Karim Eldefrawy

Cryptography, Cybersecurity, Privacy Computer Science

Co-founder & CTO of Confidencial.io
2017-2021: SRI (Internet Origin)
2011-2016: HRL (Part of IBM Research)
2006-2010: PhD@UC Irvine

Scientific curiosity

Article 5 of 17 · Draft

SRI and the Project-Funded Institution

A nonprofit institute can preserve intellectual communities across sponsors, yet finite projects and chargeability can quietly become its real constitution.

Several finite program arcs overlap within a longer institutional line, sometimes transferring tools and people and sometimes ending at funding cliffs.
Conceptual illustration; it does not represent SRI financial data or confidential program structure.

Overlapping program clocks

Three public SRI projects crossed different portions of the author’s tenure

Public institutional records show multi-year projects that overlapped and extended beyond employment boundaries. Duration is not evidence of retained capability or successful transition.

Inclusive calendar spans shown as four, four, and three elapsed years respectively; program records and role dates may use different start or completion conventions. Inspect the source record.

Source-linked argument map

Projects create institutional value only when their state crosses the boundary

The public record establishes ambitious programs and outputs. Whether they accumulated into durable SRI capability is the question, not a documented conclusion.

  1. Documented observation

    SRI hosted overlapping mission programs

    Public records connect the author’s SRI work to RACE, SIEVE, DPRIVE, and an Air Force quantum effort.

    SRI International Defense Advanced Re... Defense Advanced Re... Defense Advanced Re...

  2. Bounded firsthand observation

    Seed work and proposals connected the arcs

    During 2017–2022, internal development, proposal work, collaboration, and project execution formed a continuous local experience despite separate sponsor clocks.

    SRI International

  3. Proposed mechanism

    Chargeability can select the portfolio

    When staff survival depends on active tasks, solicitation fit and renewal timing can displace institution-level investment even without an explicit policy to do so.

    Defense Advanced Re... Defense Advanced Re... Defense Advanced Re...

  4. Bounded conclusion

    Track retained state after each project

    A nonprofit institute should account for reused people, code, proof assets, testbeds, and transition links—not only awards and deliverables.

    SRI International SRI International

The author left SRI in 2022; later project outcomes and PARC’s 2023 arrival are documented, not firsthand employment observations.

Between 2017 and 2022, my work at SRI International moved through internal seedlings, proposals, program formation, multi-institution teams, formal methods, cryptography, hardware architecture, and attempts at transition. The public record divides that work into named projects. My memory is less neatly segmented. One project supplied a collaborator, tool, or failed approach that changed the next. The institution existed in the overlap. M

That overlap is the promise of an independent nonprofit research institute. It has no single captive product line. It can join government missions, university ideas, company engineering, and internal technical traditions. But the absence of a captive product business also means there may be no automatic payer for the spaces between awards.

The project ledger is visible. The institutional ledger is not.

The unit of analysis here is the performer institution: what SRI retained, recombined, or lost across separate awards. Article 6 examines the other side of the same programs—the temporary network and common clock created by DARPA. A successful program can coexist with weak host continuity, or a durable host can retain capability after the sponsor-created network dissolves.

Three programs, one local arc

SRI’s archived biography lists my public roles in three DARPA programs: PRISM under RACE, EMPHASIZE under SIEVE, and FARSIDE under DPRIVE, as well as an Air Force quantum project. The agency pages define distinct missions. RACE pursued resilient, privacy-preserving communication. SIEVE pursued more expressive and efficient zero-knowledge proofs. DPRIVE pursued hardware and software capable of reducing the enormous overhead of fully homomorphic encryption. D

On paper, these are separate boxes. Technically, they share methods and people. Secure computation raises questions about cryptographic assumptions, systems interfaces, verification, hardware cost, adversarial behavior, and usability. A researcher or toolchain that crosses programs can make the later work possible. A proposal process can also force every inherited asset to appear newly invented because only the new task is chargeable.

That is the central ambiguity of project-funded institutions. Projects are how ambitious work becomes accountable. They give a sponsor a defined objective, budget, schedule, and right to demand evidence. Yet if every minute and asset must attach to a current task, the institution has difficulty maintaining the state that makes the next ambitious task credible.

