Economics, Governance and the Human Dimension

Author

K19G

Updated

October 31, 2026

Economics, Governance and the Human Dimension

Securing global routing is fundamentally an economic, political, and human governance challenge. Technology alone does not secure the Internet; rather, protocols are adopted when economic incentives align, institutional frameworks mandate compliance, and operational liability outweighs the friction of change.

Who Is Responsible for What: A Stakeholder Map

The global routing ecosystem comprises multiple distinct stakeholder groups, each operating under conflicting incentives:

+--------------------------------------------------------------------------+
|                       Global Routing Stakeholder Map                     |
|                                                                          |
|  +--------------------+                                                  |
|  | Standards & Policy | ---> IETF / IRTF / Regional Internet Registries  |
|  +---------+----------+      (Defines RFCs, operates Trust Anchors)      |
|            |                                                             |
|            v                                                             |
|  +--------------------+                                                  |
|  | Infrastructure Core| ---> Tier-1 Transit Providers & Hyperscale Cloud |
|  +---------+----------+      (Cogent, NTT, Lumen, AWS, Google, Cloudflare|
|            |                 High deployment of ROV and strict filters)  |
|            v                                                             |
|  +--------------------+                                                  |
|  | Access & Regional  | ---> Regional Telcos, ISPs, Mobile Operators     |
|  +---------+----------+      (Mixed adoption; sensitive to support costs)|
|            |                                                             |
|            v                                                             |
|  +--------------------+                                                  |
|  | Enterprise & Stubs | ---> Banks, Universities, Municipalities, SMBs   |
|  +--------------------+      (Lowest awareness; slowest to create ROAs)  |
+--------------------------------------------------------------------------+
  1. Standards Bodies (IETF, IRTF): Engineer protocols (BGPsec, ASPA, RTR). They operate by consensus and have zero authority to force commercial networks to deploy standards.
  2. Regional Internet Registries (RIRs): Allocate IP addresses and AS numbers; operate RPKI Trust Anchors and repository infrastructure.
  3. Tier-1 Transit Providers: Maintain the global backbone. They bear the heaviest computational load and traffic volume during incidents.
  4. Content Providers and Cloud Hyperscalers: Heavily motivated to adopt security to protect customer trust and latency SLAs.
  5. Stub Networks and Enterprises: Tens of thousands of small organizations that view routing as a utility, lacking dedicated BGP engineering expertise.

Economic Incentives and Disincentives for Adoption

The persistent delay in achieving universal routing security is rooted in a classic positive externality problem: - When Network \(A\) signs its ROAs, it protects itself from being hijacked, but it expends engineering labor to do so. - When Network \(B\) deploys ROV filtering (dropping Invalids), it expends CPU power, risks support tickets from broken third-party ROAs, and protects everyone else on the Internet, while receiving no direct commercial revenue for doing so. - Customers rarely choose an Internet Service Provider based on whether the provider validates RPKI routes; they choose based on price, bandwidth, and geographic availability.

The Role of RIRs, Regional Communities and IETF

The five RIRs (ARIN, RIPE NCC, APNIC, LACNIC, AFRINIC) have transitioned from passive allocation registries to critical operational certificate authorities: - Hosted vs. Delegated RPKI: RIRs provide hosted web portals allowing non-technical operators to create ROAs with a few clicks, driving the majority of global RPKI adoption. - RIR Coordination: RIRs coordinate via the Number Resource Organization (NRO) to standardize TAL formats, certificate expiration policies, and repository architectures. - Regional Operator Groups (NANOG, RIPE, APRICOT): Serve as the primary forums where network engineers share post-mortem analyses, establish informal social pressure, and develop shared operational norms.

MANRS, IRTF and Industry Self-Regulation

In the absence of a global regulatory body with binding jurisdiction over Internet routing, the industry has turned to self-regulation through Mutually Agreed Norms for Routing Security (MANRS): - The MANRS Observatory: Provides public transparency by grading operators on their routing hygiene, making poor security visible to enterprise procurement officers. - Peer Pressure and Commercial Mandates: Major financial institutions and cloud providers now require transit providers to be MANRS-compliant as a mandatory condition in Request for Proposal (RFP) vendor contracts.

Why Technically Sound Mechanisms Fail to Deploy

History demonstrates that technical elegance does not guarantee adoption: 1. The Curse of BGPsec: A mathematically brilliant protocol (RFC 8205) that failed because it demanded massive hardware upgrades, high CPU latency, and universal deployment before delivering value. 2. The Success of RPKI and ASPA: Pragmatic, out-of-band protocols that deliver immediate security benefits to early adopters without requiring router ASIC replacements. 3. The Lesson: On the global Internet, incremental deployability and backwards compatibility always defeat cryptographic purity.