Karim Eldefrawy

Cryptography, Cybersecurity, Privacy Computer Science

Co-founder & CTO of Confidencial.io
2017-2021: SRI (Internet Origin)
2011-2016: HRL (Part of IBM Research)
2006-2010: PhD@UC Irvine

Scientific curiosity

Article 6 of 17 · Draft

DARPA Can Create a Temporary Laboratory. What Happens When the Program Ends?

An empowered program manager can assemble an extraordinary network around a hard objective; the harder design problem is who catches the shared state when the program clock expires.

A temporary network of universities, companies, and institutes converges on a mission, then separates while tools and knowledge seek a durable host.
Conceptual program network; it does not represent a specific DARPA team or contractual relationship.

A deliberately hard target

DPRIVE defined success against the speed of unencrypted computation

The target shows how a program can coordinate disparate work around one measurable constraint. It does not show that the target was achieved or that the resulting capability persisted.

Conceptual performance ratio from the program objective, not a reported final benchmark; workloads and implementations determine actual overhead. Inspect the source record.

Source-linked argument map

A program can solve coordination without solving continuity

DARPA’s structure explains how temporary capability is assembled; the preservation gap arises after the sponsor’s bounded mission is complete.

  1. Documented observation

    Program managers receive unusual authority

    DARPA describes fixed-tenure program managers who formulate programs, select performers, manage milestones, and redirect portfolios.

    DARPA

  2. Documented observation

    Programs assemble cross-organization capability

    RACE, SIEVE, and DPRIVE joined security, formal methods, systems, and hardware around explicit mission goals.

    Defense Advanced Re... Defense Advanced Re... Defense Advanced Re...

  3. Coordination gap

    Completion ends the common clock

    Code, test infrastructure, people, and transition relationships return to organizations with different incentives when the program ends.

    Defense Advanced Re... Defense Advanced Re...

  4. Bounded conclusion

    Name a continuity owner at program formation

    Programs should assign responsibility and resources for artifact custody, team transfer, independent evaluation, and transition before the final milestone.

    SRI International National Academies ...

Finite tenure and milestones are treated as strengths. The claim concerns the missing complementary institution after program completion.

DARPA can make an organization appear where none existed. A program manager defines a hard objective, recruits groups that may never have worked together, creates milestones and shared evaluations, and forces theory, software, hardware, and mission need into the same conversation. For several years, the program has a name, a technical language, a schedule, a budget, and a community. It behaves like a laboratory distributed across institutions.

Then the clock ends.

The people still exist. The papers and code may exist. The contracts certainly existed. But the temporary laboratory’s connective tissue—regular reviews, shared urgency, cross-team debugging, evaluation infrastructure, and the authority to redirect the whole—can disappear in one budget boundary.

My experience as a performer across RACE, SIEVE, and DPRIVE is only one view of this mechanism. It is enough to identify the question, not to issue a verdict on every program. M

Why the temporary laboratory works

DARPA describes its program managers as fixed-term leaders with substantial authority to develop programs, select performers, set milestones, and manage portfolios. Finite tenure matters. It attracts people who will take a bounded period away from another career, gives urgency to their thesis, and reduces the chance that one manager owns a technical domain indefinitely. D

The program structure can solve a coordination problem ordinary grants leave open. A university may develop an algorithm. A company may build hardware. A nonprofit institute may integrate and verify a system. A government test team may define an adversary. A program manager can require those pieces to meet on a schedule and can stop a path that fails.

RACE, SIEVE, and DPRIVE illustrate different versions. RACE sought resilient anonymous communication grounded in rigorous security or realistic simulation. SIEVE sought zero-knowledge proofs expressive and efficient enough for complex statements. DPRIVE sought an integrated hardware-software leap that would bring fully homomorphic encryption to within an order of magnitude of unencrypted computation. Each objective was too cross-layered for a paper-only portfolio.

The temporary laboratory is therefore a genuine institutional invention. Its finite nature is part of its power.

Completion has at least five meanings

A program page may say “complete,” but completion is not one state.

  1. The contractual period ended.
  2. The final milestones were assessed.
  3. A technical capability was demonstrated.
  4. Artifacts became usable outside the original team.
  5. A mission or market institution adopted and maintained the capability.

