Is regulated BGP security coming?
Perceived Severity of BGP Risk
- One view: operators have largely self-organized; BGP hijacking is rare compared to other attack vectors and often not impactful on well-run networks.
- Counterview: incidents still cause large, global outages and are exploited for censorship, crypto theft, and abuse; thus BGP hijack must be in any realistic threat model for internet-reliant operations.
- Some argue “least likely” vectors become more attractive once others are hardened.
Self-Regulation vs Government Regulation
- Some see FCC action as a justified response to slow industry uptake of protections like RPKI (e.g., low US deployment decades after introduction).
- Others call it a dangerous power grab, preferring multistakeholder internet governance and warning against nationalizing or politicizing routing (e.g., “Great Firewall of the USA” concerns).
- Debate over whether states are ultimate authorities or merely delegating to RIRs and multistakeholder bodies; skeptics note states can always reclaim authority.
RPKI, ASPA, and Technical Limits
- RPKI is viewed by some as the natural cryptographic ownership mechanism; others note it doesn’t fully stop hijacks and needs extensions like ASPA.
- Confusion and criticism around how exactly RPKI prevents specific attack modes; some claim it “stops nothing” without additional mechanisms.
- Concerns about RPKI trust anchors being long-lived and high-value single points of failure.
Deployment, Legacy Space, and Incentives
- Legacy IPv4 holders resist RPKI due to ARIN contracts/fees, arguing they never agreed to new terms.
- Others argue reachability is a privilege; if you won’t participate in RPKI/IRR, you shouldn’t expect global routing guarantees.
- Suggestion of financial bonding or penalties for false announcements to create accountability, especially for chronically misbehaving regions.
Analogies to TLS/PKI and Centralization
- Some compare BGP regulation and RPKI to the transition to mandatory HTTPS/TLS: initially seen as a power grab but later accepted as necessary.
- Others see the TLS/CA ecosystem as a cautionary tale: central CAs (and now Let’s Encrypt) as single points of failure and gatekeepers, harmful for small “human” websites.
Related Security Measures and Threat Models
- Comparisons to SS7, which is regulated yet still lacks strong cryptography.
- Debates over DNSSEC, CAA, and Let’s Encrypt’s handling of BGP-hijack-based certificate misissuance.
- Calls for mandatory IP source validation (strict uRPF) at edge ISPs; noted as infeasible in the core due to asymmetric routing.