← The canon · AItopiaOrAImageddon?

The TCP/IP cutover — federation without a centre

idea · Vinton G. Cerf and Robert E. Kahn, who designed the protocol; Jon Postel, who wrote the transition plan and held the numbers; DARPA and the Defense Communications Agency, who mandated the change and enforced the date; and the several hundred host administrators who did the work · 1983

A framing later work is built out of rather than argued about. Cited when the thing being watched descends from it and the descent explains its shape.

Descends from The ARPANET's first nodes. Read on: PageRank and the crawl — ranking the web by its own link graph, Filtering at national scale — the largest content-classification systems ever deployed, and what they cost to run, APT1 — Exposing One of China's Cyber Espionage Units, The Snowden disclosures — the scale of automated collection becomes a public fact.

proposals.md filed this under idea and the filing is right, but the id looks like a moment and the reason it isn't is worth settling first. The entry is named for a date — 1 January 1983, the day NCP stopped being carried on the ARPANET — and the canon has a kind for dates. It fails that kind on a clause the canon has already used to send a bigger entry elsewhere. eliza-1966 talked its way out of moment and in doing so fixed the house definition as a date on which something visibly happened in public; llama-weights-2023 reused that wording; and unix-linux-1969-1991 failed specifically on "in public" — Torvalds' announcement was read by a few hundred people on a Usenet group about another operating system, so it went to idea instead. The cutover fails on the identical clause and by a smaller margin. It was announced to a few hundred host administrators on site bulletin boards and in a DoD newsletter; there was no press, no public, and no one outside the contract community had any way of noticing. Applying the clause consistently costs this entry the kind it looks like it deserves, and the consistency is worth more than the kind.

The stronger argument is the positive one. build.py defines idea as "a framing later work is built out of rather than argued about," and the house test set by shannon-chess-1950 and reused by dijkstra-1959 and minimax-alpha-beta is that there is a mechanism in it you could implement. TCP/IP is a specification. The mechanism is not a metaphor here; it is a header format, a gateway, and a rule about where state is allowed to live. Almost nothing in the canon passes that test as literally.

And the date is closer to an accident than the id suggests. 1 January 1983 was chosen fourteen months in advance by Jon Postel in RFC 801 and could have been any date; what a reading actually needs from this entry is not the day but the architecture — what happens to a system when the unit that joins it is a network that admits its own members. That is a framing, it is implementable, and it is idea.

descends_from is [arpanet-1969], one edge, and the edges I want and cannot have are worth naming. ARPANET is the network the cutover happened on, and the parent entry already anticipated this file: it says the internet's defining property "arrives with the TCP/IP cutover of 1 January 1983," names the id as a gap, and hands over the distinction deliberately. 1969 gets resource sharing and heterogeneous hosts; this entry gets uncontainability, and section 3 grades that word down hard.

The ancestor I most want is Cerf and Kahn's 1974 paper, which is the actual design and is quoted at length below. It has no id, it is not in proposals.md, and inventing one is forbidden, so it is named in prose. The same goes for Kahn's 1972–73 internetting programme and for Saltzer, Reed and Clark's end-to-end paper of 1981.

unix-linux-1969-1991 is on disk and is deliberately not an ancestor here. That entry calls this one a sibling — "ARPA money and Bell Labs money were different money, and the network and the operating system met later" — and it is correct. But the meeting has a date, and the date is August 1983, eight months after the cutover, when 4.2BSD shipped with TCP/IP in it. That is this entry's aftermath rather than its ancestry, and section 2 argues it is the single most important fact in the file. The edge runs sideways and then forward, not backward, so it stays in prose.

The descent that matters most runs forward and I cannot record it either. llama-weights-2023 is the same argument about weights, proposals.md says so explicitly, and section 2 sets the two against each other — but that is another entry's file and this job does not write in it.

---

1. What it is

The problem: one network is not a network of networks

By the early 1970s ARPA was paying for more than one network. The ARPANET ran on leased telephone lines; the packet radio network (PRNET) ran over the air in Hawaii; SATNET ran over satellite. They had different packet sizes, different error behaviour, different ownership, and no way to talk to each other. The ARPANET's host-to-host protocol, NCP, could not help, because NCP assumed the network it was running on. It had no concept of a destination that was not an ARPANET host, and its addressing said so: the host field was eight bits — six for the IMP and two for the host on it, a ceiling of 256 hosts, later widened by the "long leader" change but never made general. A protocol whose address space is a property of one network's hardware cannot address a second network at all.

