Tim April

Summary

A technologist, Internet architect, and incident responder with more than 15 years of experience improving the stability, resilience, and security of the Internet. Currently leading DoS Security SRE work at Google, with deep expertise in DDoS defense, large-scale incident response, and DNS and routing security, and a long record of building cross-industry collaboration against Internet abuse.

Key Accomplishments

Sought out as a subject matter expert on denial of service attacks and defense by internal teams, customers, and industry peers
Built and sustained cross-industry collaboration initiatives that track and reduce abuse of the Internet, including DDoS, malware, and phishing
Trusted expert incident responder including crisis management, complex technical coordination, and communications with executives, customers, and the public
Frequently called into incidents for the ability to rapidly understand and diagnose issues in large-scale distributed systems
Led a DoS Security SRE team, growing its on-call response to a sustainable level
Advised senior management and customers on current and potential threats at all layers of the OSI model
Consulted with product, design, and engineering teams to build safer systems
Co-founded a non-profit aiming to make DNS infrastructure changes more visible
Developed, operated, and maintained an ICANN accredited domain name registrar

Experience

Google

Staff Site Reliability Engineer & Tech Lead Manager, DoS Security SRE (DoSSec)

Staff Site Reliability Engineer, DoS Security SRE (DoSSec)

Remote

Jun 2024 – Present

May 2023 – Jun 2024
- DDoS Response On-Call:
  Owned the DoSSec on-call rotation, covering the DDoS Response Team (DDRT) product and the training of new responders, and grew the rotation to a sustainable level. Participated in the rotation managing first-party and third-party DoS response, and worked with product and technical support to streamline the processes used when responding to customer events.
- Posture Review:
  Co-developed a Posture Review workbook which guides customers to build more resilient and defensible systems.
- Industry Collaboration:
  Collaborated with industry partners to track and respond to DoS attacks and threats impacting the Internet, including coordinating the HTTP/2 Rapid Reset response.
- Tech Lead Manager:
  Responsible for managing the team, covering performance management and growing team members. Began formally managing the risks relevant to the team through a risk management program.
Google

Staff Security Engineer, Enterprise Infrastructure Protection, Federated Security

Remote

Apr 2022 – May 2023
- Security Risk Council:
  Primary technical reviewer for the Security Risk Council, collaborating with teams seeking exceptions to policies and reviews in order to enable their programs to continue. Stepped into the role when no consistent process or documentation was in place, establishing the review process and training additional reviewers.
- Federated Security Engineering:
  Founding member of the Federated Security Engineering (FedSec Eng) team. Developed an engagement model partnering FedSec engineers with product teams to manage security risks, develop mitigation plans, and track new developments.
Akamai Technologies, Inc.

Chief Architect, Information Security

Cambridge, MA

Aug 2011 – Apr 2022
- Progression:
  Security Researcher → Senior Security Researcher → Architect → Senior Architect → Principal Architect → Chief Architect
- Domain Name Registrar:
  Designed, developed, and deployed the processes and software to operate Akamai's ICANN accredited domain name registrar. Provided ongoing policy, process, and technical support for the operators of the registrar in addition to process and software updates.
- Security Architecture and Consulting:
  Worked with system architects, developers, and operators to review system designs focusing on security and operability. Common areas of advice included Routing, Switching, DNS, PKI, DDoS Attacks, Botnets, and Malware.
- Security Research:
  Investigated vulnerabilities in internal and external software and systems. Collaborated with researchers inside and outside Akamai on new and existing incidents. Contributed to internal and external publications discussing attacks and vulnerabilities observed on the Internet.
- Incident Response:
  Participated in the incident on-call rotation, helping to quickly assess and remediate events. Assisted as a subject matter expert for security incidents as well as a generalist for both Akamai and external systems.
- Research and Development:
  Contributed to the design, development, and operation of numerous research projects both in and outside the InfoSec department. Deployed, modified, and maintained multiple internal collaboration tools. Participated in all stages of the product development lifecycle.
- Trust & Safety:
  Responsible for coordinating inbound and outbound vulnerability reporting. Coordinated with public and private partners on DDoS and other security matters, including law enforcement from multiple jurisdictions.
- Special Projects:
  Assisted ad-hoc projects across the company as needed. Designed and prototyped solutions to complex problems.

