Incubating an Open Source Hardware Movement to Address the Supply Chain IssueJoshua Gruenspecht

ContentsIntroduction.................................................................................................................................................2

I. The Supply Chain Problem......................................................................................................................3

II. Open Source Software as a Cybersecurity Solution: Successes and Failures..........................................3

III. The Rise of the Open Source Hardware Movement and its Promising Potential Future........................3

A. Modern Computer Processors Have Become Overqualified for their Tasks, and Flexible Hardware is Becoming More Popular as a Result........................................................................................................3

B. The Building Blocks for an Open Source Hardware Movement are Present and the Resources are Available.................................................................................................................................................3

C. Federal Intervention to Promote Both Open Source Movements and Semiconductor Manufacturing Has Succeeded in the Past.......................................................................................................................3

IV: A Robust Open Source Hardware Movement as a Valuable Tool in Addressing the Supply Chain Problem.......................................................................................................................................................3

A. Open Source Hardware Will Increase Both the Supply of Domestically Manufactured Integrated Circuits and the Difficulty of Targeting Whole Sectors Which Use the Same Hardware........................3

B. Widespread Use of Dynamic Hardware or Open Source Design Would Also Increase the Difficulty of Targeting Specific Corporations or Consumers...................................................................................3

C. Open Source Hardware Will Bring Down the Cost of Hardware and Make a Transition to American Suppliers More Palatable.........................................................................................................................3

D. Open Source Hardware Will Diversify Available Hardware Platforms and Create Barriers to Cyber Attack Through this Diversification........................................................................................................3

E. An Open Source Hardware Movement Will Increase American Innovation and Thus Domestic Competitiveness......................................................................................................................................3

F. An Open Source Hardware Movement Will Promote Engineering Education and Increase American Human Capital.........................................................................................................................................3

V. Counterarguments and Challenges to the Use of Open Source Hardware to Promote Cybersecurity.....3

Conclusion...................................................................................................................................................3

1

Introduction

Cybersecurity professionals and theorists have, to date, largely been consumed with the

problem of securing networked computers against unauthorized access. Recently, however, as

microchip fabrication and hardware manufacturing has begun to move overseas, experts have

raised the more basic question of the reliability of out-of-the-box equipment. Modern integrated

circuits (ICs)1 are minute, complex, and extremely difficult to test for reliability. As ICs become

increasingly integral to civilian life and military applications, the prospect of an infestation of

foreign-manufactured Trojans within critical hardware in turn becomes a significant national

security threat.

The Department of Defense and the intelligence community have responded by

promoting a trusted foundry program, paying a significant premium to have hardware

manufactured and assembled entirely on U.S. soil.2 While such a program has value, especially

for high-priority hardware, this paper will propose an alternative program aimed at lower-end

hardware: the incubation of a more robust open source hardware movement. Open source

hardware is neither a short-term nor a complete solution to the national security concerns raised

by the outsourcing of IC fabrication, but it does promise significant benefits in the middle and

long term.

Section I introduces the supply chain problem and explains why the outsourcing of

microchip fabrication and hardware manufacturing concerns cybersecurity experts. Section II

briefly recapitulates the development of the open source software movement and its relationship

1 This paper will use “integrated circuit” (or “IC”) and “microchip” (or “chip”) interchangeably.

2 See John Markoff, Old Trick Threatens the Newest Weapons, N.Y. TIMES, Oct. 26, 2009, at D1, available at http://www.nytimes.com/2009/10/27/science/27trojan.html. The Pentagon reportedly invested $600 million in its initial contract with IBM over the first ten years of the program, from 1984. Id.

2

to both domestic national security concerns over the Windows “monoculture” and foreign

national security concerns over Microsoft’s dominance of the operating systems market. Section

III explains the circumstances which have led to the nascent open source hardware movement

and discusses the early manifestations of that movement in the market. It then discusses the

resources available to encourage further growth in that area.

With that background in place, Section IV discusses six reasons why a robust open

source hardware movement would help to ameliorate the supply chain problem. The first two

subsections discuss the increased difficulties in targeting particular industries and consumers that

are created by a marketplace with additional open source hardware and more flexible microchips.