Those events can occur years apart, or not at all. Confusing them produces both unfair criticism and false celebration. A program can fail at deployment while creating major scientific knowledge. It can meet every milestone while producing an artifact no one can maintain. It can miss an aggressive target yet create the people and tools that make a later success possible.

This series’ five-verdict framework—scientific, technical, transition, institutional, and public value—is not decoration. It is necessary accounting for a temporary laboratory.

A technical case: RACE after the common clock

RACE pursued a distributed messaging system intended to preserve privacy and resist compromise. The public program record emphasizes rigorous security arguments and realistic simulation. It also records that DARPA released proof-of-concept code in August 2024, allowing researchers and users to experiment with the complete system or separate components. That release is a concrete preservation event. D

Public code changes the afterlife of a program. It gives outsiders something more checkable than a final report. But a repository is not a maintainer, and a release is not adoption. Dependencies age. Build environments disappear. The people who understand why one design failed move to new work. The artifact may preserve explicit state while losing tacit state.

A separate branch of the work moved through institution and company formation. SRI’s Confidencial.io announcement describes technology rooted partly in RACE and Brandeis research being reworked into a beta product. That transition required standard cryptography, integration into existing applications, financing, customers, and an organization responsible for support. The startup did not preserve the whole program. It selected a use path.

These are complementary forms of afterlife:

  • open code preserves inspectability and reuse options;
  • a product organization accepts integration and customer obligations;
  • papers preserve claims and methods;
  • an enduring laboratory can preserve people, testbeds, and the capacity to begin the next question.

No single one substitutes for all the others.

The unowned state problem

At program end, each actor can reasonably assume someone else will carry the state.

  • DARPA completed the bounded program it was chartered to run.
  • The performer must move staff to funded work.
  • A mission agency may want a product, not a research prototype.
  • A company may want exclusive value, not a shared testbed.
  • A university may preserve papers and students, not system maintenance.

This is an unowned-state equilibrium. Everyone can satisfy local obligations while code, facilities, evaluation data, and cross-team trust decay.

The unit here is the sponsor-created program network, not any one performer’s internal continuity. Article 5 asks what a host such as SRI can carry across awards. This article asks who owns the cross-performer state once the common DARPA clock disappears.

The cost is not merely waste. Later programs may pay again to reconstruct a test environment, rediscover a negative result, or reassemble experts who already learned how the pieces fail together. The national R&D account records both rounds as new spending.

The strongest counterargument

Preservation can become a euphemism for permanent subsidy. Most prototypes should die. Teams should disperse so ideas diffuse. A program that plans its institutional afterlife too early may bias selection toward established performers and easily transitioned work—the opposite of DARPA’s purpose.

That objection rules out automatic continuation. It does not justify automatic amnesia.

The design response is an option, not an entitlement. At program formation, identify potential custodians and reserve a small, staged continuity budget. Near completion, an independent review chooses among archival release, maintenance, mission transition, follow-on research, or deliberate termination. A team need not survive intact for its build environment, evaluation corpus, failure log, and integration knowledge to remain usable.

Before the final integrated review, the program must name the accountable continuity owner outside the temporary network—or record an explicit decision that no active owner is warranted. “The community” is not an owner. DARPA need not become the maintainer, but the disposition must identify the performer, mission agency, FFRDC, company, standards body, or repository that accepts each surviving obligation.

The National Academies’ assessment of ARPA-E is useful here because it documents a related model of technically strong program directors, active management, milestones, and portfolio authority. The cross-agency comparison does not prove a universal solution. It shows that empowered temporary coordination is repeatable; continuity still requires another institution. D

Five different verdicts

  • Scientific success: The programs can create new theory, algorithms, and methods even where system targets remain incomplete.
  • Technical success: Integrated demonstrations test whether separately plausible ideas function together under a hard constraint.
  • Transition success: Code release, standards, procurement, licensing, and spinouts are distinct paths and must be measured separately.
  • Institutional success: The temporary network creates powerful shared state; its default post-program preservation is weak unless assigned.
  • Public-value success: Public sponsorship can create spillovers well beyond one performer, but only if artifacts and capability remain accessible or transferable under appropriate security rules.