Robert Kahn, by then at ARPA's Information Processing Techniques Office, framed the problem as open-architecture networking and set out ground rules for it. The canonical statement is in A Brief History of the Internet, written by nine of the participants including Kahn himself:

> Each distinct network would have to stand on its own and no internal changes > could be required to any such network to connect it to the Internet.

> Communications would be on a best effort basis. If a packet didn't make it to > the final destination, it would shortly be retransmitted from the source.

> There would be no global control at the operations level.

That last rule is the entry. Everything below is machinery for it.

The design: Cerf and Kahn, 1974

The paper is "A Protocol for Packet Network Intercommunication," IEEE Transactions on Communications, Vol. COM-22, No. 5, May 1974, manuscript received 5 November 1973, written under ARPA Contract DAHC 15-73-C-0370 — Cerf then at Stanford, Kahn at IPTO. Its abstract announces a protocol "that supports the sharing of resources that exist in different packet switching networks."

The decisive commitment is a refusal to touch anything:

> the interconnection must preserve intact the internal operation of each > individual network. This is easily achieved if two networks interconnect as if > each were a HOST to the other network, but without utilising or indeed > incorporating any elaborate HOST protocol transformations.

From which the one new object in the design follows:

> It is thus apparent that the interface between networks must play a central > role in the development of any network interconnection strategy. We give a > special name to this interface that performs these functions and call it a > GATEWAY.

The gateway is the whole political content of the architecture expressed as a box. It translates between networks and asks them for nothing. A network joining does not adopt anyone's internal routing, addressing, hardware or management; it keeps all of them and puts a gateway at its edge. Cerf and Kahn state the alternative they are avoiding, and it is the reason a common protocol has to exist at all:

> The unacceptable alternative is for every HOST or process to implement every > protocol (a potentially unbounded number) that may be needed to communicate > with other networks.

The phrase that most directly anticipates 1983 is buried in the discussion of fragmentation, where they note that handling packet-size variation at the gateway "permits packet size variations to be handled on an individual network basis without global administration." The design's aversion to a centre is not rhetoric added later; it is in the 1974 text, in the engineering.

They also saw the ownership problem, and got its consequence wrong in a way section 3 grades:

> To allow networks under different ownership to interconnect, some accounting > will undoubtedly be needed for traffic that passes across the interface.

In 1978 Cerf, Danny Cohen and Jon Postel split the single protocol in two — TCP for reliable ordered delivery, IP for getting a datagram across — because some traffic, notably packet speech, wanted the delivery without the reliability. That split is what makes the layering load-bearing: IP is the thin thing everyone must agree on, and everything else is optional. The word "internet" first appears as shorthand in RFC 675 (Cerf, Dalal and Sunshine, December 1974). The standards the cutover actually ran on are RFC 791 (IP) and RFC 793 (TCP), September 1981.

The priorities, in the designer's own order

David Clark's retrospective — "The Design Philosophy of the DARPA Internet Protocols," SIGCOMM 1988, p. 106 — is the best statement of what the architecture was optimising for, and it is unusually candid. The top-level goal:

> The top level goal for the DARPA Internet Architecture was to develop an > effective technique for multiplexed utilization of existing interconnected > networks.

And the reason that is a claim about institutions rather than cables:

> networks represent administrative boundaries of control, and it was an > ambition of this project to come to grips with the problem of integrating a > number of separately administrated entities into a common utility.

Clark then lists seven second-level goals in priority order:

> 1. Internet communication must continue despite loss of networks or gateways. > 2. The Internet must support multiple types of communications service. > 3. The Internet architecture must accommodate a variety of networks. > 4. The Internet architecture must permit distributed management of its resources. > 5. The Internet architecture must be cost effective. > 6. The Internet architecture must permit host attachment with a low level of effort. > 7. The resources used in the internet architecture must be accountable.

He insists the order is the point:

> It is important to understand that these goals are in order of importance, and > an entirely different network architecture would result if the order were > changed. For example, since this network was designed to operate in a military > context, which implied the possibility of a hostile environment, survivability > was put as a first goal, and accountability as a last goal. […] An > architecture primarily for commercial deployment would clearly place these > goals at the opposite end of the list.

> The reader should consider carefully the above list of goals, and recognize > that this is not a "motherhood" list, but a set of priorities which strongly > colored the design decisions within the Internet architecture.

Note what this does and does not support. Distributed management is goal 4, not goal 1, and "permit host attachment with a low level of effort" — goal 6 — says low effort, not no permission. The architecture was not built to be ungovernable. It was built to survive, and ungovernability is a side effect of the survivability mechanism, which Clark calls fate-sharing: connection state lives in the endpoints, and the gateways in between are stateless. A network whose middle knows nothing about the conversations crossing it is a network whose middle cannot easily be made to decide about them. That is the entire technical basis for everything the phrase "permissionless" is later made to carry, and it was adopted for reliability under bombardment.