The third subsection explains how open source hardware frees up resources which can then be

used to enhance cybersecurity, and the fourth discusses the beneficial effects of hardware

diversity in counteracting hardware-based malicious code. The final two subsections discuss the

indirect benefits of an open source movement as a spur to innovation and to technological

education. Section V then addresses seven counterarguments to the open source hardware

solution, refuting some but also recognizing some limits on the utility of open source hardware in

enhancing American cybersecurity.

I. The Supply Chain Problem

National security requires some assurance of an ongoing supply of critical resources, and

maintaining access to such resources is a vexing security problem. Such issues can contribute to

war: In order to ensure sufficient stocks of coal and access to steel-making expertise, France and

Germany battled for ownership of the Saar and the Ruhr several times between 1870 and 1945.3 3 See Norman J. G. Pounds, THE RUHR: A STUDY IN HISTORICAL AND ECONOMIC GEOGRAPHY 19-26 (1952); Sam Henze, France, Germany and the Struggle for the War-making Natural Resources of the Rhineland, INVENTORY OF CONFLICT AND ENVIRONMENT CASE STUDIES (2005), http://www1.american.edu/ted/ice/saar.htm.

3

At other times, they become the focus of intense geopolitical maneuvering: Later, the U.S. and

U.S.S.R. spent years staking indirect claims to various oil-producing nations.4 As manufacturing

becomes more and more globally specialized, however, ensuring a supply of key manufactured

goods becomes almost as important as ensuring the supply of natural resources and other, more

basic materials. One of the most important manufactured goods in today’s networked economy

is the microchip.

The American military relies on ICs in almost every aspect of operations, as the Defense

Science Board pointed out in 2005.5 Complex weapons systems are built on top of both custom

application-specific integrated circuits (ASICs) and mass-produced chips.6 The proper

functioning of the microchips within these systems becomes increasingly critical as technology

progresses,7 and microchips continue to become a standard component of more and more

warfighting equipment.8 Military communications networks rely on ICs at every level, from

satellites to switched telephony to computer systems. Most military purchasing of such

equipment is commercial off-the-shelf (COTS),9 so military microchips are largely sourced

wherever the commercial market finds the best price. Modern shipping and tracking are also 4 See DANIEL YERGIN, THE PRIZE: THE EPIC QUEST FOR OIL, MONEY & POWER 391-412 (2008).

5 See generally DEFENSE SCIENCE BOARD TASK FORCE, HIGH PERFORMANCE MICROCHIP SUPPLY (2005), http://www.acq.osd.mil/dsb/reports/ADA435563.pdf (laying out American military dependencies on imported microchips in detail and explaining the resulting national security concerns).

6 Id. at 62.

7 See Noel Sharkey, A Matter of Precision, DEFENSEMANAGMENT.COM (Jan. 4, 2010), http://www.defencemanagement.com/feature_story.asp?id=13316. Defense robots have been given greater and greater autonomy over the last several years, and some have even proposed allowing them to make life-or-death decisions when human decisionmakers are unavailable. See id.

8 Defense scientists are even looking to incorporate computer microchips into uniforms. See, e.g., David Garlan et al., Project Aura: Toward Distraction-Free Pervasive Computing, IEEE PERVASIVE COMPUTING MAGAZINE 22 (April-June 2002) (describing defense-funded research into networked clothing).

9 See DEFENSE SCIENCE BOARD, supra note Error: Reference source not found, at 17.4

performed largely with modern computing equipment, making military provisioning vulnerable

as well.

Beyond the difficulties in maintaining successful military operations, there is the larger

issue of homeland cybersecurity. The American economy is ever more dependent on the

communication networks and major online service providers that make up the backbone of the

Internet.10 All of those networks and providers operate major data centers and exchange points,

each composed of thousands of individual computers, routers, and switches. As computerization

spreads, additional pieces of critical infrastructure become dependent on functional microchips.

Major transportation, energy, and chemical networks often rely on supervisory control and data

acquisition (SCADA) hardware – small devices placed along pipelines or tracks which automate

remote changes and report local conditions to control centers in real time. Disrupting this

hardware and the control centers that manage it could cause significant damage to the American

economy.11 Moreover, individual consumers’ homes are full of an ever-increasing number of

devices – from thermostats to refrigerators – whose mass disruption would cause substantial

popular discomfort. Even more than the problem of military readiness, the problem of civilian

dependence on foreign-manufactured ICs raises national security red flags – if an adversary can

attack the civilian population directly, it may be able to harm American interests without

engaging the American military at all.

