Time SIG

The Time Security SIG exists to help the global FIRST community prepare for the 2036–2038 epoch rollovers. By coordinating research, testing, and outreach on time integrity, the SIG connects CSIRTs, vendors, and standards bodies to strengthen resilience across critical infrastructure. Our goal: ensure the world’s clocks keep running — securely — long past 2038.

Mission

The Time Security SIG will raise awareness of the 2036–2038 epoch rollovers (the ‘Epochalypse’) and promote resilience in time synchronization across critical systems.

Its mission is to:

Identify where critical systems rely on fragile timekeeping
Communicate the risks posed by upcoming epoch rollovers
Equip FIRST teams with practical guidance for time integrity: authenticated sources, resilient architectures, and verifiable controls

The Time Security SIG will coordinate with the Epochalypse Project (https://epochalypse-project.org) to ensure public outreach and technical guidance remain aligned and grounded in operational reality.

Unlike Y2K—which had global mobilization and years of preparation—the 2036–2038 rollovers lack coordinated response, yet affect systems from IT to IoT, from infrastructure to defense, at planetary scale.

Time integrity is foundational to security. This SIG exists because that foundation is about to be tested.

Goals & Deliverables

Goals

The Time Security SIG aims to:

Enable FIRST teams to assess 2036–2038 rollover risks in their infrastructure
Create a knowledge base for sharing sector-specific vulnerabilities and mitigation strategies
Establish coordination channels among CSIRTs, vendors, and standards bodies
Reduce time-to-remediation through shared intelligence and validated mitigation patterns

Scope

The SIG will focus on three critical epoch rollovers:

NTP Era 1 Rollover (07 February 2036)
Unix time_t Rollover (19 January 2038)
GPS Week Number Rollover (20 November 2038)

Priority Sectors: Aviation; maritime; energy; healthcare; telecommunications; financial services; defense; and industrial control systems.

Longer-Term Vision (Years 2–3 Focus)

Develop tabletop exercise scenarios for 2036–2038 rollovers
Coordinate cross-sector testing (simulated rollover exercises)
Publish Time Integrity Playbook
Establish relationships with national CERTs and regulatory bodies
Establish a coordinated vulnerability bounty program for time integrity bugs (in partnership with security research community)
Track global remediation progress (vendor patches, standards updates)

The clock is counting down. This SIG provides the coordination infrastructure FIRST teams need to be ready before 2036.

And in 2038? We'll measure our success by how ready the community feels — and by the quality of the party we throw at that year's FIRST Annual Conference!

Meetings

At the Annual Conference (in person)
Monthly (virtually)

Chairs

Trey Darley
Pedro Umbelino

Membership

Any FIRST member may join, others are welcome as well, requests must be approved by the SIG chairs.

Request to Join