The cutover

RFC 801, "NCP/TCP Transition Plan," Jon Postel, November 1981 is the order. Its schedule is five lines:

`` Last NCP Conversion Begins Jan 82 Mail Relay Service Jan 82 Normal Internet Service Jul 82 Last NCP Conversion Completed Nov 82 Full Internet Service Jan 83 ``

"Full Internet Service" is defined as: "All hosts are TCP-capable and use TCP-based services. NCP is removed from service, relay services end, all services are TCP-based." The stated goal is "to make a complete switch over from the NCP to IP/TCP by 1 January 1983," and the pressure in the document is real — "It is urgent that the implementation of of IP/TCP be begun on all other ARPANET hosts as soon as possible and no later than 1 January 1982 in any case" (the doubled "of" is in the original). Postel also puts the labour where it fell: "It is the task of each host organization to implement IP/TCP for its own hosts."

RFC 801 was a plan. What made it an obligation was a DoD memorandum of March 1982 declaring TCP/IP mandatory as the department's standard host-to-host protocol, on a network whose users were, without exception, defence contractors and grantees.

It did not go smoothly, and the contemporaneous record is unambiguous about that. Because sites were not converting, the ARPANET's managers turned NCP off to make the point. A CMU bulletin-board notice from Rudy Nedved, 25 September 1982: "On Saturday October 1st, the entire ARPANET will not forward NCP traffic and will only forward TCP traffic." A second, from the same author on 12 December 1982: "On Monday, 13-Dec-82, the ArpaNet Management will conduct a 48-hour TCP-only (new protocol) experiment. For the entire two days, NCP packets (old protocol) will be rejected by the IMPs." The TCP/IP Digest, moderated by Mike Muuss at the Army's Ballistics Research Laboratory, recorded what the tests measured: on 15 November 1982, 62% of the previous Monday's packet volume got through; on 13–14 December, 89% against the same two weekdays a week earlier.

Eight days before the deadline, CMU's Howard Wactlar wrote the most valuable sentence in the whole record:

> We expect a significant degradation in ARPAnet communication lasting for > several months as the new protocols go into use in a production enviroment > network-wide.

and, in the same message:

> As of today, we have reasonably stable communication with only a handful of > sites (BBN, ISI, PURDUE, RUTGERS, NPRDC).

Five sites. Ken Wertz posted the last reminder at 23:11 on 31 December 1982: "the ArpaNet will begin using IP/TCP exclusively effective 1-Jan-83 00:01." Muuss reported afterwards that BRL's hosts "started passing TCP traffic about 6-Jan" but that mail problems ran on for months. Stragglers were down for as long as three months. Vint Cerf's summary, thirty years later, is that the prevailing emotion was relief, and that "the only visible mementos were the 'I survived the TCP/IP switchover' pins proudly worn by those who went through the ordeal."

Two more things happened in 1983 that belong in the same paragraph and are usually separated from it. In August 1983, 4.2BSD shipped — DARPA had paid BBN to implement TCP/IP for Unix and the code went to Bill Joy at Berkeley, who rewrote it, so that from that release onward the protocol arrived free inside the operating system the research world already ran. And on 4 October 1983 the ARPANET was deliberately partitioned: of its 113 IMPs, 65 went to a new MILNET for military traffic and 68 stayed, with access control in the IMPs enforcing the separation and a small number of "mail bridges" between them. The year of "no global control at the operations level" is the year its operators cut the network in half on purpose. Both facts are load-bearing and both are graded in section 3.

---

2. Why a reading would cite it

This entry earns its place three ways, and the second is the one most worth having.

First: when containment of a capability is proposed. This is the case proposals.md asks for, and the entry supports it only in a specific, weakened form — which is precisely what makes it worth citing rather than gesturing at. The honest claim it supports is: a specification that anyone may implement, whose reference implementation is free and bundled with the tools people already use, becomes impractical to recall, because there is no party holding a thing to be taken back. That is a strong claim and 1983 is good evidence for it. The claim it does not support is that the resulting system cannot be controlled. Section 3 grades that against 313 documented shutdowns in 52 countries in 2025. A reading that cites this entry for "you cannot put it back in the box" is citing something half-true, and the entry's value is that it says which half.

