By Ahmad Hathout

Verizon, AT&T and Lumen Technologies have proposed that the Federal Communications Commission adopt and lead a strike force consisting of various industry, government and international participants to come up with policy mechanisms to secure internet traffic over the global gateway.

The proposals are particular to the border gateway protocol, which is how global traffic is routed. The problem is that there are no security features to ensure trust of the information being routed, according to the FCC, which opened a proceeding on the matter on February 28 last year asking for commentary on what to do about the issue. The concern is that without security measures, bad network actors can redirect traffic to itself instead of the intended recipient, which exposes Americans to the theft of identity, extortion, financial transactions, and state spying, the commission noted.

In the letter last week, the three telecommunications companies proposed that secure internet traffic routing practices over the border gateway protocol first focus on critical infrastructure entities in the United States and its allies to allow these telecommunications companies to protect the traffic routes via filtering.

The filtering would involve registering traffic origins and identifying where to filter traffic along the route, including at interconnection peering points and customer routers. The proposed strike force would involve Big Tech companies and cloud platforms, which the FCC asked if it should include in its original proceeding document, as they have networking equipment and BGP routers. The internet service providers, who have their own filtering practices, also floated the possibility of the Cybersecurity and Infrastructure Security Agency requiring other agencies to provide that information.

The proposal also includes “collaborative assurances” in which the ISPs would provide confidential technical briefings about the practices.

But they advise against the FCC making prescriptive rules about such practices, noting that different ISPs have different approaches by design, and that any onerous approach could jeopardize security, not bolster it.

Questions about FCC’s jurisdiction over a fundamentally global internet routing system

The trio also questioned the jurisdiction of the commission on the routing ecosystem, which is fundamentally global.

“Asserting prescriptive regulatory control over internet protocols could have cascading effects, prompting international regulators – and authoritarian regimes in general – to seek greater internet control at the global level through” the United Nation’s telecommunications regulatory, the International Telecommunication Union.

“This would create barriers to US leadership in the global digital economy and U.S. national security and is directly contrary to core interests of the United States and our free market democratic allies,” they added.

The FCC’s notice came just days after Russia’s invasion of Ukraine, which resulted in reports of increased cyberattacks from the warring regions. In fact, the FCC accused Russian network operators of inexplicably routing traffic through its country, including from traffic from Google, Facebook, Apple, Microsoft and major credit card companies MasterCard and Visa.

It also came before a law was passed that requires critical infrastructure companies to report to the federal government within a certain timeframe when they have experienced a hack or breach, as the country grapples with a number of high-profile attacks since the pandemic began.

The FCC has targeted national security threats by halting license authorizations to Chinese firms and putting on a blacklist a number of companies whose equipment American telecommunications companies are expected to remove from their networks.