Where US Internet Resilience Evidence Disagrees With Itself

The most dangerous single points of failure in US Internet access are the formally governed ones, yet the failures that have actually happened come from the informal ones. Meanwhile, the institutions meant to defend the network are becoming a risk to it.

Key points

• Verisign's hold on root zone publication is the most concentrated chokepoint in the naming system, but the large outage we have seen came from a DNS fault inside one AWS region.
• AI vulnerability discovery currently helps defenders, yet deployed patches already trail known flaws, and the gap is likely to widen.
• The federal government both oversees critical chokepoints and has shown it will use supply-chain designations against domestic firms.
• Court rulings, the fate of the threat-sharing law and FERC's data center standards will settle more than any new threat report.
• We judge an extended national outage more likely to come from compounding failures across layers than from any single chokepoint.

The tensions

Is the real chokepoint the governed one or the accidental one?

The case for Verisign. One company compiles the root zone, signs it daily, sends it to every root operator, runs two root servers and runs .com, all under ICANN contract and a Commerce cooperative agreement renewed through the early 2030s¹. If that pipeline were compromised or coerced, validating resolvers worldwide would begin failing once cached signatures expired, about a week later¹. A failure at that level has no alternative path.

The case for the accidental chokepoints. Verisign has done this job without a catastrophic failure since 1993¹, and its week-long signature window gives time to respond. The outage that actually happened was a race condition in DynamoDB's DNS automation. It made us-east-1 endpoints unresolvable for about 15 hours and degraded account operations in other regions, because global control planes live in Northern Virginia². That same region sits on one utility footprint, where data center loads over 1,000 MW have dropped off the grid in seconds³. Nobody designed this concentration and no contract governs it.

What would settle it: a public stress test of root zone recovery after a signing compromise, and hyperscaler disclosure of which global control-plane functions still depend on one region. Until then, we put roughly 70% of the risk of a multi-day outage in the unmanaged layer.

Does AI favor the defender or the attacker?

The defender's case. The most capable known vulnerability-finding model is restricted to a coalition of major vendors, which has reported more than 10,000 high or critical flaws across every major OS and browser⁴. The first AI-generated zero-day confirmed in a mass-exploitation plan was caught and patched before the campaign launched⁵.

The attacker's case. Discovery is not remediation. Salt Typhoon's persistence in carrier routers relied partly on known, unpatched CVEs⁶, so the patch backlog was already losing before machine-speed discovery added to it⁴. The legal basis for threat-sharing now survives on short extensions while CISA sheds staff⁷. The international safety consensus finds that sophisticated attackers bypass current safeguards⁸. Once comparable capability spreads, defenders will face a stock of zero-days in router firmware and operational technology (OT) that they cannot patch fast enough⁴.

What would settle it: median time-to-patch for Glasswing-class findings in ISP edge gear, and whether the threat-sharing act gets a multi-year reauthorization before December 11, 2026⁷.

Is the US government a backstop or a single point of failure?

The backstop case. Federal oversight is what binds Verisign to its obligations¹. Federal agencies exposed Salt Typhoon⁶. FERC has ordered mandatory reliability standards for data center loads by year end³, and DOE is modeling blackout risk before it arrives⁹. The system of checks also works: a federal judge ruled the Pentagon's supply-chain designation of Anthropic unlawful retaliation¹⁰.

The risk case. That designation, a tool built for foreign adversaries, was used against a domestic provider over a policy dispute, and a second lawsuit is still pending¹⁰. Aimed at a DNS provider, CDN or cloud operator, it could force contractors to migrate almost overnight. The same firm's model underpins a major defensive program⁴. Section 706 still lets the President shut down communications without congressional approval¹¹. The Commerce lever over .com also gives other states a pretext for alternative roots¹.

What would settle it: the outcome of the second Anthropic suit and any appeal, and whether Congress passes a 48-hour limit on Section 706 shutdowns¹¹. We think a designation against a core Internet provider in the next three years is plausible but unlikely, around 15%.

Why these questions matter

The signal scan found that the weeks-long scenarios are compound ones: grid stress⁹, transformers that take years to replace¹² and backup fuel that lasts about three days¹³ meeting a cyber or political shock. While these questions stay open, we would plan for the unmanaged chokepoints first. That means mapping single-region control-plane dependencies, testing whether carrier hotels and IXPs can hold power beyond 72 hours, and treating a provider's standing with the government as an operational risk worth writing into contracts.