10 See NATIONAL ECONOMIC COUNCIL, A STRATEGY FOR AMERICAN INNOVATION: DRIVING TOWARD SUSTAINABLE GROWTH AND QUALITY JOBS (2009), http://www.whitehouse.gov/administration/eop/nec/StrategyforAmericanInnovation/ (last visited May 12, 2010) (“Our nation’s economy is increasingly dependent on the Internet.”).

11 “The worst-case scenarios are alarming. In the popular press, policy space, and think tanks, these scenarios include disrupting critical infrastructure services, impeding key economic functions, or imperiling public safety and national security….” SCOTT CHARNEY, RETHINKING THE CYBER THREAT: A FRAMEWORK AND A PATH FORWARD 6 (2009), http://www.microsoft.com/downloads/details.aspx?FamilyID=062754cc-be0e-4bab-a181-077447f66877&displaylang=en (press button to download .pdf) (last visited May 12, 2010).

5

Although resource control issues are not a new national security concern, the networking

of computers makes them uniquely vulnerable not just to time-of-manufacture targeting – that is,

shipping of broken or otherwise flawed parts12 – but also to post-manufacture targeting – that is,

shipping of parts which are functional, but can also be remotely exploited. A shipment of

adulterated refined oil or steel cannot be triggered to fail upon the occurrence of a particular

series of events, but a microchip with a hidden backdoor can. When the foreign manufacturer

wishes to take advantage of that backdoor to manipulate a computer system or to shut it down, he

can target that machine remotely over the network and take control. As a result, infiltration of

problematic ICs can happen slowly, over time, and the stockpiling of replacement parts may only

be a partial solution to the problem.

The outsourcing of microchip manufacturing to foreign fabrication facilities provides two

potential means of making American computing systems into post-manufacture targets. First,

analysis of the design information required to manufacture the IC can provide those

manufacturers with a means of discovering implementation flaws in chip design. Such flaws are

not uncommon, and are often tolerated by manufacturers and corrected at the device driver layer.

With access to the masks and other design specifications used to manufacture ICs, however,

foreign manufacturers can use their knowledge of hardware-based weaknesses to create software

capable of overriding driver controls. Insider knowledge of the microchip design provides a leg

up in reverse engineering computers which contain that chip.

12 This, of course, is also a problem. See, e.g., Brian Grow et al., Dangerous Fakes, BUSINESS WEEK, Oct. 2, 2008, http://www.businessweek.com/magazine/content/08_41/b4103034193886.htm (discussing the prevalence of bugs in hardware imported from China). It is not a new problem, however. See, e.g., Suspect Microchips Sold to 200-300 Defense Plants, Pentagon Widens Probes, SCHENECTADY GAZETTE, Sept. 13, 1984, http://news.google.com/newspapers?nid=1917&dat=19840913&id=IhEhAAAAIBAJ&sjid=H3QFAAAAIBAJ&pg=1587,2743146 (discussing bugs in hardware imported from Taiwan in 1984).

6

Second, access to the design of a chip and to the manufacturing and shipping process can

lead to the replacement of some subset of a shipment with ICs providing the identical

functionality, but also possessing a known vulnerability. By adding a relatively small number of

additional transistors, a manufacturer might be able to add a “kill switch” – enabling a properly

equipped remote user to shut down the system remotely.13 A more involved replacement scheme

might instead create a hardware platform offering the attacker the means to escalate privileges or

steal passwords while running underneath the operating system.14 Replicating the existing

functionality of a complex ASIC while adding vulnerabilities is a significant technical challenge,

but with sufficient advance notice of the planned design, it is not insurmountable.

Given the national security risk inherent in placing the supply of such a uniquely

targetable resource in the hands of foreign manufacturers, it is worth considering ways in which

American microchip manufacturing might be revitalized. One possibility would be the fostering

of a significant open source hardware movement. To explain the benefits of this move, however,

it is first important to understand the national security value of the existing open source software

movement.

II. Open Source Software as a Cybersecurity Solution: Successes and Failures

The origins of the open source software movement can be traced back to 1983, when

Richard Stallman founded the GNU project. The GNU project and the free software movement

13 See Sally Adee, The Hunt for the Kill Switch, IEEE SPECTRUM (May 2008), available at http://spectrum.ieee.org/semiconductors/design/the-hunt-for-the-kill-switch.

