Internet Security Research Group

Internet Security Research Group
Name	Internet Security Research Group
Formation	2013
Type	Nonprofit organization
Headquarters	United States
Location	Portland, Oregon
Region served	Global
Leader title	Executive Director
Leader name	Josh Aas

Internet Security Research Group is a nonprofit organization that develops and operates public-interest security infrastructure for the Internet. Founded in 2013, it is widely known for automating certificate issuance and advancing web encryption standards through practical tools and advocacy. The group works at the intersection of operational engineering, standards like Transport Layer Security, and public-interest interoperability with organizations such as Mozilla, Cisco Systems, and Google.

History

The organization was founded in 2013 amid initiatives following debates around surveillance revealed by figures such as Edward Snowden and proposals from Tim Berners-Lee and groups like the Electronic Frontier Foundation to increase baseline encryption. Early collaborations included technical work with Mozilla Foundation and contributions to discussions at the Internet Engineering Task Force and the World Wide Web Consortium. The group's launch paralleled efforts by entities including EFF, EFF's Let's Encrypt initiative, and infrastructure projects like OpenSSL and Free Software Foundation campaigns to harden transport-layer security. Key milestones include initial certificate automation development in 2014, scaling milestones aligning with platforms such as Amazon Web Services, Cloudflare, and integration with certificate management tools from Red Hat and Microsoft.

Mission and Activities

The group's mission centers on making secure communication ubiquitous by lowering the barriers for deploying Transport Layer Security certificates for operators of services including web hosts, content delivery networks, and platforms. Activities span operating public services, contributing code to projects like Boulder and Certbot, participating in standards development at IETF and W3C, and publishing operational guidance used by providers such as GitHub, DigitalOcean, and Heroku. The organization engages with privacy advocates including Electronic Frontier Foundation, policy institutions like Center for Democracy & Technology, and academic groups at MIT, Stanford University, and University of California, Berkeley for empirical studies. It also responds to incidents involving certificate transparency logs coordinated with operators such as Google Transparency Report teams and logging services used by Facebook and Twitter.

Projects and Initiatives

Primary projects include automated certificate issuance systems, integration with ACME protocol implementations, and development of client tooling. The group’s systems interoperated with server and orchestration software from Apache HTTP Server, Nginx, Lighttpd, Kubernetes, and Docker. Initiatives extended to support for embedded platforms from manufacturers such as Raspberry Pi, and content delivery networks like Akamai and Fastly. The organization contributed to transparency initiatives referenced by Google, Apple, and browser vendors like Mozilla and Microsoft Edge to improve certificate auditing. Other efforts included outreach programs with hosting providers such as GoDaddy, Namecheap, and OVH and participation in security education with groups like ISOC and conferences including Black Hat, DEF CON, and RSA Conference.

Governance and Funding

The group operates as a nonprofit with a board and executive leadership, incorporating corporate and foundation support from donors including technology firms like Mozilla Corporation, Cisco Systems, Akamai Technologies, Google LLC, and foundations such as Internet Society allied funds. Governance interactions involved advisory input from security researchers at Google Project Zero, academics from Harvard University and University of Oxford, and legal counsel familiar with laws such as the General Data Protection Regulation affecting operations. Funding models combined sponsorships, grants, and in-kind contributions from infrastructure providers like Amazon Web Services and enterprise vendors including Red Hat and Microsoft Corporation.

Partnerships and Collaborations

Collaborations spanned corporate, academic, and nonprofit partners including Mozilla, Electronic Frontier Foundation, Cloudflare, Cisco Systems, and Let's Encrypt ecosystem participants. The group engaged with standards bodies such as IETF and W3C and worked with certificate authorities and vendors including DigiCert, Entrust, Sectigo, and GlobalSign to encourage adoption of automated issuance. It partnered with cloud platform teams at Google Cloud Platform, Microsoft Azure, and Amazon Web Services to streamline integrations, and collaborated with content platforms including WordPress.org, Drupal Association, and Cloudflare Workers. The organization also liaised with national research networks like Internet2 and regional registries such as ARIN and RIPE NCC for operational coordination.

Impact and Reception

The group’s efforts significantly increased HTTPS adoption across the web, influencing metrics tracked by Mozilla Telemetry, Google Safe Browsing, and industry reports from Netcraft. Praise came from privacy advocates including Electronic Frontier Foundation and standards proponents at IETF; critics in some commercial certificate markets, including incumbent certificate vendors, noted market disruption. Technical analyses from research groups at Stanford University, UC Berkeley and independent teams like Censys and ZMap documented deployment effects. The organization received recognition in operational security communities at conferences such as USENIX Security Symposium and through awards presented by institutions including Internet Society.

Category:Internet security organizations