Why wasn't security a priority in the original design of the internet?

It grew out of ARPANET, a small closed network of trusted academic/military institutions, so the designers optimised for sharing — not defending against malicious users.

The internet evolved from ARPANET — a network of trusted academic and military institutions. The designers assumed:

• All users were known and trustworthy
• The network was closed and controlled
• The goal was information sharing, not protection

This resulted in protocols (HTTP, SMTP, FTP, DNS) with no built-in authentication or encryption - because in a trusted network, why would you need them?

Modern consequence: We now run these inherently insecure protocols on a global network with anonymous users and malicious actors. Security has to be bolted on (HTTPS, SMTPS, DNSSEC) rather than being fundamental to the design.

Go deeper:

• History of the Internet (Wikipedia) — how ARPANET's small, trusted network grew into the open internet, and why security was retrofitted.