James Galvin: So, when I start­ed with the Internet when I grad­u­at­ed from col­lege and I was going on to grad­u­ate school, I knew that I want­ed to get into net­work­ing. And so that’s what I jumped into and I chose my grad­u­ate school accord­ing to that desire and those wish­es. And that was a good thing. I mean that was back in the ear­ly 80s, before net­work­ing was real­ly too much of a thing. And it was an excit­ing time back then. The grad­u­ate school that I went to was an impor­tant part of what was then DARPANET. That allowed me the oppor­tu­ni­ty to get into secure email tech­nolo­gies. And from there I got into DNS secu­ri­ty tech­nol­o­gy. And I’ve done a vari­ety of things along the way. And as part of that, I start­ed attend­ing the IETF back in 1989. So I’ve been at this for a very long time. I’ve had var­i­ous roles in the IETF along the way, in work­ing groups and in fact I was chair of the work­ing group that had cre­at­ed the DNS Security stan­dard. It was my team at the com­pa­ny that I worked at at that time that had done the first pub­lic domain imple­men­ta­tion. And today I con­tin­ue because ensur­ing that we have open stan­dards is an impor­tant part of the suc­cess of an open Internet. For how­ev­er you want to define ​“open,” and I define it rather broadly.

Access and free­dom for all to use it and express it in a way that does not keep the oth­er man from using it, too. 

Intertitle: Describe one of the break­through moments or move­ments of the Internet in which you have been a key participant.

Galvin: Yes, there are actu­al­ly two break­through moments that I want to talk about. One real­ly was secure email, when I had got­ten involved in that. Because in the ear­ly days, when we were first doing it, the first gen­er­a­tion of secure email tech­nolo­gies was focused on a pub­lic key infra­struc­ture and the idea that every­body would have some kind of cer­tifi­cate that would gen­er­al­ly be avail­able and we’d have some kind of you know, sin­gle, hier­ar­chi­cal dis­tri­b­u­tion of cer­tifi­cates and all be used. 

And that was inter­est­ing because the way that cer­tifi­cate tech­nolo­gies worked back then, there was no deployed infra­struc­ture for that dis­tri­b­u­tion. So there was no way to cause that mod­el to come into exis­tence. But then it was decid­ed to move into DNS Security. It was a con­cept that was invent­ed in fall of ​’91, hall­way con­ver­sa­tions in the IETF, which are a nice col­lo­qui­al­ism for the way a lot of things get start­ed in the IETF. And we kicked off a work­ing group in March of 1992. And I was chair of that work­ing group for the length of its exis­tence through three gen­er­a­tions of the DNS Security protocol.

But that was the sec­ond moment, was the abil­i­ty to get involved in DNS Security, because real­iz­ing that you could take a globally-deployed nam­ing infra­struc­ture, some­thing which you could then put in your pub­lic key or your cer­tifi­cate, and you could imag­ine that users could get domain names and then at their domain name you now had a glob­al­ly unique nam­ing infra­struc­ture. And now you could put use­ful data out there like your secu­ri­ty key. And sud­den­ly you could actu­al­ly deploy secure email. 

At the time that’s what was inter­est­ing. When the Web came around in ​’94, ​’95 and you had all of that and the Internet start­ed to become the Internet as we know it today, the next thing that hap­pens is you moved towards secure Web access. And your trans­port lay­er secu­ri­ty used cer­tifi­cates, too. And sud­den­ly you had anoth­er use for DNS Security. And that would be for being able to secure web sites out of the box, would be very nice. Now, we’re not even there yet, fif­teen years lat­er on that par­tic­u­lar sce­nario. But that’s a future that I’d like. But I guess we’ll get to that as we dig fur­ther here into what’s coming. 

Intertitle: Describe the state of the Internet today with a weath­er anal­o­gy and explain why.

Galvin: I would say that the Internet is part­ly cloudy. We have a work­ing Internet in many ways. A lot of peo­ple on, it’s grow­ing all the time. You know, the kind of things You want to be hap­pen­ing are hap­pen­ing. But the rea­son why I say it’s part­ly cloudy is because there are areas, there are places, there are miss­ing tech­nolo­gies, there’s miss­ing coop­er­a­tion. And of course there are just areas of the world that don’t use the Internet in an open way and impos­ing their own will and restric­tions. So I think there’s a place to get to yet. So, it’s part­ly cloudy, which makes it most­ly good. 

Intertitle: What are your great­est hopes and fears for the future of the Internet?

Galvin: I look at the Internet and I think it’s… The great­est threat to the secu­ri­ty and sta­bil­i­ty of our Internet today is dis­trib­uted attacks, dis­trib­uted denial of ser­vice attacks in par­tic­u­lar. The Internet was built on a foun­da­tion of it works because every­body coop­er­ates and we all agree. And that was a great envi­ron­ment when you pret­ty much could name every­body who was on the Internet, or you got to where you could name all the sites and you know, you could name all the orga­ni­za­tions. And we very quick­ly grew out of that as we got into the 90s. It just became an unten­able sit­u­a­tion. And we haven’t changed that a great deal. The base­line pro­to­col, the Internet Protocol—IP—and TCP on top of that, you know, the Transmission Control Protocol, they’re all based on the idea that every­thing works because every­body just coop­er­ates. To the extent that even all of the rout­ing, all the net­works work because they all coop­er­ate in rout­ing and nobody tries to cheat. Again, every­thing works. 