Community & Standards Work

Internet Fire Brigade Society

Co-Founder & Director

Sep 2021 – Present
- Purpose:
  Internet Fire Brigade Society was founded to be the non-profit home of the DNS Transparency Project, working to make changes to the DNS visible as close to the time of change as possible. The organization is also expected to be home to other similar projects when reasonable.
Security and Stability Advisory Committee (SSAC)

Member, Internet Corporation for Assigned Names and Numbers (ICANN)

Jun 2018 – Present
- Routing Security Work Party - Co-Chair:
  Co-chaired the work party that developed security and stability advice to the ICANN Board and ICANN Community on the impacts of routing security issues on the Internet naming and addressing systems, published in June 2022 as SAC121: SSAC Briefing on Routing Security.
- Advice and Education:
  Working with the SSAC Administrative Committee and other SSAC members to develop and present advice on issues which impact the security and stability of the Internet naming and addressing systems.
Root Zone Evolution Review Committee (RZERC)

Chair, Internet Corporation for Assigned Names and Numbers (ICANN)

Member, Internet Corporation for Assigned Names and Numbers (ICANN)

Apr 2021 – Jul 2023

Aug 2020 – Jul 2023
- Purpose:
  Appointed by the IETF to the RZERC, which reviews proposed architectural changes to the content of the DNS root zone.
DNS Security Facilitation Initiative Technical Study Group

Member, Internet Corporation for Assigned Names and Numbers (ICANN)

Jun 2020 – Nov 2021
- Purpose:
  DNS Security Facilitation Initiative Technical Study Group (DSFI-TSG) was responsible for providing expertise and guidance on the technical work ICANN could consider for DNS security facilitation functions. The TSG's final report was delivered to the ICANN CEO in October 2021.
Northeast Collegiate Cyber Defense Competition (NECCDC) Red Team

Member

Jan 2013 – Mar 2021
- Penetration Testing:
  Worked with other Red Team members to penetrate simulated corporate environments to simulate adversarial behavior in the competition setting.
- Coordination:
  Assisted the Red Team captain in coordinating competition activities with the other operational teams of the event, both before and during the competition.

Publications

Google mitigated the largest DDoS attack to date, peaking above 398 million rps: E Kiner and T April. “Google mitigated the largest DDoS attack to date, peaking above 398 million rps.” Google Cloud Blog. 10 October 2023.
DNS Security Facilitation Initiative Technical Study Group - Final Report: T April, G Brown, J Crain, M Kaeo, R Rasmussen, M Rogers, K Sataki, R Schischka, and D Wessels. “DNS Security Facilitation Initiative Technical Study Group - Final Report.” ICANN Community. 15 October 2021.
(tapril.net Copy)
AnyOpt: predicting and optimizing IP Anycast performance: X Zhang, T Sen, Z Zhang, T April, B Chandrasekaran, D Choffnes, B M Maggs, H Shen, R Sitaraman, and X Yang. “AnyOpt: predicting and optimizing IP Anycast performance.” In Proceedings of the 2021 ACM SIGCOMM Conference. 2021.
(tapril.net Copy)
The DNS in IoT: Opportunities, Risks, and Challenges: C Hesselman, M Kaeo, L Chapin, k claffy, M Seiden, D McPherson, D Piscitello, A McConachie, T April, J Latour, and R Rasmussen. “The DNS in IoT: Opportunities, Risks, and Challenges.” In IEEE Internet Computing. 2020.
(tapril.net Copy)
Understanding the Mirai Botnet: M Antonakakis, T April, M Bailey, M Bernhard, E Bursztein, J Cochran, Z Durumeric et al. “Understanding the Mirai Botnet.” In USENIX Security Symposium. 2017.
(tapril.net Copy)
The WireX Botnet: An Example of Cross-Organizational Cooperation: T April, C Baker, M Carothers, J Cochran, J Paine, J Mauch, A Nixon et al. “The WireX Botnet: An Example of Cross-Organizational Cooperation.” Cloudflare Blog. 28 August 2017.
(Akamai Blog - archive.org), (tapril.net Copy)

Education

University of New Hampshire

Master of Science in Electrical Engineering

Durham, NH

Aug 2009 – May 2013
- Coursework:
  Completed in 2011; research and thesis continued while working at Akamai.
- Master's Thesis:
  Comparing and Contrasting Manual Direct Touch Interaction with Tangible User Interfaces for Mapping Applications
University of New Hampshire

Bachelor of Science in Computer Engineering

Durham, NH

Sep 2005 – May 2009

Relevant Skills

Programming: Go, Python, JavaScript, HTML, SQL (MySQL, PostgreSQL)
Operating Systems: Unix/Linux, macOS
Protocols: DNS, HTTP, BGP, TLS, EPP, Protocol Design
Incident Response and Management: Crisis Management, Executive Communications, Public and Customer Notifications, Training Incident Managers