Cloud glitch crashes sites across globe
Dozens of websites went down briefly around the globe Tuesday, including CNN, The New York Times and Britain’s government home page, after a blackout at the cloud computing service Fastly, illustrating how vital a small number of behind-the-scenes companies have become to running the internet.
The sites that could not be reached included some Amazon pages, the Financial Times, Reddit, Twitch and The Guardian.
Fastly in San Francisco acknowledged a problem just before 5 a.m. About an hour later, the company said: “The issue has been identified and a fix has been applied.” Most of the sites soon appeared to be back online.
The company said in an emailed statement that it was a “technical issue” and “not related to a cyberattack.”
Still, major futures markets in the U.S. dipped sharply minutes after the failure, which happened a month after hackers forced the shutdown of the biggest fuel pipeline in the U.S.
Fastly is a content-delivery network. It provides vital but behind-the-scenes cloud computing “edge servers” to many of the web’s popular sites. These servers store, or “cache,” content such as images and video in places around the world so that it is closer to users, allowing them to fetch it more quickly and smoothly.
Fastly says its services mean that a European user going to an American website can get the content 200 to 500 milliseconds faster.
Internet traffic measurement by Kentik showed that Fastly began to recover from the blackout roughly an hour after it struck at midmorning European time, before most Americans were awake.
“Looks like it is slowly coming back,” said Doug Madory, an internet infrastructure expert at Kentik. He said “it is serious because Fastly is one
of the world’s biggest [content-delivery networks] and this was a global outage.”
Brief internet service blackouts are not uncommon and only rarely are the result of hacking or other mischief.
Still, the incident highlighted the relative fragility of the internet’s architecture given its heavy reliance on big technology companies — such as Amazon’s AWS cloud services — as opposed to a more decentralized array of companies.
“Even the biggest and most sophisticated companies experience outages. But they can also recover fairly quickly,” Madory said.
When the failure hit, some visitors trying to access CNN. com got a message that said: “Fastly error: unknown domain: cnn.com.” Attempts to access the Financial Times website turned up a similar message, while visits to The New York Times and U.K. government’s gov.uk site returned an “Error 503 Service Unavailable” message, along with the line “Varnish cache server,” which is a technology that Fastly is built on.
Down Detector, which tracks internet blackouts, posted reports on dozens of sites going down.
Widespread internet failures are less common today than years ago, as Google and other major tech companies develop interconnected data centers that improve performance, but there have been a number of incidents over the past year.
In December, Google services including Gmail, Maps and
YouTube crashed for about an hour. The company attributed the problem to an “authentication system outage.” And in January, Slack, the popular workplace messaging platform used by millions of people worldwide, experienced a major disruption in which users could not send messages, load channels, make calls or log in to the service.
Failures like the one on Tuesday, in which many of the affected sites belonged to news outlets, often hit businesses in the same sector because they rely on the same third-party services, said Marie Vasek, a lecturer in information security at University College London.
“All of these websites really depended on this one third-party service, and the slight disruption in that caused this disproportionate effect,” Vasek said.
Madeline Carr, director of the Research Institute for Sociotechnical Cyber Security, which focuses on the security of organizations, said that companies that provide the infrastructure for websites can be slow to provide details when they experience internal failures or are the victims of cyberattacks. That is in part because their main selling point to clients is their reliability, she said.
“There does need to be a level of accountability,” said Carr, also a professor of cybersecurity at University College London. “In the last generation of cybersecurity, it was about ensuring websites were protected or had adequate security, but when you’re talking about something like Fastly, in a sense it doesn’t matter how secure your own website is,” she said, since so many websites depend on it.