Thank you, dear reader, for sticking with me for Hardcoded, a series on the emergency camp on functionality of mobile phones used in Australia, that is, their ability to dial emergency service numbers like 000 when their home telecom network is unavailable (I abbreviate that to ‘camp on’).
To recap our journey thus far:
Context.
The actual firmware issue for the 71 problematic Samsung models.
The utterly tragic consequences.
The contemporary regulatory landscape.
Hardcoded does not comprise happy stories, given its subject being the aftermath of a problematic firmware configuration for dozens of Samsung models that told them to camp onto a non-existent 3G network.
Clearly, prevailing regulatory and operational settings were unsound. It is necessary to interrogate, well, ‘Where to from here?’
Now, when I started drafting what was supposed to be the piece which considered that question (as in, the final article in Hardcoded), it became too long to be the final piece.
Hence, I have split my analyses and recommendations into four pieces:
The importance of all phones being network agnostic for dialling emergency service numbers (the present piece).
The need for robust testing regimes for phones, especially testing of their camp on capabilities.
The importance of telcos, OEMs and the state being on the same page with respect to the camp on capabilities of phones.
The need for the Australian Government—including our federal telecommunications regulator, the Australian Communications and Media Authority (‘ACMA’)—to get their act together as national security regulators.
Before we dive into the first of these four pieces, some housekeeping.
Housekeeping
In this series, I distinguish between:
61 ‘Updatable Models’—that Samsung said could be fixed through over-the-air firmware updates; and
10 ‘Hardcoded Models’—that Samsung said could not be fixed and thus required replacement.
Note the following keywords about dialling emergency services over here:
The general emergency service number is 000 (the one I focus on in Hardcoded), while 106 is the one for use with teletypewriters and 112 is an alternative number for mobile phone users, as per Telecommunications Act 1997 (Cth) s 466(2) (‘Telecommunications Act’) and Telecommunications Numbering Plan 2025 (Cth) s 20.
An ‘emergency call service’ handles calls to emergency service numbers, and ensures that emergency services are dispatched when and where they are required (to summarise the definition in Telecommunications Act s 7). The ACMA oversees emergency call services in Australia, as per part 8 of the Telecommunications (Consumer Protection and Service Standards) Act 1999 (Cth).
Note the following key abbreviations:
LTE = Long Term Evolution = A 4G telecommunications standard enabling wireless broadband communication for mobile devices at faster speeds than on 2G/3G networks.
eVoLTE = A configuration which allows your phone to make an emergency voice call on an LTE network. I’m borrowing from TPG Telecom’s use of ‘eVoLTE’ in this fashion, rather than the industry shorthand for ‘Enhanced/Evolved VoLTE’.
000 Inquiry = The Senate Environment and Communications References Committee’s inquiry into the September 2025 000 outage.
With that, as the late John Clarke said to Bryan Dawe before they recorded the first ever ep of Clarke and Dawe:
Alright, let’s go and stick some ferrets down some trousers.
Cause, not Symptoms
It could be argued, indeed cogently, that a significant contributing factor for the fiasco under investigation in Hardcoded was the shutdown of the Vodafone 3G network (within the larger context of the 3G shutdown over here).
After all, as I explained in Technicalities, the shutdown brought the problematic firmware configuration into sharp relief. It was because the network became non-existent in January 2024 that the absence of an eVoLTE configuration for the Vodafone network from the baseband firmware of the 71 Samsung models became rather problematic. Samsung issued a firmware patch to insert that very configuration into the 61 Updatable Models so those phones could camp onto the Vodafone LTE network if Telstra and Optus towers are unavailable.
Except the 3G shutdown, significant as it was, merely brought the symptoms of the problem with the phones into sharp relief. I don’t put down the shutdown (as mismanaged as it was) as the cause of the problem here.
Noting that the issues discussed in Hardcoded are hardly homogeneous or monocausal, the most important cause of this saga was Samsung’s commercial decision to prevent its phones from being network agnostic for dialling emergency service numbers, thus rejecting the relevant part of Android’s reference implementation (unique among OEMs for Android phones). The aforementioned firmware patch was required because Samsung has a proprietary VoLTE and IMS/MMTEL System under which it needs to add telco-specific eVoLTE configurations.
