Why BGP remains the Internet's weak link
The Border Gateway Protocol (BGP), conceived in 1989 — before SSL was even a concept — was designed to let independently operated networks signal the IP prefixes they own or can reach. But its original architects never intended it to be secure. BGP assumes mutual trust between the thousands of networks that form the Internet, making it vulnerable to hijacks, leaks, and manipulation.
As networks exchange reachability information for prefixes like 104.16.128.0/20, they build a constantly shifting map of the Internet. Operators use paths announced by neighboring networks, which in turn pass along announcements from other peers — decisions based on criteria chosen by each operator, not necessarily on visibility into security or performance basics. Since any network can announce a prefix, malicious actors can claim to be the origin of an IP range they don't own, or position themselves as an intermediary to intercept and inspect someone else's traffic.
How RPKI fills the gap
The security framework developed over time is the Resource Public Key Infrastructure (RPKI) — a PKI infrastructure for the IP addresses and Autonomous System Numbers (ASNs) that networks use to identify themselves. Via RPKI, operators issue Route Origin Authorization records (ROAs) binding their IP prefixes to their specific ASN. Other networks and services can check those records when they see a BGP announcement. That check, called Route Origin Validation (ROV), is used by receivers to accept or reject announcements from origin networks based on whether matches exist in the ROA data. In short, RPKI puts a cryptographic verification step into what previously was a purely trust-based process.
The high price of routing mistakes and attacks
The published White House roadmap focuses on strengthening this last-mile trust gap across the Internet. The reasoning is rooted in increasingly costly incidents:
- In 2022, attackers hijacked part of an IP range from Korea-based crypto platform KLAYswap to impersonate a JavaScript SDK served to their customers. Since attackers controlled the hijacked IP address, TLS certificates were issued validly for the associated domain. Customer wallets were eventually drained — costing around $1.9 million.
- In that same year, a misconfigured Russian ISP (RTComm, AS8342) accidentally announced a Twitter (now X) IP prefix (
104.244.42.0/24) as its own. Communities stepped in afterward to restore service. - Cloudflare's 1.1.1.1 DNS resolver, reachable at
1.1.1.1, is its own landmark—and sometimes, accidental test target — for routable IP announcements by networks with local configuration errors. These wrong announcements are called route leaks.
In these failures, the consequences differ: the crypto theft could have been stopped with ROA records. The RTComm/Twitter case, direct hijack of a Twitter as an IP origin, was mostly mitigated because the RPKI database contained ROA records for those Twitter prefixes — networks validating routes rejected RTComm. For the 1.1.1.1 case, presence of ROA records confirms the true origin and blocks bogus announcements from other origin networks. ROA-based filtering would prevent the entire class of hijacks from succeeding because invalid routes would be immediately filtered.
RPKI relies on validating networks keeping ROA data up to date. What's missing is widespread adoption — and the White House roadmap aims to close that gap, guiding the federal government's own role in this new security Internet layer.
How we got here
The White House roadmap builds on years of groundwork across government and industry. NIST has long pushed routing security forward with test and measurement tools and special publication 1800-14 on Protecting the Integrity of Internet Routing. Cloudflare began publicly advocating for RPKI adoption after a massive BGP route leak in 2019 took down portions of the Internet, including sites on Cloudflare's network.
Federal action has picked up steadily since then. The 2020 Cyberspace Solarium Commission report urged the government to develop common implementable guidance for securing DNS and BGP. In February 2022, the FCC opened an inquiry into Internet routing vulnerabilities; Cloudflare responded with its RPKI history. A joint FCC-CISA workshop followed in July 2023, and in June 2024 the FCC issued a Notice of Proposed Rulemaking that would require large service providers to develop security risk management plans and report on RPKI adoption. The White House's March 2023 National Cybersecurity Strategy cited BGP vulnerabilities as a strategic concern, and in May 2024 the Department of Commerce signed ROAs for some of its IP space — a step the roadmap now urges other agencies to take.
The state of play
The ONCD report assesses current BGP security and the challenges around ROA issuance and ROV adoption, then lays out next steps for operators and agencies.
Its first recommendation is that all networks create and publish ROAs for their IP prefixes. Without one, other networks cannot verify that the advertiser is the authorized origin — so a missing ROA is itself a red flag when a prefix appears from an unexpected source.
Adoption has grown substantially. As of September 2024, at least 53% of all IPv4 prefixes on the Internet have a valid ROA, up from 6% in 2017; IPv6 crossed that milestone in late 2023. By traffic share, Kentik data shows 70.3% of Internet traffic is exchanged with prefixes that have a valid ROA.
The US lags: only 39% of IP prefixes originated by US networks have a valid ROA. That partly reflects the sheer scale of US address holdings, but the report points to familiar operator barriers — administrative burden, perceived risk, and competing priorities and resources — as reasons US adoption trails other regions.
The roadmap also flags the messy reality of IP address allocation. Networks that let customers control address space still need to ensure ROAs point to the correct entity in official records.
Validation and filtering
Signing routes is only half the job. Without ROV, a network's incorrect announcement of itself as origin for 1.1.1.1 would have no effect beyond its own borders if no neighbors accept the invalid route. The roadmap calls on network service providers to filter invalid routes, and the report leads with a recommendation for full ROV deployment by providers of all sizes.
Progress on validation has been steady. Cloudflare data from 2022 showed about 15% of networks validating routes. APNIC measurements now show roughly 20% of its probes globally filter invalid routes with ROV; in the US, that figure is 70%.
The roadmap also leverages federal purchasing power, recommending that the Office of Management and Budget require contracted service providers to adopt commercially viable routing security technologies. Broadband grant programs, it says, should require recipients to incorporate routing security into their projects.
Beyond established practice, the report highlights emerging standards. ROAs only cover part of the routing ecosystem, so the community is working on ASPA (Autonomous System Provider Authorization) and BGPsec to secure the relationships between networks, not just prefix origins. The roadmap acknowledges that work and explicitly follows it.
A fuller picture of route security
BGPsec and ASPA extend RPKI to validate not just the destination of a prefix but the path taken to reach it. Combined with ROV, these additions aim at a fully secure signaling protocol for routing. Separate from RPKI, the community has formalized customer roles through RFC9234, covering route leak prevention and detection using roles in UPDATE and OPEN messages — a further tool operators can use against route leaks as support grows.
Operators can act now: sign ROA records with their Regional Internet Registry and apply ROV so only signed routes are accepted. Non-operators can check their ISP at isbgpsafeyet.com and make clear that routing security matters to them. With government prioritization now explicit, the roadmap gives the community both a yardstick and a push.