Chargeability is not merely an accounting rule

Chargeability begins as fiscal discipline: labor billed to a sponsor should advance the work that sponsor bought. That is necessary. The systemic effect appears when nearly all technical labor must remain chargeable nearly all the time.

Then proposal fit becomes a survival criterion. A researcher asks not only “What problem matters?” but “Which open solicitation can carry this person next quarter?” A manager asks not only “Which capability should we build?” but “Which funded line can absorb its maintenance?” Internal seed funding helps, but short seedlings may optimize for proposal readiness rather than for the uncertain period needed to discover whether a new direction is real.

This argument rests partly on firsthand interpretation, not a published SRI-wide chargeability dataset. It should be tested, not universalized. Relevant evidence would include the share and duration of internal funding, staff time between projects, reuse of technical infrastructure, turnover at funding cliffs, and the fate of groups whose work remained strong but temporarily lacked a matching solicitation. M A

A technical case: from program research to public artifact

RACE makes the handoff visible. DARPA’s public program record states that the work sought a distributed messaging system resistant to large-scale compromise and grounded in rigorous security or realistic statistical arguments. The page also records a later event: in August 2024, DARPA released proof-of-concept code so others could experiment with the complete system or its components. That release is evidence of afterlife beyond a final report. It does not establish broad deployment, maintenance, or the preservation of the original team. D

The same research line contributed to a different transition path. SRI’s 2022 spinout announcement says that Confidencial.io drew on technologies rooted in the DARPA Brandeis and RACE programs and was launching a beta product with seed financing. A public research program, a nonprofit institute, and a startup each performed a different function. None alone was the complete pipeline.

The research program could pay for new security mechanisms and system prototypes. SRI could assemble people and intellectual property across work. The startup could focus on integration with existing business applications, customers, procurement, support, and product survival. Transition required changing the technical form: the announcement describes using current cryptographic standards rather than requiring customers to adopt every original research primitive.

This is not proof that every transition should become a company. It demonstrates that “technology transfer” is not a signature at the end of a project. It is a new institution accepting a different set of obligations.

PARC arrived after my SRI tenure

Xerox announced the donation of PARC to SRI in April 2023, after I had left SRI. SRI’s current history describes PARC as part of the institution. I can analyze the transaction as an alumnus and observer; I cannot describe its internal integration firsthand. D

That boundary is especially important in a series about institutional memory. Prior experience with SRI can illuminate questions to ask—how teams are funded, what shared services exist, how internal work is protected—but it cannot answer what current PARC and SRI staff actually experienced. Those answers require documents and interviews.

The strongest counterargument

Project competition may be the feature, not the bug. It prevents stagnant groups from claiming permanent support. It forces researchers to explain relevance, compare approaches, meet milestones, and assemble new teams. A nonprofit institute insulated from sponsor demand could become an expensive guild.

The answer is not to abolish competition. It is to stop making one mechanism purchase three different things without naming them. Competitive projects buy goal-directed work. They do not reliably buy institutional memory, and they are poorly suited to buying shared capability whose users are future programs not yet defined.

A better compact would expose the layers:

  • Sponsors competitively select and evaluate projects.
  • Institutes receive bounded capability funding for demonstrably reused people, tools, data, and facilities.
  • Capability funding expires or recompetes when external review finds no reuse, learning, or mission value.
  • Transition receives its own owner and budget rather than being implied by a final demonstration.

This design preserves hard tests without forcing each new project to rebuild the institution it assumes.

Five different verdicts

  • Scientific success: The public programs generated papers, formal methods, cryptographic constructions, and open technical work; importance varies by result.
  • Technical success: RACE, SIEVE, and DPRIVE demanded systems, verified implementations, or hardware-software integration beyond papers alone.
  • Transition success: Public code and the Confidencial.io spinout show two distinct transition mechanisms, neither equivalent to universal adoption.
  • Institutional success: SRI provided a durable host across overlapping projects, while the amount of capability retained between them remains the core empirical question.
  • Public-value success: Government sponsorship created reusable knowledge and artifacts, but preservation and diffusion depend on licensing, maintenance, openness, and successor institutions.

