De La Rosa questions approval process for Motorola updates

So I'm sorry.

So we go through a whole, there's a whole process to do that.

The one thing that I just want to say is I'm sorry, just to finish answering that question, because while Motorola, Motorola's update was the thing that triggered the issue.

I think additionally, just again in terms of full exploration of all the issues, is

we did not become aware, OTI additionally did not become aware when the issue was originally started surfacing.

So I just, this goes back to why I can't necessarily ascribe responsibility across the board.

Because there were a lot of components and a lot of people who were involved and who ideally should have triggered an issue.

The thing that I will say is, I apologize, what was the question?

My question was when Motorola deems that this is a necessary update.

Yes.

I'm assuming someone approves that that is indeed the case.

Yes.

So what is that process of walking through an approval?

Like, does it come to your desk?

Where does it go in the infrastructure?

to determine that it is indeed critically necessary for the update to happen.

Yeah.

Or is it more like it happens every six months, every five months?

What is the process?

Yeah.

So there is a really rigorous process that's supposed to be in place for doing testing and rollout and approvals.

Obviously, it needs to be revisited and reexamined very, very closely.

Generally, PSACs are managed by all three of these agencies.

That's who governs it.

There's also a change advisory board where all changes go through and get approval in order to move forward into the environments.

In this case,

Motorola is a managed service, or they run this service for us, meaning we do not have direct access to the systems.

We pay them to implement, support, maintain, upkeep, keep them up and running.

They're in fact registered with the FCC as the managed service vendor of record for the 911 services.

The process that happens is Motorola says there's a security update needed, a firmware patch.

It is, there's a risk assessment associated with it.

In this case, it was deemed low risk.

They evaluated it as low risk.

Typically, that is the case.

case for firmware upgrades.

And so they associate it as low risk, and so based on that, it goes through escalating procedures depending on the level of risk.

And so in this case, because it was low risk, it did not get executive sign-off from the cab, it wasn't deemed to require that.

So that's

part of, again, what we need to revisit from a process perspective.

So Motorola.

Knew were the ones who said, hey, this is a patch that is required and is necessary.

They deemed it to be low risk.

We, OTI specifically, and then kind of via the CAV, Change Advisory Board, review what comes through as those documents.

Again, the higher the risk, the more documents come through.

And through that process, things then get rolled out.

And again, this one was low risk, so it did not go through the rigorous scrutiny that it might have.