Could China install ‘kill switches’ in military microchips?

Graphic: DARPA

The latest issue of IEEE Spectrum has a fascinating article about the possibility that cylons Chinese or Russian bad guys might build a “backdoor” or a “kill switch” on chips exported to the United States:

Three years ago, the prestigious Defense Science Board, which advises the DOD on science and technology developments, warned in a report that the continuing shift to overseas chip fabrication would expose the Pentagon’s most mission-critical integrated circuits to sabotage. The board was especially alarmed that no existing tests could detect such compromised chips, which led to the formation of the DARPA Trust in IC program.

Where might such an attack originate? U.S. officials invariably mention China and Russia. Kenneth Flamm, a technology expert at the Pentagon during the Clinton administration who is now a professor at the University of Texas at Austin, wouldn’t get that specific but did offer some clues. Each year, secure government computer networks weather thousands of attacks over the Internet. “Some of that probing has come from places where a lot of our electronics are being manufactured,” Flamm says. “And if you’re a responsible defense person, you would be stupid not to look at some of the stuff they’re assembling, to see how else they might try to enter the network.”

John Randall, a semiconductor expert at Zyvex Corp., in Richardson, Texas, elaborates that any malefactor who can penetrate government security can find out what chips are being ordered by the Defense Department and then target them for sabotage. “If they can access the chip designs and add the modifications,” Randall says, “then the chips could be manufactured correctly anywhere and still contain the unwanted circuitry.”

How real is this threat? DARPA thinks the U.S. military could be vulnerable:

Dean Collins, deputy director of DARPA’s Microsystems Technology Office and program manager for the Trust in IC initiative… notes that many defense contractors rely heavily on field-programmable gate arrays (FPGAs)—a kind of generic chip that can be customized through software… “If you make a mistake on an FPGA, hey, you just reprogram it,” says Collins. “That’s the good news. The bad news is that if you put the FPGA in a military system, someone else can reprogram it.”

Almost all FPGAs are now made at foundries outside the United States, about 80 percent of them in Taiwan. Defense contractors have no good way of guaranteeing that these economical chips haven’t been tampered with. Building a kill switch into an FPGA could mean embedding as few as 1000 transistors within its many hundreds of millions. “You could do a lot of very interesting things with those extra transistors,” Collins says.