What the successor must learn

The permanent institution should not replace DARPA’s temporary laboratory. It should catch what deserves to survive after the program has done its job.

Every major program should have a continuity disposition alongside its transition plan:

  • what will be archived in a reproducible form;
  • what requires an active maintainer;
  • which people or roles are hard to reconstitute;
  • which test infrastructure has reuse value;
  • which negative results will be discoverable;
  • which mission organization can adopt the result; and
  • what should be allowed to end.

The open question is measurable: five years after a successful program, how much would it cost—and how long would it take—to reassemble the capability that existed at its final integrated review?

Argument under pressure

Two rounds of objection—not a ceremonial counterargument

These are simulated steelman exchanges. The second objection responds to the first answer; the conclusion is narrowed where the objection survives.

Claim under test

DARPA programs leave valuable shared state without an owner.

  1. First-level objection

    DARPA’s job is to demonstrate possibility and create options, not operate laboratories or maintain products indefinitely.

  2. Response

    Correct. The preservation obligation need not sit inside DARPA; it must be assigned to a performer, mission agency, FFRDC, company, standards body, or dedicated repository.

  3. Second-level objection

    Preassigning a continuity owner could entrench incumbents and force preservation before anyone knows what deserves to survive.

  4. Bounded conclusion

    Fund staged continuity options with explicit kill criteria. Preserve enough state to permit evaluation, then continue only artifacts, teams, and facilities that pass independent mission and reuse tests.

DARPA Defense Advanced Rese... National Academies of...

Claim under test

Milestones can shorten the effective horizon of uncertain research.

  1. First-level objection

    Aggressive milestones are precisely what prevent speculative programs from drifting and force technical truth to appear early.

  2. Response

    Milestones are a strength when they test the core uncertainty. They become distorting when every period must show smooth progress despite a discontinuous research path.

  3. Second-level objection

    Program managers already have authority to revise milestones, so the problem is execution quality rather than institutional design.

  4. Bounded conclusion

    Preserve empowered judgment, but audit whether milestones tested decisive uncertainty, rewarded candor about failure, and left time and ownership for integration after technical proof.

DARPA National Academies of...

Revision ledger

Corrections and feedback incorporated

Inspectable claims

Source Ledger

  1. Agency primary source

    Become a program manager

    DARPA. Supports: Fixed program-manager tenure, portfolio authority, milestones, and performer coordination.

  2. Consensus study report

    An Assessment of ARPA-E

    National Academies of Sciences, Engineering, and Medicine. Supports: ARPA-E's use of technically exceptional program directors with substantial authority over program design, active management, milestones, and portfolio decisions.

  3. Employer-authored project record

    Karim Eldefrawy—Key Projects

    SRI International. Supports: The public dates, roles, and program affiliations of FARSIDE under DPRIVE, EMPHASIZE under SIEVE, PRISM under RACE, and the Air Force quantum project during the author's SRI tenure.

  4. Agency primary source

    Resilient Anonymous Communication for Everyone

    Defense Advanced Research Projects Agency. Supports: RACE's privacy and resilience objectives, rigorous security requirement, completion status, and later public release of proof-of-concept code.

  5. Agency primary source

    Securing Information for Encrypted Verification and Evaluation

    Defense Advanced Research Projects Agency. Supports: SIEVE's objective of expanding efficient zero-knowledge proofs for complex defense-relevant statements.

  6. Agency primary source

    Data Protection in Virtual Environments

    Defense Advanced Research Projects Agency. Supports: DPRIVE's completed program status and its goal of bringing fully homomorphic encryption within one order of magnitude of unencrypted computation through integrated hardware and software research.

  7. Institutional transition announcement

    SRI Ventures announces new spin-out, Confidencial

    SRI International. Supports: Confidencial's launch, seed financing, beta-stage product, SRI origins, and roots in the DARPA Brandeis and RACE programs.

Public record

Version history

Published versions are immutable snapshots. Corrections create a new version rather than silently changing the historical record.

No public snapshot has been archived yet. The first snapshot is created when the article is published.

Read the correction, withdrawal, and versioning policy

← Return to the series map

This essay distinguishes firsthand memory, documentary evidence, interviews, and analysis. Published versions remain available even after revision or withdrawal.