Second, and most useful: when an open standard is weighed against a platform. The lesson everyone draws from 1983 is "open won." The record says something narrower and much more checkable. TCP/IP did not defeat a proprietary alternative. Its serious rival, OSI, was itself an open, international, committee-made standard — begun under ISO in 1977, taught in every computer science curriculum, and, as Andrew Russell puts it, "endorsed by governments around the world," with competing networks "expected to fade away once OSI protocols were standardized." Openness was not the differentiator, because both sides had it.

What TCP/IP had that OSI did not was a funded free implementation and an anchor customer. DARPA paid BBN to write the code, paid Berkeley to put it in the operating system, and — as the Defense Department — mandated it for its own procurement in March 1982, then enforced the mandate on a captive population of its own contractors. Cerf and Kahn's protocol won on the back of an industrial policy that is rarely described as one.

That converts a slogan into a test a reading can actually apply to the concentration lens. When someone argues an open release will win on openness, the question 1983 licenses is: is there a free reference implementation, is it bundled into what practitioners already run, and is there an anchor buyer? llama-weights-2023 is the same argument about weights and answers "yes, partly, and Meta" — but that entry is about an involuntary release and this one is about a funded, mandated, deliberately subsidised one, and the difference is the whole mechanism. Open weights with no free tooling and no institutional buyer is the OSI position, not the TCP/IP position.

Third: when a mandate is in the news. The same instrument produced opposite results eight years apart, which makes 1983 an unusually clean natural experiment for the policy lens, whose standing instruction is to record what governments did. The March 1982 DoD mandate worked: it ratified something that already had running code, a funded implementation path and a deadline someone was willing to enforce. The later mandate failed. GOSIP, issued as FIPS 146, became a federal procurement requirement in August 1990 — Cerf himself co-wrote the RFC explaining it — and by 1994 NIST was proposing that GOSIP incorporate TCP/IP and drop the OSI-only requirement, which entered the standard the following year. A mandate that ratifies running code succeeds; a mandate that specifies code nobody has written fails. That is directly applicable to any reading in which a government proposes a standard for model evaluation, watermarking or disclosure, and it is a finding about mechanism rather than about politics.

I can write all three of these paragraphs honestly, so the entry passes the admission test.

---

3. What it got right, and what it got wrong

Grading is not required for idea, but the claim this entry carries is an empirical prediction about how systems spread, and it has had forty-three years to be tested. Claims are dated by when they were made and graded against what happened.

Right: the architecture scaled past everyone's imagination

Claim (1974, Cerf and Kahn): networks of different ownership, size and internal design can be joined by gateways with no internal modification to any of them, and that arrangement will work.

Graded: emphatically right, and the numbers are not close. Mark Lottor's host counts for SRI, published as RFC 1296 in January 1992, are the authoritative series: 213 hosts in August 1981; 235 in May 1982; 562 in August 1983; 1,024 by October 1984; 2,308 by February 1986; 80,000 by January 1989; 617,000 by October 1991. The architecture absorbed local area networks that did not exist when it was designed, then commercial networks its designers were forbidden to serve, then the mobile networks of the 2000s, without a redesign of the layer everyone had to share. A protocol whose predecessor had a 256-host ceiling reached six figures inside six years of the cutover.

The subtler right answer is fate-sharing. Putting connection state in the endpoints and leaving the middle stateless is what let the middle be replaced piecemeal — a claim that is only visible in hindsight, because the design's own justification for it, in Clark 1988, was surviving battle damage.

Right, and the least-credited part: the transition method

Claim (RFC 801, November 1981): a heterogeneous population of several hundred independently administered machines can be moved to an incompatible protocol on a fixed date.

Graded: right, but "flag day" flatters it. The date held and the network did not fall over. But the mechanism was not a switch, it was fourteen months of deadline, two rehearsals in which the operators deliberately broke the network to force compliance, packet volumes at 62% and then 89% of normal during those rehearsals, five sites in reasonably stable communication eight days before the deadline, an insider expecting "significant degradation lasting for several months," mail broken well into the new year, and stragglers dark for three months. The transition took roughly six months and worked because a single funder could compel a captive population. Nothing about it generalises to a setting without those conditions, which is exactly why it is worth citing against arguments that some future protocol change will be similarly clean.

Wrong: the accounting that never came

Claim (1974, Cerf and Kahn): "To allow networks under different ownership to interconnect, some accounting will undoubtedly be needed for traffic that passes across the interface." Due: whenever networks of different ownership actually interconnected — from the mid-1980s.

Graded: wrong, and instructively so. Inter-network traffic accounting never arrived. Settlement-free peering did — networks exchange traffic and bill nobody. Clark's 1988 list is the confession: accountability is goal seven of seven, it "received very little attention during the early stages of the design," and an architecture built for commerce "would clearly place these goals at the opposite end of the list." The most consequential property of the internet — that moving a packet across an ownership boundary costs the sender nothing traceable — is not a designed feature. It is the residue of a military priority ordering, and the people who wrote it down said so.

