one layer in a portfolio:

prevent unsafe changes;
contain failure inside the primary network;
recover trusted state;
preserve priority service;
offer an independent alternative path;
communicate limitations clearly.

Fallback is most valuable when it is tested under the same congestion and public-demand conditions that make it necessary.

What the frozen public record cannot prove

The sources support a detailed control analysis. They do not support a complete private postmortem.

They cannot prove:

the exact route commands;
every affected prefix or packet path;
the identity or decision process of the operator who executed the work;
the complete approval chain;
the vendor and version of every affected node or database;
whether a supplier defect contributed;
all retry timers and congestion thresholds;
per-region service availability;
every attempted emergency call;
full MVNO, roaming, IoT and enterprise impact;
exact customer loss;
current production configuration;
independent effectiveness of every announced remediation.

These gaps cannot be filled responsibly with speculation.

The unresolved questions can be tested with evidence such as:

versioned change tickets and procedure diffs;
topology and route-policy simulation;
per-node signalling telemetry;
database consistency logs;
backup hashes and validation results;
vendor support records;
service-specific probes;
failure-injection reports;
regulator follow-up assurance.

Uncertainty is not a reason to abandon accountability. It defines the evidence request.

A reusable mobile-network change accountability test

The KDDI event supports a practical standard for high-impact telecom work.

1. Bind intent to executable change.
The approved outcome, topology model, procedure, device targets and exact configuration diff should form one versioned entity.

2. Make expert review evidential.
The reviewer should see the intended network state, abnormal paths, expected outputs and rollback conditions, not only a command list.

3. Classify by maximum harm.
Approval depth should follow potential service, geographic, emergency and common-mode impact.

4. Set a blast-radius budget.
Define maximum affected nodes, regions, users, time and downstream state before execution.

5. Test partial failure.
Exercise dropped requests, asymmetric routing, duplicate signalling, delayed responses and one-of-two path loss.

6. Protect signalling and identity systems.
Bound retries, admission and database demand so a short interruption cannot become self-sustaining congestion.

7. Create real fault domains.
Distribution should contain abnormal load, not merely share ordinary load.

8. Make rollback service-aware.
Rollback criteria should include registration, call, data and database health, not only restored router configuration.

9. Preserve known-good state.
Software, configuration and essential subscriber recovery state need independent integrity and provenance.

10. Give responders bounded authority.
Teams should know when they may isolate nodes, shed load, separate regions and activate fallback.

11. Define restoration by transaction.
Measure registration, voice, emergency calls, data, SMS, MVNO, IoT, enterprise, roaming and support functions separately.

12. Observe from outside.
Use probes and partners that do not depend on the control plane being repaired.

13. Replay the incident class.
Test semantic variants of the failure, not only the exact command that triggered the last incident.

14. Bind remediation to deployed state.
Policies and diagrams should point to current configuration, test results, exceptions and residual-risk decisions.

15. Maintain a bounded alternative path.
Emergency roaming, another carrier, fixed service, Wi-Fi or public telephones can reduce harm, but their capacity and limitations must be tested and communicated.

16. Publish proportionate assurance.
Explain what failed, which control class changed, how it was tested and what remains uncertain without exposing sensitive commands or architecture.

This standard does not demand that a national network never fail. It demands that authority match blast radius and that restoration claims can be examined.

Conclusion

KDDI's July 2022 outage began with an incorrect route setting during maintenance. The configuration was reverted after a short interruption. The incident continued because the network had changed state.

Location-registration requests repeated. VoLTE nodes congested. Subscriber authentication traffic grew. The subscriber database became overloaded and inconsistent. Some recovery state was damaged. Six of eighteen nodes were isolated as responders worked to reduce the signalling pressure. Customers experienced a reported 61-hour-25-minute effect across nationwide voice and data services. [1][5][9]

The responsible lesson is not that one person made one mistake.

It is that a national network change is a chain of institutional controls. Procedure custody, expert review, approval, blast-radius analysis, rollback timing, abnormal-state design, congestion observability, backup integrity, recovery authority and service measurement all determine whether a short error remains short.

KDDI published corrective measures across that chain. Those measures deserve recognition and verification. The later emergency-roaming service adds a valuable alternative path with clear limits. Neither a long checklist nor a fallback network substitutes for evidence that the primary failure class is contained.

For critical mobile infrastructure, restoring the old route is not enough. The operator must show that the signalling system is stable, subscriber state is trustworthy, essential calls work, fallback is real and the next high-impact change cannot cross the same boundary unnoticed.

That is the accountability test created by the 61 hours after the route was already back.

KDDI's 61-Hour Mobile Outage Made Router Change Control an Accountability Test