Technology

1 dead mast in rural Britain will soon trigger an alert

Ryan Brothwell 4 min read
1 dead mast in rural Britain will soon trigger an alert

Key Points

  • Ofcom is consulting on rules that make a single rural mast failure a reportable security incident, closing a long-standing gap.
  • A new UK-wide rural postcode dataset will pull together ONS, NISRA and Scottish Government classifications into one map.
  • Urban Britain gets a 25-cell-site threshold; customer-count thresholds stay at 100,000 users for any duration.
  • The critical incident bar drops from three million to 1.5 million user-hours lost, pulling smaller MVNOs into scope.
  • Every MNO will hand Ofcom a monthly list of every RAN cell on its network for incident-mapping purposes.

Lose mobile signal in a remote British village and, under current rules, nobody at the regulator has to hear about it.

That’s about to change. Ofcom on Tuesday (12 May) opened a consultation on overhauling how mobile networks report security and resilience failures, and the headline shift is that a single cell site going dark in a rural postcode will now be enough to land on the watchdog’s desk.

Under the current rules, set out in 2022, mobile operators effectively report incidents using customer-count thresholds borrowed from the fixed-line world.

The problem is structural: in a village with one mast serving the whole community, you can take everyone offline, including their ability to dial 999, without ever tripping the numerical bar that triggers a report.

Ofcom now admits the regime has been missing exactly the sort of outage that hurts most.

Rural areas, the regulator notes, “typically have a lower density of cell sites compared to urban areas”, which means the loss of even a single site “could completely isolate a rural community from all mobile coverage, including the ability to make emergency calls”.

The fix is a three-point UK-wide map of urban, rural and most rural postcodes, stitched together from the Office for National Statistics’ rural/urban classification for England and Wales, the Northern Ireland Statistics and Research Agency’s settlement data, and the Scottish Government’s six-point scale north of the border.

Any mast that falls inside a rural or most rural postcode will trigger a reporting obligation if it fails, even as a solo outage.

Urban Britain gets a different rule. Outages there only need reporting once 25 or more cell sites in the same area have failed, on the basis that overlapping coverage usually catches the spillover.

The customer-count thresholds also get a refresh: 100,000 users affected for any duration, or 10,000 (or 25% of the operator’s base) hit for eight hours.

A lower threshold

The big number elsewhere in the document: Ofcom is halving the bar for what counts as a critical incident. The threshold for the most serious category, previously called urgent and now relabelled critical, drops from three million user-hours lost to 1.5 million.

That pulls the smaller Tier 2 MVNOs, whose subscriber bases sit between 1.5 and 5 million, into the same severity tier as the big networks.

The other novelty is a monthly mapping requirement. Every mobile network operator will be expected to hand Ofcom a fresh list of every Radio Access Network cell on its books each month, in a standardised format.

The regulator wants to plug the global cell IDs that come in with incident reports straight into that monthly map, so it can see exactly where in the country a blackout landed and how many people it touched.

The rural rule also carries a Shared Rural Network wrinkle.

Under the SRN, operators share masts, power and sometimes backhaul in remote areas. If one of those sites fails, it can knock out every network at once, which Ofcom argues makes the case for treating even a solitary rural failure as reportable.

Other changes

The consultation goes wider than rural reporting. Ofcom says it now wants to lean more on assessment notices, which let it walk into an operator’s premises, interview staff and observe live tests, rather than relying solely on the paper-based information notices it has been sending out roughly once a year.

The regulator frames this as less burdensome for industry. Operators may read it as a sharper set of teeth.

There’s also a fresh push on pre-positioning attacks, the type where a hostile actor quietly gets inside a network to enable a future hit, with Ofcom noting it isn’t seeing anywhere near the volume of reports it would expect given the threat picture.

Severe weather incidents, where dozens of small outages stem from a single storm or heatwave, will also need to be aggregated and reported as one event.

Responses are open until 4 August 2026, with a final statement due in autumn. If the proposals land as drafted, the era of a rural blackout quietly disappearing into a quarterly summary is over.

Now read: Vodafone reaches 26 million UK homes with broadband as new 5G service bridges fibre gap