Wrong, as usually stated: "uncontainable"

Claim (the entry's own proposal, and the general reading of 1983): federation without permission made everything after it uncontainable.

Graded: false as stated, and this is the grading the entry most exists to deliver.

The strongest evidence is contemporaneous. On 4 October 1983 — nine months after the cutover, in the same network, by the same operators — the ARPANET was partitioned. Sixty-five of 113 IMPs became MILNET, access control in the IMPs enforced the split, and traffic between the halves was restricted to a handful of mail bridges. The people who had just finished building "no global control at the operations level" demonstrated within the year that a federated network can be cut in two by whoever owns the boxes.

The modern evidence is worse. Access Now's #KeepItOn coalition documented 313 internet shutdowns across 52 countries in 2025, against 304 in 2024 and 289 in 2023 — a record, and not one day of the year without one. Myanmar alone accounted for at least 95; India, the most of any democracy, 65; conflict was the largest single trigger at 125 shutdowns across 14 countries. Set beside a persistent national filtering regime covering a fifth of humanity, the claim that the 1983 architecture made control impossible is refuted at scale, annually, on the public record.

What was actually abolished was not permission but its centre. This is the correction that makes the entry useful rather than decorative. In 1983 you still needed permission for almost everything: ARPANET membership was restricted to government agencies and their contractors, new connections were approved by the Defense Communications Agency, and a network number came from Jon Postel personally, by letter, at 4676 Admiralty Way, Marina del Rey — a function that became IANA and then ICANN and the regional registries, and which has never stopped existing. CSNET is the proof of exactly where the line fell: it was founded in 1981 by the NSF because computer science departments without defence contracts could not get permission to join the ARPANET, so they built their own network and gatewayed it — and ARPA then delegated to CSNET the authority to admit new sites. Permission was not abolished. It was decentralised, and then delegated again, recursively.

So the defensible form of the claim, and the one a reading should use, is: after 1983 there was no longer any single party who could refuse you entry to the system as a whole, because there was no longer a whole to be admitted to — only networks, each admitting its own members, joined by gateways that ask nothing. That is a real and consequential property. It is not the same as uncontainability, and states have spent forty years demonstrating the difference.

---

4. Commonly misused as

Not required for idea, but four misuses of this entry are common enough, and close enough to things a reading might want to say about AI, to be worth refusing.

1. "Open beat closed, so open will win again." The most load-bearing error, because it is the one a reading reaching for the concentration lens will reach for first. OSI was not closed. It was an ISO standard, internationally negotiated, government-endorsed, and by some measures more open in governance than the DARPA process that beat it. What decided it was running code, free implementations and an anchor buyer — the things David Clark compressed in 1992 into "We reject: kings, presidents, and voting. We believe in: rough consensus and running code." An argument that an open AI ecosystem must prevail because it is open is making precisely the prediction OSI's backers made, and it is the losing side of the analogy, not the winning one.

2. "Nobody is in charge of the internet." Refuted by the entry's own machinery. Someone has always been in charge of the names and numbers — Postel by hand, then IANA, then ICANN and the RIRs — and someone has always been in charge of each constituent network. What 1983 removed was a single admissions desk, not authority. Readings about AI governance that invoke the internet as proof that distributed systems resist governance are invoking a system with a functioning, centralised, forty-year-old numbering authority.

3. "It was designed to survive a nuclear war." The standing folk claim. This entry's contribution is narrower than the usual debunk and more interesting: Clark 1988 says plainly that survivability was goal 1 because the network was designed for a military context implying a hostile environment. So the survivable architecture is real and militarily motivated — while the specific nuclear-command story attaches to Paul Baran's separate RAND work, and arpanet-1969 already handles the priority dispute and the RAND question and should be cited for it rather than this file.

4. "1983 is the internet's birthday." Contested and better avoided. The design is 1973–74, the term is 1974, the standards are 1981, the cutover is 1983, DNS is 1984, the commercial internet is the 1990s. The entry does not need a birthday to work, and a reading that argues about the date is spending its credibility on the least useful thing in the file.

---

5. Sources

Read directly, at source. Two primaries are image-encoded PDFs and were read page by page as rendered images; every quotation attributed to them is from the document itself, not from a secondary quoting it. Fetch failures are recorded at the end rather than papered over.

Secondary, and flagged as such because I could not reach a primary.

Fetch failures, recorded rather than hidden.