BGP Is the Internet's Honor System

Ask someone how their video call actually reaches the other side of the planet and most people shrug. Fair enough, it works, so why think about it. Underneath every one of those trips, though, sits a protocol written in the late 1980s that still makes the internet's core traffic decisions, and it runs almost entirely on trust.

That protocol is BGP, Border Gateway Protocol. The internet isn't one network, it's thousands of independently run networks, each with its own name, called an autonomous system, and its own slice of address space. None of them can see the whole picture. So they talk to their neighbors constantly, announcing which addresses they can reach and how to get there. Your ISP hears an announcement from another network, adds itself to the path, and passes that announcement along to its own neighbors. Multiply that across every network on earth and you get a constantly updating, crowdsourced map that somehow gets a packet from a phone in one city to a server in another, usually in well under a second.

Where the trust runs out

Nothing in that process checks whether a network actually owns the addresses it announces. That should bother people more than it does. A network says, in effect, I can reach this block, and its neighbors mostly believe it, because the entire design assumed every operator on the internet was reasonably honest and reasonably competent. When that assumption holds, BGP works beautifully. When it doesn't, a network can announce address space that belongs to someone else, and depending on how far that announcement spreads, real traffic starts flowing to the wrong place. Operators call this a route leak or a hijack, and the difference usually comes down to intent rather than mechanism. The protocol itself cannot tell malice from a typo.

And a typo is usually what it is. Most of the incidents I've heard discussed in operator circles over the years trace back to someone fat-fingering a configuration, accidentally announcing a customer's block more broadly than intended, or misconfiguring a filter meant to catch exactly this. The internet's routing table has no spell-check. A single misplaced entry on one router, in one network, can ripple outward within minutes.

So why hasn't this been properly fixed after forty-odd years? Because fixing it means getting tens of thousands of independently owned, independently operated networks to agree on how to verify each other, and no single authority can mandate that. Nobody owns the internet's routing. Every network has to decide, on its own, that upgrading its equipment and enforcing stricter checks is worth the effort, or get pushed hard enough by peers that ignoring the problem costs more than fixing it. That's an enormous coordination problem wearing a technical disguise. I've sat through enough operator meetings over the years to know the technology was rarely the hard part.

My honest opinion, watching this world for years, is that we should have gotten serious about the trust gap sooner than we did. The risk was well understood long before it got real institutional attention. I also understand why it dragged. Nobody wants to be the first network to reject a neighbor's announcement and risk breaking reachability for its own customers, and the early verification tools were clunky enough to scare people off.

A slow, partial fix

The good news is that the fix has been arriving, just slowly. RPKI, short for Resource Public Key Infrastructure, lets a network cryptographically prove it is authorized to announce a given block of addresses. Paired with route origin validation, other networks can check that proof and drop announcements that don't hold up. Adoption has climbed over the past several years as major transit providers and content networks started rejecting invalid routes by default, which gave everyone downstream a real reason to sign up too. It isn't universal, and given how the internet is owned and operated, it may never fully get there. Still, compared to the first forty years of this protocol's life, when the answer to how do we know this is legitimate was essentially nothing, that counts as real progress.