Certainly, the problem is not limited to the 71 Samsung Models, and telcos and OEMs have made a dog’s breakfast of (e)VoLTE implementation more generally.
But come on, Samsung must cop a fair bit of stick for its decision making for baseband firmware design. Decision making with significant negative externalities—catastrophic externalities that I went through in Fallout—for the user base and national security at large. We are talking about the ability of the citizenry to access an emergency call service and an essential service, for crying out loud.
Especially when Samsung Electronics Australia’s Head of Mobile Division, Mr Eric Chou, agreed in testimony at the 000 Inquiry that it was ‘foreseeable’ that phone users in Australia would switch from 3G to 4G for calling 000. Again, come on.
While this issue is not a software security one (a missing eVoLTE configuration is not a bug), it is still one about software design, which makes relevant the chat (some of which I flagged at the start of the Prologue) about vendors operating on incentive structures divorced from the national security equities of a software-dependent polity.
Especially the notion that vendors continue to be allowed by recalcitrant/negligent/ignorant/captured governments to, well, prioritise what is best for them commercially rather than what is best for the polity at large (a theme running through my PhD thesis).
Certainly, I am not arguing that we should require phone OEMs to reflash legacy phones running chips that are no longer supported by their vendors, and operating systems that fuse the OS image with the chip vendors’ code and for which build environments are no longer supported (something I raised in Technicalities). That would make no commercial sense.
That said, I reckon we should develop multi-stakeholder strategies to ensure that all smartphones that are 4G- and/or 5G-capable are network agnostic when it comes to dialling emergency service numbers. That is, ensure that network agnosticism is baked into their baseband firmware unlike what happened with the dud Samsung models.
As with technology generally, let’s start with the standards.
Standards
Mate, key standards themselves require network-agnosticism for making emergency calls.
For example:
3GPP TS 22.003 v19.0.0—Circuit Teleservices Supported by a Public Land Mobile Network (PLMN) clause A.1.2 says that (emphasis added):
Emergency calls supersede all constraints imposed by supplementary services or user equipment features used for other Tele or Bearer services. The lock state of the UE is overridden by the SOS‑procedure.
3GPP TS 22.101 v20.0.0—Service Aspects; Service Principles clauses 10.1.0, 10.1.1, 10.4.1 provide that emergency service calls, including to 000, must be possible: without a SIM card; regardless of service restrictions if legally required; and even if the phone is unauthenticated (according to the IP Multimedia CN subsystem) if legally required.
3GPP TS 23.122 v19.4.0—Non-Access-Stratum (NAS) Functions Related to Mobile Station (MS) in Idle Mode clauses 2, 3.5 provide for: a range of scenarios under which a phone camps onto a tower even if it lacks a SIM card and regardless of the phone’s usual network (eg operating under a ‘“limited service” state’, ‘eCall only mode’ or an ‘eCall inactive’ state).
3GPP TS 23.501 v20.0.0—System Architecture for the 5G System (5GS) clause 5.16.4.1 provides that 5G-capable phones must be able to dial emergency service numbers in a limited service state on any network, subject to local regulation and a telco’s policy. If legally required, a telco supporting emergency calls by phones in a limited service state must enable the latter to do so, regardless of the phones’ authentication, roaming or Mobility Restrictions or the telco being the home network of that phone.
AS/CA S042.1:2025—Requirements for Connection to an Air Interface of a Telecommunications Network – Part 1: General section 5.2.2, especially clause 5.2.2.1, provides that phones must be able to dial 000 and 112 whether or not they have working SIM cards. Note that this is an ‘applicable technical standard’ for ‘customer equipment’ under the Telecommunications (Labelling Notice for Customer Equipment and Customer Cabling) Instrument 2025 (Cth) (‘TLN’) s 9, schedule 1. Which is important because OEMs, as I explained in Oversight, must get their phones tested against this standard (among others) before supplying the devices here and then tell the world that they’re compliant (via the regulatory compliance mark) or not (via, for example, a ‘non-compliance label’) as per TLN pt 3.
On top of this, there is the Android reference implementation which specifies network agnosticism for accessing emergency call services.
Mate, the above standards, to grossly oversimplify, say ‘come what may, the phone must execute a camp on’.
