RPKI and ROV Block BGP Hijacks Before They Reach Your AS — 48% of Prefixes Remain Unprotected
On July 31, 2026, a European cloud operator's prefix was hijacked for four hours via a fraudulent BGP announcement originating in Southeast Asia. RPKI and ROV would have stopped the incident in 87 seconds — yet nearly half of all IPv4 prefixes globally still lack protection.
July 31, 2026, four hours, one prefix: a European cloud operator lost control of its IPv4 block after an unauthorized AS in Southeast Asia announced the route as its own. Traffic destined for Frankfurt servers landed in Jakarta. Monitoring tools detected the incident — but they didn’t block it. There was no ROV on the path.
The Resource Public Key Infrastructure (RPKI) and Route Origin Validation (ROV) have existed since 2012. In 2026, they remain the only automated defense against accidental or malicious BGP hijacks. Yet according to the NIST RPKI Monitor from August 2026, 48% of IPv4 prefixes are still not covered by a valid ROA. This is not a technology problem — it’s a willpower problem.
BGP Hasn’t Changed Since 1989
Border Gateway Protocol version 4 (RFC 4271) is the protocol that keeps the Internet running. It operates on a simple principle: each Autonomous System (AS) announces the prefixes it knows how to route, and routers pick the best path. The vulnerability has been known from day one: any AS can announce any prefix.
On December 24, 2004, AS 9121 (TTNet, Turkey) accidentally advertised the entire global BGP table. The result: a massive Internet outage. In April 2018, a Russian ISP hijacked traffic for Google, Apple, Facebook, and Microsoft by announcing their prefixes. In February 2022, AS 55410 (Vodafone Idea, India) hijacked Cloudflare’s 103.21.244.0/22 prefix — traffic for thousands of websites traveled through Mumbai for 17 minutes. In June 2025, a misconfigured BGP optimizer at a major CDN provider leaked over 2,000 prefixes, causing a 90-minute brownout across North America.
Every time, the response is the same: “enable RPKI.” In 2026, 18 years after the first RPKI specification (RFC 3779), the message still hasn’t reached half of all operators.
How RPKI + ROV Stop a Hijack in Under Two Minutes
The mechanism is cryptographic and decentralized:
- Each IP block holder creates a Route Origin Authorization (ROA) — a digitally signed statement that says “prefix 192.0.2.0/24 may ONLY be announced by AS 64500.”
- ROAs are published through the five Regional Internet Registries (RIRs) — RIPE NCC, ARIN, APNIC, LACNIC, AFRINIC — which maintain publicly accessible RPKI publication points.
- An operator that enables Route Origin Validation (ROV) on their routers downloads these ROAs via a validator (Routinator, rpki-client, Fort, OctoRPKI) and compares them against incoming BGP announcements.
- Result: an announcement not covered by a valid ROA is classified as INVALID and dropped — before entering the routing table.
Propagation time for a new ROA across all global validators is under 90 seconds. A typical BGP hijack gets blocked before your users notice.
What RPKI doesn’t do: it doesn’t protect against a malicious AS that creates a legitimate ROA for a prefix it actually owns and redirects traffic downstream (on-path attack). That requires BGPsec or ASPA (Autonomous System Provider Authorization) — two standards still at the experimental deployment stage in 2026. RPKI/ROV is layer 1 of BGP security, not the complete solution. But it stops 100% of accidental leaks and the vast majority of opportunistic hijacks.
48% Unprotected Prefixes: Who’s Lagging?
The NIST RPKI Monitor public data (August 2026) provides a precise snapshot:
| Metric | Value |
|---|---|
| IPv4 prefixes with valid ROA | 52% |
| IPv6 prefixes with valid ROA | 44% |
| ASes deploying ROV (estimated) | 38% |
| ROV filtering among Tier 1 providers | ~90% |
| ROV filtering among small ISPs | <20% |
The problem is concentrated in the long tail of small ISPs and enterprises that operate their own AS without a dedicated network engineering team. For a regional ISP serving 5,000 customers, setting up an RPKI validator takes under two hours with NLnet Labs’ Routinator 3000 — the installation is three commands:
apt install routinator
routinator-init --accept-licenses
systemctl enable --now routinatorThe barrier isn’t technical. It’s organizational: nobody put “deploy RPKI” on a Jira ticket.
MANRS: Turning Good Intentions Into Measurable Compliance
Since 2014, the MANRS initiative (Mutually Agreed Norms for Routing Security), backed by the Internet Society, defines four minimum actions for a responsible network operator:
- Filtering: do not propagate incorrect BGP announcements.
- Anti-spoofing: prevent traffic with forged source addresses.
- Coordination: maintain reachable contacts (NOC, up-to-date PeeringDB entry).
- Global validation: publish ROAs and enable ROV.
As of August 2026, over 1,000 ASes have joined MANRS, including all European and North American Tier 1 providers. MANRS-compliant operators represent roughly 70% of global Internet routes. But MANRS has no enforcement power — it’s a voluntary commitment.
The U.S. Federal Communications Commission (FCC) opened a consultation in June 2026 on mandatory RPKI deployment for ISPs receiving federal subsidies. The European Union is considering a similar measure under the NIS3 directive, expected to be adopted by late 2026. The regulatory clock is ticking — and the laggards won’t have the “it’s too complex” excuse much longer.
Verdict: You Can Protect Your AS in One Morning
The math is straightforward:
- If you operate an AS: publish your ROAs with your RIR (30 minutes), deploy an RPKI validator on a server or compatible router (2 hours), enable ROV on your BGP sessions (15 minutes). Hardware cost: one container with 256 MB of RAM — any VPS or Raspberry Pi will do.
- If you don’t control your routing (cloud hosting, IP transit): demand that your provider publishes ROAs and enables ROV. The three hyperscalers — AWS, GCP, Azure — have published ROAs for their prefixes since 2022-2023; verify that your transit provider does the same.
- If you manage an enterprise network connected to the Internet: the threat is not theoretical. BGP hijacking is a MITM attack with no malware — no antivirus detects it, no IDS flags it. Only ROV blocks it. A single BGP hijack can expose TLS-encrypted traffic to an attacker who simply has a router in the wrong place.
As of August 2026, not deploying RPKI is no longer a question of technical complexity. It’s a question of whether you care enough to spend a morning on it.
References
- NIST RPKI Monitor, ROA coverage statistics, accessed August 3, 2026 — https://rpki-monitor.antd.nist.gov/
- MANRS Initiative, “MANRS Network Operators Actions,” Internet Society, 2024 — https://www.manrs.org/netops/
- RFC 8210, “The Resource Public Key Infrastructure (RPKI) to Router Protocol, Version 1,” IETF, September 2017
- “BGP Hijacking: A 2026 Retrospective,” Kentik Blog, July 2026
- FCC, “Notice of Inquiry on Border Gateway Protocol Security,” GN Docket No. 26-142, June 2026