14 For an example of such an implementation, see Samuel T. King et al., Designing and Implementing Malicious Hardware, Presented at the First Usenix Workshop on Large-Scale Exploits and Emergent Threats (April 15, 2008), available at http://www.usenix.org/event/leet08/tech/full_papers/king/king.pdf.

7

that it spawned15 were dedicated to the principle that software, once paid for, should be

modifiable and reusable at will.16 Major commercial software providers at the time disagreed.17

As a result, Stallman and his compatriots began writing software which they distributed with

source code – open source software. Rather than retain intellectual property rights in their

sources, they also drafted a license which required users who distributed both the code and

improved versions to do so without restrictions.18 The GNU code libraries became a definitive

adjunct to the most widely used academic operating system of the 1980s, UNIX. In time, the

Computer Systems Research Group at the University of California-Berkeley, authors of the

Berkeley Standard Distribution of Unix (BSD UNIX), were spurred by the success of the free

software movement to create a version of their OS which was not dependent on code copyrighted

by AT&T.19 The combination of BSD UNIX and the GNU toolset was a de facto standard for

network administrators in mid-sized institutions such as universities.20

15 Stallman rejects the name “open source” as insufficient to describe the goals of his movement. See Richard Stallman, Why Open Source Misses the Point of Free Software, http://www.gnu.org/philosophy/open-source-misses-the-point.html (last visited May 12, 2010) (“Open source is a development methodology; free software is a social movement. For the free software movement, free software is an ethical imperative, because only free software respects the users' freedom. By contrast, the philosophy of open source considers issues in terms of how to make software “better”—in a practical sense only.”). Since this paper is concerned only with the practical implications of free software and not the philosophical movement, it will adopt the more common “open source” appellation.

16 See The Free Software Definition, http://www.gnu.org/philosophy/free-sw.html (last visited May 12, 2010).

17 Stallman’s interest in free software arose as a result of his inability to repair the software associated with his Xerox printer without source code, which Xerox refused to provide. See STEVEN WEBER, THE SUCCESS OF OPEN SOURCE 46-47 (2004).

18 See GNU Public License FAQ, http://www.gnu.org/licenses/gpl-faq.html (last visited May 12, 2010).

19 See WEBER, supra note Error: Reference source not found at 25-46, 49-53 (tracing the early history of UNIX and the development of BSD UNIX as an alternative to AT&T software). BSD UNIX became available to the public in 1989, and the CSRG continued to distribute it until 1995. Id.

20 Id.8

For personal computing and specialized applications, however, proprietary operating

systems reigned supreme until the advent of the commercial Internet. In the early 1990s, Linus

Torvalds and a number of other programmers met online and discovered a common interest in

building an alternative to the Microsoft Windows OS which, at the time, had a de facto

monopoly over Intel x86 machines.21 Where previously the assumption among software

developers had always been that programs as complicated as operating systems required

extensive top-down design and management hierarchies, Torvalds and his team, working

collaboratively online, were the most notable pioneers of a new model of software development

– non-hierarchical, apparently chaotic, and yet highly successful in creating a Windows

alternative – Linux.22 The lack of intellectual property constraints combined with the ease of

communicating on the network made this new-model “corporation” devoted to the Linux project

possible.23

While the non-traditional approach to intellectual property rights in a work product

became the defining feature of the open source movement, the decentralized development model

which Eric Raymond named development from “the bazaar” (as opposed to traditional in-house

design-heavy development, which he termed development from “the cathedral”)24 became nearly

as important to open source culture. The bazaar depended on a relatively large group of code

developers, of various skill levels, each interested in a given final product and each actively

contributing small amounts of time to improve it. The most important mantra of open source

21 Id. at 99-102.

22 This was revelatory even to the UNIX development community at the time. See ERIC RAYMOND, THE CATHEDRAL AND THE BAZAAR 23-25 (2001).

23 See generally Yochai Benkler, Coase's Penguin, or Linux and the Nature of the Firm, 112 YALE L.J 369 (2002) (describing the conditions which allowed for the development of Linux through peer production).

