The Trust Layer That Never Shipped

In August 1964, an engineer at the RAND Corporation published a series of memoranda proposing something that did not yet exist: a communications network with no center. Paul Baran’s On Distributed Communications ran to eleven volumes and answered one question with total clarity — how does a network survive the loss of its parts?

Baran’s problem was concrete. The strategic networks of his day were built like snowflakes: elegant, hierarchical, and dependent on a small number of critical nodes. Destroy the center, and the whole structure went silent. His answer was to remove the center entirely — a mesh of many small nodes, each connected to several neighbors, each willing to forward traffic for any other. Messages would be chopped into blocks and routed dynamically around whatever happened to be missing. If a node died, the network would not mourn it. It would route around it.

After Baran, On Distributed Communications (RAND, 1964), Vol. I.

It was a radical bet, and it won completely. Baran’s redundancy arithmetic showed that surprisingly modest connectivity — roughly three links per node — bought survivability close to the theoretical limit. Independently, Donald Davies at the UK’s National Physical Laboratory arrived at the same architecture and gave its unit of exchange the name that stuck: the packet. The design flowed into the ARPANET, and from there into everything. Every message you have ever sent traveled on Baran’s bet.

But look closely at what the design assumes. Every node forwards for every other. Every node believes what its neighbors tell it — about who they are, about where a message came from, about which paths exist. In 1964 this was not an oversight. Every node in the imagined network belonged to the same owner. Trust was not a protocol feature; it was an ownership fact. The threat model was bombs, not lies. Nobody designs a verification layer for a network whose every component reports to the same chain of command.

Then the design escaped the laboratory.

The network that inherited Baran’s architecture is operated by tens of thousands of independent parties with no common owner, no common law, and frequently opposed interests. And it still runs on the 1964 assumption. A machine says where a message came from; the network takes its word. A network operator announces which destinations it can reach; its neighbors believe it, and re-announce it to theirs. Traffic between two offices in the same city has, on documented occasions, crossed the planet because somewhere, someone asserted a route — maliciously or by typo — and the assertion propagated as fact. The system that cannot be silenced also cannot be contradicted.

The deeper trouble surfaces after something goes wrong. Ask a network what happened and it will tell you — logs, counters, flow records, timestamps. Ask it to prove what happened and the conversation ends. The records are assertions written by the same machinery whose behavior is in question, modifiable by anyone with sufficient access, and consistent with many different pasts. Networks can report. They cannot testify.

So the achievement of 1964 is best understood as one layer of a two-layer problem. The first layer is delivery: getting bits from here to there through a world that keeps breaking. That layer shipped, and it is one of the great engineering triumphs of the century. The second layer is custody: knowing — not assuming, not inferring, knowing — that what the network claims about itself is true. That layer was never built. It was never even on the drawing board, because in the world where the drawing was made, it did not need to be.

Sixty years on, we run civilization on the first layer and improvise the second out of statistics, reputation, and hope.

That is the space we work in. More soon.