← Back to overview Language: NL EN

The Internet was designed to be resilient in the face of failure—not to be secure. That was a mistake.

Vinton Gray Cerf

Testimony before the U.S. Senate on cybersecurity, 2010 · Checked on 17 March 2026
The Internet was designed to be resilient in the face of failure—not to be secure. That was a mistake.

Analysis

Cerf’s claim is correct in that the early Internet (ARPANET) prioritized **resilience**—such as packet-switching to route around failures—over built-in security. However, labeling this a 'mistake' is subjective; security was deprioritized due to the network’s initial **trusted-user environment** (military/research institutions), not outright neglect. Later protocols (e.g., TCP/IP) retained this focus, but security flaws (e.g., lack of end-to-end encryption by default) emerged as the Internet scaled. Cerf himself has acknowledged this trade-off in later interviews, framing it as a **design limitation** rather than an error (*Wired*, 2014).

Background

The Internet’s foundations (1960s–1980s) emphasized **fault tolerance** to survive nuclear attacks or hardware failures, not adversarial threats. Early users were a small, vetted community where security relied on **physical access controls** rather than cryptographic measures. By the 1990s, commercialization exposed these vulnerabilities, leading to retrofitted solutions like SSL/TLS and firewalls.

Verdict summary

Vinton Cerf’s statement accurately reflects the Internet’s original design priorities but oversimplifies the historical context of security considerations.

Sources consulted

— Cerf, V. (2010). *Testimony before the U.S. Senate Committee on Commerce, Science, and Transportation* (C-SPAN Archive: [https://www.c-span.org/video/?293306-1/hearing-cybersecurity](https://www.c-span.org/video/?293306-1/hearing-cybersecurity))
— Abbate, J. (1999). *Inventing the Internet*. MIT Press (pp. 120–145, on ARPANET design goals).
— Greenberg, A. (2014). *Wired: ‘The Internet’s Original Sin’*. [https://www.wired.com/2014/05/internet-original-sin/](https://www.wired.com/2014/05/internet-original-sin/)
— RFC 821 (1982). *Simple Mail Transfer Protocol* (illustrates lack of built-in authentication in early protocols).