The Physics of Critical Connectivity Failure

This first edition of CSL’s research paper draws on the CSL Critical Connectivity® Failure Atlas, a database of publicly documented incidents. They span telecommunications, emergency calling, internet routing, cloud, identity, DNS, endpoint security, aviation systems, data centres, terrestrial fibre and submarine cables. The paper’s central finding concerns independence rather than redundancy. A second path protected a service only where it lay outside the failure domain of the path it backed up. In six of the 45 incidents, an alternative path carried partial traffic. The incidents were chosen because they were consequential and well documented. The figures therefore describe how such failures develop, not how often they occur.

In 62 per cent of the incidents, the first fault was a software defect, a configuration change, or a routing or capacity event. The paper accordingly locates the lesson in how change is handled, not in change itself. In 25 of the 45 incidents, the initiating failure lay above the bearer, in a platform or service rather than a carrier’s network. A device can then keep its radio signal while identity, DNS, cloud processing, payment authorisation or emergency-call handling is unavailable.

In 27 of the 45 incidents, or 60 per cent, what restoration needed was itself impaired: monitoring, management access, credentials, configuration data, communications or capacity. The consequences extended to critical services. Emergency communications were affected in 13 incidents, payment services in 11, transport in 10 and healthcare in seven. Those counts include only records where the sector impact is separately evidenced. In none of the 45 incidents was the affected service reported or coded as operating fully as intended.

The paper turns these findings into seven engineering principles and a set of assurance questions. It is written for organisations that depend on connectivity for critical services, and for the boards, service owners and procurement teams accountable for continuity. Its executive summary leads with four changes in practice:

• assess independence as well as redundancy, by identifying the equipment, routes and operating processes that the primary and alternative paths share
• treat recovery tooling as a protected layer, keeping monitoring, credentials, communications and access available when the primary service is affected
• test failover at realistic load, scope and duration, recording the observed outcome rather than the intended design
• follow the complete service path end to end, including identity, DNS, cloud, power, timing and physical routing

The paper analyses 45 of the 46 incidents coded to its own cut-off of 19 September 2026; the 46th, a July 2026 incident, is excluded because its emergency-call outcome and fall-back behaviour remain unresolved in the analysis. Of the 45 records, 43 are high-confidence, because a regulator, government or detailed provider record supports each one. A source register gives the type of primary source, the evidence confidence, the verification status and any material caveat for every catalogued incident. The figures come from Atlas dataset v0.8.16, with evidence refreshed on 9 October 2026, and the method also draws on 25 classified academic studies. Every incident is a publicly documented third-party event rather than a CSL incident.

The paper’s appendices give the analysed corpus and the source register, and a glossary near the front defines its technical terms.

Independent redundancy, with alternative paths placed in separate failure domains, is the foundation of CSL’s approach to resilient connectivity. CSL applies it at the mobile-core layer in DualCore® architecture, through rSIM® and DualSIM® technology. An independent second core removes a shared-core dependency; the layers above the bearer, however, are assessed separately on the same end-to-end principle. To discuss independence in a connected estate, contact sales@csl-group.com.