Time SIG
The Time Security SIG exists to help the global FIRST community prepare for the 2036–2038 epoch rollovers. By coordinating research, testing, and outreach on time integrity, the SIG connects CSIRTs, vendors, and standards bodies to strengthen resilience across critical infrastructure. Our goal: ensure the world’s clocks keep running — securely — long past 2038.
Mission
The Time Security SIG will raise awareness of the 2036–2038 epoch rollovers (the ‘Epochalypse’) and promote resilience in time synchronization across critical systems.
Its mission is to:
- Identify where critical systems rely on fragile timekeeping
- Communicate the risks posed by upcoming epoch rollovers
- Equip FIRST teams with practical guidance for time integrity: authenticated sources, resilient architectures, and verifiable controls
The Time Security SIG will coordinate with the Epochalypse Project (https://epochalypse-project.org) to ensure public outreach and technical guidance remain aligned and grounded in operational reality.
Unlike Y2K—which had global mobilization and years of preparation—the 2036–2038 rollovers lack coordinated response, yet affect systems from IT to IoT, from infrastructure to defense, at planetary scale.
Time integrity is foundational to security. This SIG exists because that foundation is about to be tested.
Goals & Deliverables
Goals
The Time Security SIG aims to:
- Enable FIRST teams to assess 2036–2038 rollover risks in their infrastructure
- Create a knowledge base for sharing sector-specific vulnerabilities and mitigation strategies
- Establish coordination channels among CSIRTs, vendors, and standards bodies
- Reduce time-to-remediation through shared intelligence and validated mitigation patterns
Scope
The SIG will focus on three critical epoch rollovers:
- NTP Era 1 Rollover (07 February 2036)
- Unix time_t Rollover (19 January 2038)
- GPS Week Number Rollover (20 November 2038)
Priority Sectors: Aviation; maritime; energy; healthcare; telecommunications; financial services; defense; and industrial control systems.
Year One Deliverables
Plans are just a fiction we tell ourselves while life comes at us. The SIG aims to deliver, modulo actual volunteer capacity:
Q1-Q2 2026:
- Launch community platform (FIRST portal or dedicated workspace)
- Publish initial threat brief: "2036–2038 Epoch Rollovers for CSIRTs"
- Establish monthly coordination calls (timing to be determined based on member availability)
Q3-Q4 2026:
- Release Time Integrity Assessment Questionnaire (self-assessment tool)
- Publish 2-4 Sector Risk Briefs
- Launch collaborative knowledge base (wiki format, version-controlled)
- Create Outreach Toolkit: slide deck + FAQ + one-pager for internal briefings
Ongoing:
- Monthly call notes and recordings (published within 7 days)
- Quarterly "State of Time Security" summary (tracking progress, new disclosures)
- Coordination with Epochalypse Project, IETF, ITU-T, OASIS, and other standards bodies
Success Metric (Year One)
- 15+ organizations actively participating in monthly calls
- 100+ downloads of assessment questionnaire
- 5+ sector-specific risk briefs contributed by member organizations
- 3+ coordinated vulnerability disclosures handled through SIG channels
Longer-Term Vision (Years 2–3 Focus)
- Develop tabletop exercise scenarios for 2036–2038 rollovers
- Coordinate cross-sector testing (simulated rollover exercises)
- Publish Time Integrity Playbook
- Establish relationships with national CERTs and regulatory bodies
- Establish a coordinated vulnerability bounty program for time integrity bugs (in partnership with security research community)
- Track global remediation progress (vendor patches, standards updates)
The clock is counting down. This SIG provides the coordination infrastructure FIRST teams need to be ready before 2036.
And in 2038? We'll measure our success by how ready the community feels — and by the quality of the party we throw at that year's FIRST Annual Conference!
Meetings
- At the Annual Conference (in person)
- Monthly (virtually)
Chairs
- Trey Darley
- Pedro Umbelino
Membership
Any FIRST member may join, others are welcome as well, requests must be approved by the SIG chairs.
Request to Join