Trey Darley

From machinery to shared systems¶

Trey began his career working on embedded Linux for telecommunications-grade network equipment: low-level software, reproducible firmware builds, interoperability testing, and the mixed collection of systems needed to prove that equipment would behave outside the laboratory. He later directed and supported technical work for NATO systems, including architecture, qualification, deployment, documentation, and long-term sustainment.

Those years left a durable lesson: reliability does not live only in the clever part of a design. It also lives in testing, documentation, maintenance, handover, and the ordinary details that let a system survive the departure of the people who first understood it.

Before cybersecurity became the category, Trey also worked in media and film: as IT director for an advertising and publicity company, as CTO of a Prague-based media intelligence firm, and as a technical consultant on The Chronicles of Narnia: Prince Caspian, keeping a film production running on location with commodity hardware and gaffer tape. Productions like that only work when specialists with different vocabularies can coordinate without first becoming experts in one another’s disciplines.

The same problem later appeared at a different scale. At Splunk and Soltra, Trey worked on making threat-intelligence systems exchange meaning reliably across tools and organisations. At OASIS, that work extended into standards: he co-chaired the Cyber Observable subcommittee and edited several parts of STIX 2.0 before later co-chairing the full Cyber Threat Intelligence Technical Committee and serving as an editor of STIX 2.1.

At the Centre for Cybersecurity Belgium, Trey helped establish the national cyber threat-intelligence capability and trained the people who went on to operate it. He also architected and led implementation of the Belgian Anti-Phishing Shield, which uses DNS to steer people away from malicious sites identified through crowdsourced and validated intelligence, even after a convincing message has persuaded them to click. It was an early national example of protective DNS, an approach now deployed at European scale through DNS4EU.

Helping institutions act together¶

Some technical problems become institutional problems because responsibility is distributed. Trey served an elected term on the board of FIRST, and co-founded and co-chairs its Standards SIG, connecting operational experience with standards organisations including ITU-T, OASIS, IETF, ETSI, and ISO. He also helped establish FIRST’s DNS Abuse SIG.

The same pattern shapes much of his current public-interest work on the 2036–2038 timestamp rollovers: a cluster of known technical failure boundaries whose remediation is distributed across software, devices, suppliers, sectors, jurisdictions, and standards bodies. He is the primary drafter and a co-editor of ITU-T Technical Paper XSTP.epoch, co-founded and co-chairs the FIRST Time Security SIG, and contributes to related public education and coordination through the Epochalypse Project.

The point is not more committees, but finding the people who each hold part of a problem, creating enough shared language and evidence for them to see the same map, preserving useful disagreement, and helping the room decide where to go next.

The thread¶

The pattern is visible in hindsight, but the route could not have been planned. The medium changed. The message, less so. The critical questions remain: what is the problem we are trying to solve, and what must be made legible so that we can act?

A degree in Comparative Literature has proven more useful than it may first appear. It trained close reading: attention to framing, context, omission, and the way the same account changes as it moves between audiences. Later training in ICA Technologies of Participation supplied practical methods for working with groups that hold reasonable yet divergent accounts of the same situation and must still reach a shared decision.

The Field Notes practise the same discipline in writing: read closely enough to find what is load-bearing, remove what is not, and leave the reader with more room to reflect and act.

Before founding Proper Tools, Trey was a Security Senior Manager at Accenture Belgium, advising clients and internal teams on cyber resilience, threat intelligence, and incident readiness, and contributing to the early development of an AI security and testing laboratory. He is a CISSP, has spoken at conferences including BruCON, BSides Lisbon, hack.lu, FIRST, RSA, and USENIX, and is a co-author of Beyond Planted Bugs in “Trusting Trust”: The Input-Processing Frontier. Selected talks →  ∷  Fuller professional history →

Patron saints¶

Grace Hopper, Evi Nemeth, Felix “FX” Lindner, Jocelyn Bell Burnell, Dan Kaminsky, Paul Erdős, and Gilda Radner, whose Roseanne Roseannadanna supplied the durable operating principle that it is always something: if it is not one thing, it is another.

Not a canon, exactly. More like a working committee: people who did the work, told the truth, built things that lasted, stayed curious, and made the people around them better.

Working together¶

Proper Tools offers focused assignments where a problem crosses technical, organisational, or institutional boundaries, a small number of continuing advisory relationships, and a way for organisations to sponsor the public coordination work.

Read about the practice and terms →