High Performance Microchip Supply - Under Secretary of Defense ...

FINDINGS ___________________________________________________________________
applications (confidentiality, integrity, or availability). Today,
offshore engineers design, develop, test, fabricate, remotely maintain,
integrate, and upgrade some U.S. defense hardware and software.
Regrettably, the United States currently has no effective strategy to
weigh the obvious cost and time advantages of outsourcing offshore
against the potential of component subversion. 33
If real and potential adversaries’ ability to subvert U.S.
microelectronics components is not reversed or technically mitigated,
our adversaries will gain enormous asymmetric advantages that
could possibly put U.S. force projection at risk. In the end, the U.S.
strategy must be one of risk management, not risk avoidance. Even if
risk avoidance were possible, it would be prohibited by cost. Factors
affecting the risk management calculation are numerous,
complicated, and interdependent. They include
Ability of an adversary to gain life-cycle access and
keep such access secret
Given access, an adversary’s capability to alter a
component such that the alteration is difficult to
detect and to attribute
The adversary’s willingness to exploit such an
opportunity
The benefit to the adversary
The impact of a compromise on the United States
Capability of the United States to detect a
modification
Capability of the United States to attribute the
modification
Consequence to the adversary if the modification is
detected and attributed to them
33. Some of these activities may be contrary to long-standing International Traffic in Arms
Regulations (ITAR) export controls. While the U.S. has an extensive set of laws and
regulations governing export of critical technologies, comprehension of their
importance and application is not widespread.
50 _________________________________________________________ DSB TASK FORCE ON