Regulation won't fix internet routing security

A push for routing security regulation from U.S. agencies including the FCC won't result in the sort of safe digital ecosystem we all want.

Without the global internet routing system, you wouldn’t be reading this. You wouldn’t be doing anything online, actually. That routing system enables the internet to function by distributing countless bits of data around the world at a moment’s notice.

That’s why routing system security is essential. It’s critical to maintaining privacy online and making sure your information isn’t hijacked by malicious actors and that the information a business, critical infrastructure operator or government agency sends — and receives — is trustworthy.

At the heart of the global internet routing system is the Border Gateway Protocol, which runs across all the networks in the world. From time to time, there have been occurrences in a network operator’s BGP configuration that have consequences for internet users. Thankfully, most of these incidents appear to be accidental. But others do seem likely part of some malicious scheme to disrupt service or help achieve nefarious objectives such as spamming or credential theft.

Network operators and hardware manufacturers globally have long worked to make routing equipment and protocols as secure as possible. Persistent vulnerabilities in the system aren’t the result of backdoors in code or devices that need patching but instead systemic weaknesses in assessing the validity of the information and how it is intended to propagate.

Earlier this year, the FCC opened a Notice of Inquiry questioning network operators’ efforts to secure routing infrastructure, while also calling for comment on its authority to regulate internet routing security measures. The commission pointed to Moscow as one of the main adversaries in cyberspace poised to exploit router vulnerabilities, noting that “Russian network operators have been suspected of exploiting BGP’s vulnerability to hijacking, including instances in which traffic has been redirected through Russia without explanation.”

Even though that’s a real and pressing concern, a push for routing security regulation from federal agencies including the FCC, Department of Justice and Department of Defense is unlikely to result in the sort of highly secure digital ecosystem that we’re all hoping to maintain.

Today’s network landscape is unlike it was at the time when BGP was first implemented in the early 1990s. Of course, the risks facing the modern internet are vastly different due to an increase in complexity and scale, the rise of cybercrime, nation-state cyberconflicts and many other threats. Additionally, the global internet routing system is highly interconnected and spans many jurisdictions across the globe.

Since its early use, the companies and organizations that make today’s web function have worked hard to ensure BGP and routing security measures have evolved and kept pace to meet recent security challenges. But, simply put, routing security incidents are not an immediate existential threat to the internet.

Industry groups want to work with the government on this issue and have long coordinated with agencies such as the National Institute for Standards and Technology on BGP security. In its comments to the FCC, the National Telecommunications and Information Administration emphasized the need to continue this cooperation but warned that a move toward regulation of an issue that involves stakeholders around the world sends a troubling message.

“The Internet’s success over time is testament to the wisdom of the multistakeholder approach, which the Biden Administration reaffirmed last month in the Declaration for the Future of the Internet,” NTIA wrote to the FCC. “In contrast to this vision, authoritarian governments have sought and continue to seek to establish intergovernmental control over Internet standards and governance in multilateral fora. Regulation by the Commission over Internet routing could set a damaging precedent in support of international Internet regulation, in contrast to standing USG policy.”

NTIA is not alone in their pushback. Just the other week, the Broadband Internet Technical Advisory Group Technical Working Group weighed in and released a detailed report outlining the work being done already to address routing security and the risks of unnecessary federal regulation.

As the BITAG report points out, federal regulation could damage actual progress on enhancing routing security. In fact, it runs the risk of locking in outdated methods. While deploying new technical standards, often new operational factors will come up as the system grows in scale. These considerations were often not foreseen during the development process and this adaptability is critical to the internet’s foundation of multistakeholder standards process and the industry has taken to address routing security. Prescriptive regulation threatens this progress.

Does this mean that federal policymakers should take a back seat and not be involved in working toward sustainable updates and protections? Of course not. Rather, policymakers must engage the industry early and often when looking to encourage routing security enhancements. Setting goals rather than specifying technologies is a better tactic when working in a dynamic ecosystem.

A critical area that policymakers should prioritize and would provide a great service to the industry is in the funding of long-term monitoring programs needed to understand routing and effects of changes over time. The programs that exist and have significantly enabled much of the progress so far are the result of communal goodwill and collective contribution. Bolstering this foundation through funding can help ensure the persistent availability of longitudinal data about the global internet routing system.

Routing security is not something that is solved overnight. It’s time for closer coordination between stakeholders and policymakers. Otherwise, we put decades of progress at risk.

Dr. Douglas C. Sicker is the executive director of the Broadband Internet Technical Advisory Group.

Microsoft, tech companies throw weight behind spread of open-source AI

Other signatories of the letter include Meta, Palantir, Perplexity, Mistral, NVIDIA, Mozilla, The Linux Foundation, Hugging Face, Dell Technologies and IBM.

Where’s the Trump administration line on AI regulation?

Critics call FCC router rule a ‘big swing’ that could create more supply chain uncertainty

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure