Beyond Technical Solutions Understanding the role of governance structures in Internet routing security Dr. Milton Mueller Dr. Brenden Kuerbis

This research is supported by the U. S This research is supported by the U.S. National Science Foundation, Award Number SES-1422629. Begin date: August 15, 2014; end date July 30, 2016

Research Problem The Internet’s routing protocol, Border Gateway Protocol (BGP) is known to be susceptible to errors and attacks. Most research on Internet routing security concentrates on technical solutions (new standards and protocols). But what if the obstacles to improved routing security are not just technical?  RQ: Are distinct governance structures among networks correlated with variation in the number and severity of routing anomalies? Most research on Internet routing security concentrates on technical solutions (new standards and protocols). But what if the obstacles to improved routing security are not just technical? What if the susceptibility of networks to malicious route hijacks and path manipulations have as much to do with the way organizations implement routing policies and technologies as with the technical standards and protocols per se? What if a new technology designed to “solve” routing security problems creates new, unanticipated implementation and cooperation issues that could undermine many of the theoretical security gains of the better design? Despite the role of socio-economic factors in security, studies of routing security are not adequately supported by social science studies of the actual behavior of network operators. This project is based on the premise that organizational and institutional factors – known as governance structures in institutional economics – are as important to Internet routing security as technological design. Internet routing involves decentralized decision making among tens of thousands of autonomous network operators. In this environment, an individual operator’s decisions regarding implementation, organization and monitoring of routing policies powerfully affect the adoption and performance of security technologies.

Governance structures Definition The institutional framework in which contracts are initiated, negotiated, monitored, adapted, enforced and terminated Markets, hierarchies, networks Relevance to routing security Networked governance

Levels of analysis of governance structures Macro Meso Micro The Internet is comprised of hundreds of thousands of distinct organizations with varying incentives and operational goals. Routing is a decentralized, cooperative process in which network operators exchange information and use contracts or other kinds of voluntary agreements based on common technical standards to exchange traffic. In Internet routing, institutional and regulatory authority is also decentralized; while there is global connectivity, there are approximately 200 separate national legal jurisdictions and no common, hierarchical global regulatory authority over all the organizations that comprise the Internet and their routing practices. Routing security, therefore, must be achieved through a bottom up process of self-governance. As a result, deploying secure Internet routing is much more challenging than just installing a piece of hardware or performing a software upgrade. It requires understanding the socio-economic factors that influence operators’ cooperative practices and technology implementation decisions. This study will use an innovative combination of institutional economics and network analysis to isolate and understand the governance structures underlying Internet routing, and attempt to determine which governance structures lead to more or less routing security incidents.

Dependent variable Anomaly monitoring systems Numerous systems Identifying differences between observed & expected route announcements What are routing announcements? Prefix and AS Number (ASN) What is an anomaly? Prefix hijacks and path manipulation Limitations of anomaly monitoring systems Incompleteness of the observed AS-level structure of the internet Over- and under-estimation Identification of perpetrators and new types

Initial quantitative findings Observed routing & anomaly data for June 2011 – October 2014 Notable variation in the number of anomalies among ASs Number of routing anomalies is correlated with number of out- degrees 0.269** correlation

Independent variable: governance structures Internet Address Registries Macro-level Became regionalized from 1991 - 1997 Internet Routing Registries (IRRs) Key meso-level governance structure Few academic studies of them as institutions Important variations across IRRs New Technologies grounded in Regional Address Registries (RIRs) RPKI BGPSEC

Internet Routing Registries (IRRs) Databases that allow AS’s to register their own routing policies and validate routing policies of other AS’s. Extensive mirroring of data across different IRRs based on standard formatting Who operates them? Specialized third parties Tier 1 Internet service providers RIRs and NIRs Hosting/colocation companies, Internet Peering Exchanges How are they sustained economically? Free/open Fee-based Service-based

Economic and governance analysis of IRRs Do IRRs have public good characteristics? Nonrival consumption, nonexclusive benefits Voluntary data input by many autonomous actors Open access to data; some data mirrored across registries What governance structures are used to ensure data accuracy and currency? Contracts Data and access controls Linkages to macro-level institutions (RIRs) How to detect IRR use?

IRRs vs. other solutions Data quality inetnum (IRR) vs. Route Origin Authorization (RPKI) Routing security Route object registration (IRR) vs. Route Origin Authorization (RPKI) Filtering out anomalous route announcements (IRRs) vs authenticating all announcements (BGPSEC) Individual AS benefit (IRR) vs. overall network benefit (BGPSEC) Major implications for governance mode Networked governance vs. hierarchical governance

Final thoughts Policy implications Are there ‘best practices’ for IRRs and operators? Should RIRs facilitate or mandate new tech adoption? Should national regulators require use of specific technologies? Need for closer engagement of computer science, policy studies, political economy, institutions