And yet, Samsung has thumbed its nose (and likely continues to do so) at all of the above with its fancy-pants proprietary VoLTE and IMS/MMTEL System.
Furthermore, the Telecommunications (Emergency Call Service) Determination 2019 (Cth) ss 14-15, 19 (‘ECS Determination’) require the telcos to simply provide access to 000 and 112 and carry those emergency calls for callers. When read with the above 3GPP standards, this also calls into question why the telcos allowed the mess of telco-specific eVoLTE configurations on Samsung phones to persist.
Making its phones network agnostic for dialling emergency service numbers shouldn’t be that hard a thing for Samsung to do, especially since it’s easy enough for the other Android phone OEMs. Indeed, Samsung only has to implement the existing Android reference implementation and standards!
Which is why I don’t believe the Australian Government should yield an inch to Samsung if it argues that getting rid of its IMS profile management and Consumer Software Customization (‘CSC’) systems will cost a lot of resources and/or goodwill with telcos.
To seal the deal, I believe we need to amend the TLN s 20 to the effect that the ability of phone OEMs to obtain mandatory registration on the EESS Platform before supplying their phones to the Australian market is conditional on their wares being network agnostic for dialling emergency service numbers. After all, prevailing regulatory settings, including standards requiring network agnosticism, clearly were not enough to prevent Samsung from running its own show with respect to eVoLTE configurations.
Let’s move from standards to the major influence of Google over the software of Android phones.
Google’s Regulatory Capacity
To paraphrase the renowned regulatory theory scholar, Julia Black, regulatory capacity refers to the ability to marshal resources that can shape the functioning of a regulatory framework.
And Google has lots of it with respect to incentivising and/or compelling Samsung and other OEMs to ensure that their products are network agnostic for making emergency calls.
Look at Figure 1, courtesy of the UK Competition and Markets Authority which decided in October 2025 ‘to designate Google as having strategic market status in respect of its mobile platform’; which only drives home the leverage which Google enjoys as the, in essence, ‘maker’ of the Android ecosystem.
What Figure 1 refers to as ‘Google 1P apps’ is also collectively known as ‘Google Mobile Services’ or ‘GMS’. (Note that Google’s contract with OEMs for phones sold in most regions other than the UK and EEA are subject to something other than the EMADA, namely the ‘Mobile Application Distribution Agreement’ or ‘MADA’.)
If we hone in on Google’s being the licensor for GMS, the company was reported in 2019 to have used that regulatory capacity to compel OEMs to update their phones with, at that time, at least Android 10 if they wanted Google to approve their software builds after 31 January 2020.
That was a year after the company was reported to have mandated OEM partners to ‘provide “at least four security updates” within one year of the phone’s launch’ and ‘within the second year as well, though without a specified minimum number of releases’, provided the phone had been activated by over 100,000 users. There’s also what Google has done with Project Mainline to bypass OEMs altogether when patching core Android components, especially to improve device security.
Caveat: there are antitrust concerns about the above.
To the extent that these sources of leverage are lawful, they represent major tools for Google—as the de facto gatekeeper of the Android ecosystem—to force Samsung to make phones that are network agnostic for dialling emergency service numbers. Especially when the Android reference implementation itself specifies network agnosticism (as above)!
If we move from Google’s ‘sticks’ to its ‘carrots’, we can also look at the ‘Android Enterprise Recommended’ program, namely a list of devices that Google has assessed as meeting certain rigorous security requirements, including the OEMs providing three (for ‘Knowledge Worker’ devices) or five (for ‘Rugged’ devices) years of security patches. It is a form of informational regulation whereby a device being on that list acts as a signal to enterprise procurement teams that the device is pretty decent from a security and/or durability standpoint. Arguably, Google should make network agnosticism for making emergency calls on 4G and 5G networks a condition of being on that list.
Now, having talked about ensuring network agnosticism is baked into the baseband firmware of 4G- and 5G-capable phones via implementation of existing standards by OEMs like Samsung as well as Google flexing its muscles, we must look into what comes after these phones are manufactured but before they are supplied for sale here.
We have to look at the testing regimes, especially when standard testing failed to pick up the dud firmware configuration in the 71 dud Samsung models.
Which we will in Testing.