But because there are not a lot of con­trols placed on those base­line pro­to­cols and those under­ly­ing lay­ers on which every­thing is built, there is still oppor­tu­ni­ty, and a lot of oppor­tu­ni­ty, for peo­ple to cheat and for mali­cious actors to do bad things. Which has hap­pened. Generally these things are noticed by the peo­ple who are prin­ci­pals who pay atten­tion to how their net­works and infra­struc­tures are oper­at­ing. But the fact that it can occur is real­ly an issue. You know, you have gov­ern­ments and nation-states that choose to take con­trol of their Internet from their pop­u­la­tion and things like that. 

So you know, my fear is mali­cious actors. Because there’s still too much oppor­tu­ni­ty, in my opin­ion, as some­one who’s been a secu­ri­ty tech­nol­o­gist for a long time, for them to abuse the net­work and do bad things and bring bad things to far too many people. 

My great­est hope is that we are final­ly begin­ning to see some growth in deploy­ment of DNS Security. The DNS is an infra­struc­ture pro­to­col. In today’s Internet, vir­tu­al­ly every­thing that you do depends on the DNS as an ordi­nary user. So your brows­er and every­thing that you do with your brows­er, and all of your appli­ca­tions that you use from your work and your employ­ment, they all depend on the DNS in one form or anoth­er. And DNS Security is in that sense a crit­i­cal infra­struc­ture pro­to­col, only one of the few, that the abil­i­ty to secure that and pro­tect it and ensure its integri­ty is a foun­da­tion on which you can build all kinds of things. And it sets you up for the oppor­tu­ni­ty to pro­vide not just a sta­ble but a secure Internet for every­thing, every­body, and for things to come that we haven’t even invent­ed yet. I mean, I spoke ear­li­er about my moti­va­tion for DNSSEC you know being indi­vid­ual users being able to put secu­ri­ty infor­ma­tion out there that can be used pro­tect com­mu­ni­ca­tion with them. That same kind of prin­ci­ple applies to appli­ca­tions and oth­er ser­vices. Because with DNS, it is the only globally-deployed infra­struc­ture pro­to­col that every­body uses. It’s very sim­ple. It’s just a lookup sys­tem. The idea of look­ing up secu­ri­ty tokens? You know, that would just be out­stand­ing. So my hope is that as we see more deploy­ment, we’ll begin to see more and more inter­est­ing ser­vices and func­tions built that will make the Internet a safe and secure place for everybody. 

Intertitle: Is there action that should be tak­en to ensure the best pos­si­ble future?

Galvin: One action in a larg­er con­text— I mean, tech­nol­o­gists will always build new tech­nolo­gies. So you’ll always have this arms race, is the col­lo­qui­al­ism for you know, the descrip­tion between the good actors and the bad actors. So, what­ev­er you do the bad actors will still find a way—eventually a way around it or through it or some­thing. But what we don’t do today as a soci­ety is gov­ern­ments are not as good, yet, about coop­er­at­ing to do things in an open and free way. And ensur­ing that they deploy tech­nolo­gies that enhance the secu­ri­ty and sta­bil­i­ty of the Internet. One of the things that the Internet does offer you is anonymi­ty, for exam­ple. But there’s a lot­ta data col­lec­tion that goes on in the Internet, and there’s a lot­ta cor­re­la­tion of all of that data which pre­vents you from hav­ing any kind of anonymi­ty or pseu­do­nymi­ty on the Internet. 

Now the down­side of offer­ing anonymi­ty and pseu­do­nymi­ty is the fact that you have to be able to pro­tect your­self from bad actors. And so, there are things that we need to do to pro­tect our­selves from bad actors that we’re not doing today. When I talked about the biggest threat fac­ing us and I talked about denial of ser­vice attacks, one of things that we don’t do in the Internet today glob­al­ly is be cer­tain of the ori­gin of infor­ma­tion as it flows around the Internet. There are tech­nolo­gies that have exist­ed for more than ten years. This is a known prob­lem that has a known solu­tion, and yet nobody wants to deploy it. And that’s because there’s no mech­a­nism for mak­ing that come into exis­tence. And I think there’s an oppor­tu­ni­ty for nation-states in par­tic­u­lar to require that we work togeth­er, require that the net­works with­in their sov­er­eign­ty and their rela­tion­ships with oth­ers, they work togeth­er to pro­tect each oth­er from things that cir­cu­late around the Internet that should­n’t be there. You know, check­ing the source of pack­ets that are flow­ing around and know­ing that they could have rea­son­ably come from where they say they’re com­ing from. I mean, that’s a dis­trib­uted denial of ser­vice attack, and that’s our biggest threat and I think that’s the action that we should look for­ward to. People need to talk about this and sit down and decide that they want to fix it.