The vulnerable Border Gateway protocol, a quick-fix solution from 1989, still directs most internet traffic
Net of insecurity Part 2 — The long — life of a — quick ‘fix’ — Internet protocol from 1989 leaves data vulnerable to hijackers — The long life of a quick ‘fix’
Context & Ripple Effects
This 2015 Washington Post piece is the early-warning entry in a decade-long arc on Border Gateway Protocol's insecurity. It flagged that a trust-based protocol from 1989, largely unchanged since 1994, still directs most internet traffic and keeps routing decisions vulnerable to hijackers.
What followed validates the warning: Cloudflare built a public scorecard in 2020 that names which ISPs have added filtering via its Is BGP Safe Yet site (Cloudflare's ISP security checker), and by 2024 the pressure reached the executive branch with the White House publishing a roadmap to shore up BGP security. The story matters because it documents the moment before remediation became institutional.
First-order effects
- ISPs and backbone operators running BGP remain directly exposed: any network can announce routes it does not own, misdirecting traffic through hijacker-controlled paths.
- Enterprises and end users whose providers lack filtering inherit that exposure silently, since nothing in the default protocol verifies a route's legitimacy.
Second-order effects
- Public accountability tools like Cloudflare's checker turn BGP hygiene into a competitive signal, pressuring laggard ISPs to adopt protections or lose credibility with peers and large customers.
- Government attention, culminating in the White House roadmap, shifts the fix from voluntary operator goodwill toward policy expectations for critical internet infrastructure.
Third-order effects
- If the pattern holds, internet routing moves from a 1989-era honor system toward validated route announcements as standard practice — a structural change in who bears responsibility for core-infrastructure security, from nobody to named operators and regulators.
The trend: Core internet infrastructure is being dragged from informal trust-based operation toward verifiable security standards, with BGP as the highest-stakes test case.