What the successor must learn

The successor laboratory should maintain a cross-project state ledger. For every completed program, it should record which people remain, which tools are maintained, which negative results are searchable, which artifacts are independently usable, which relationships persist, and who owns the next transition decision.

That ledger should not guarantee survival. It should make destruction visible. A project can properly end while a valuable capability continues; a project can meet every milestone while leaving nothing usable behind.

The open question for SRI colleagues and sponsors is precise: which later result depended on institutional state that no sponsor had explicitly paid to preserve, and which supposedly reusable asset was never actually used again?

Argument under pressure

Two rounds of objection—not a ceremonial counterargument

These are simulated steelman exchanges. The second objection responds to the first answer; the conclusion is narrowed where the objection survives.

Claim under test

Chargeability pressure can make proposal incentives the operating system of a nonprofit research institute.

  1. First-level objection

    Without internal financial data, this is an anecdote about one employee’s experience, not evidence about SRI as a whole.

  2. Response

    Correct. The claim should be framed as a mechanism observed locally and tested through interviews, funding records, turnover, internal investment, and cross-project reuse.

  3. Second-level objection

    Researchers may blame chargeability when the real issue is that their preferred work lacks sponsor demand or technical merit.

  4. Bounded conclusion

    Do not infer merit from funding difficulty. Test whether valuable shared assets and independently validated work disappear specifically at project boundaries despite demonstrated reuse or demand.

SRI International SRI International

Claim under test

A nonprofit institute can preserve capability better than a temporary program network.

  1. First-level objection

    SRI’s need to win contracts may make it no more durable than the programs it hosts.

  2. Response

    Legal continuity is only a container. It becomes technical continuity when the institute retains staff, tools, archives, and problem communities across awards.

  3. Second-level objection

    Retention can also entrench outdated groups and turn public missions into a subsidy for incumbents.

  4. Bounded conclusion

    Condition capability funding on external technical evaluation, reuse, apprenticeship, open or transferable artifacts where appropriate, and periodic competition—without forcing zero-state rebids for every project.

SRI International Defense Advanced Rese... SRI International

Revision ledger

Corrections and feedback incorporated

Inspectable claims

Source Ledger

  1. Institutional primary source

    About SRI International

    SRI International. Supports: SRI’s institutional history and PARC’s 2023 integration.

  2. Transaction announcement

    Xerox announces donation of PARC to SRI International

    Xerox. Supports: The form, rationale, and announced structure of the PARC transfer.

  3. Employer-authored project record

    Karim Eldefrawy—Key Projects

    SRI International. Supports: The public dates, roles, and program affiliations of FARSIDE under DPRIVE, EMPHASIZE under SIEVE, PRISM under RACE, and the Air Force quantum project during the author's SRI tenure.

  4. Agency primary source

    Resilient Anonymous Communication for Everyone

    Defense Advanced Research Projects Agency. Supports: RACE's privacy and resilience objectives, rigorous security requirement, completion status, and later public release of proof-of-concept code.

  5. Agency primary source

    Securing Information for Encrypted Verification and Evaluation

    Defense Advanced Research Projects Agency. Supports: SIEVE's objective of expanding efficient zero-knowledge proofs for complex defense-relevant statements.

  6. Agency primary source

    Data Protection in Virtual Environments

    Defense Advanced Research Projects Agency. Supports: DPRIVE's completed program status and its goal of bringing fully homomorphic encryption within one order of magnitude of unencrypted computation through integrated hardware and software research.

  7. Institutional transition announcement

    SRI Ventures announces new spin-out, Confidencial

    SRI International. Supports: Confidencial's launch, seed financing, beta-stage product, SRI origins, and roots in the DARPA Brandeis and RACE programs.

Public record

Version history

Published versions are immutable snapshots. Corrections create a new version rather than silently changing the historical record.

No public snapshot has been archived yet. The first snapshot is created when the article is published.

Read the correction, withdrawal, and versioning policy

← Return to the series map

This essay distinguishes firsthand memory, documentary evidence, interviews, and analysis. Published versions remain available even after revision or withdrawal.