24 See RAYMOND, supra note Error: Reference source not found, at 29-30.9

development became “given enough eyeballs, all bugs are shallow”25 – with enough testers, all

problems can be categorized quickly, and someone in the development base will have an idea for

a fix.

Given this development model, it is unsurprising that open source has largely succeeded

in two sets of marketplaces. The first includes types of software with extremely large user bases,

such as operating systems, email clients, and web browsers. Only a small percentage of the users

of products in these categories may themselves be coders, but because of the sheer number of

users, there are enough interested, sufficiently talented parties to be able to create open source

alternatives. Open source products in this category tend to penetrate the marketplace for a given

type of software in inverse proportion to the level of customization required by users of that

software.26 The more that a given type of software requires customizing, the less likely that a

sufficient user base exists to develop the code required to implement that customization. The

second is the market for software which is heavily used by computer-savvy populations, such as

web servers, mail servers, and software development and testing platforms. Open source

products in this category tend to penetrate where flexibility is desired by the user population.27

Even in these latter marketplaces, however, commercially distributed software binaries without

25 Id. at 41.

26 The Mozilla Firefox web browser, for example, currently has about 25% of the web browser market. Posting of Ina Fried to Beyond Binary, CNET NEWS, http://news.cnet.com/8301-13860_3-20004031-56.html (May 3, 2010 15:00 PDT). Users generally demand only that their web browser work with certain popular plug-ins (e.g., Shockwave Flash, Adobe Reader). By contrast, Linux still only has about 1% of the personal computing market. Posting of Emil Protalinski to One Microsoft Way, ARS TECHNICA, http://arstechnica.com/microsoft/news/2010/01/windows-7-growing-faster-than-vista-overtakes-mac-os.ars (Jan. 21, 2010 07:30 GMT). Users require that their operating system possess drivers for every device that can be plugged into an x86 computer.

27 The open source Apache web server, for example, has been challenged repeatedly by the IIS web server associated with Windows Server Edition, but continues to maintain greater than 50% market share. Netcraft, April 2010 Web Server Survey, http://news.netcraft.com/archives/web_server_survey.html (last visited May 12, 2010) (see table entitled “Market Share for Top Servers Across All Domains”).

10

source code have maintained a solid share of the market by focusing on ease of use, scalability,

and support.28 No open source program has yet driven a commercial manufacturer out of a major

market.

The national security community has considered open source software as a possible

inexpensive solution to flaws at points in the network ecosystem dominated by closed-source

systems. Endpoint operating systems, which are largely run by Microsoft Windows, are one

example of such a point. The Windows operating system was, for a substantial part of its

lifespan, notably bug-ridden.29 Several computer security experts have suggested that the

market dominance of Windows creates an easily targeted single point of failure - a monoculture -

within our computing systems.30 Their suggestions for solving that problem include a

decoupling of Windows and several of its component applications in order to give potential

Linux users more reason to switch over from Microsoft.31 The National Security Agency (NSA)

has released SELinux, a customized version of Linux with enhanced security controls, to the

public, in order to provide “a good starting point [in bringing] valuable security features to

mainstream operating systems.”32 The government, however, has stopped well short of replacing

its commercial-software-driven systems and applications with open source software, both

28 For examples of Microsoft using these features as selling points for Windows Server Edition, see Windows Server Case Studies, http://www.microsoft.com/windowsserver2008/en/us/R2-case-studies.aspx (last visited May 12, 2010).

29 See, e.g., John Markoff, Flaws Are Detected in Microsoft’s Vista, N.Y. TIMES, Dec. 25, 2008, http://www.nytimes.com/2006/12/25/technology/25vista.html (discussing the failure of Windows Vista to erase the image of Microsoft Windows as a flawed operating system).

30 Dan Geer et al., Cyberinsecurity: The Cost of Monopoly, http://cryptome.org/cyberinsecurity.htm (last visited May 12, 2010).

31 Id.

32 Security-Enhanced Linux, http://www.nsa.gov/research/selinux/index.shtml (last visited May 12, 2010).11

because of a commitment to commercial solutions and because American dominance in software

production gives the government a means of accessing closed-source code if absolutely

necessary.

China, lacking these reasons to prefer closed source code, has made a more concerted

effort to look at open source solutions to national security problems. Concerned that the Chinese

software market “risk[ed] becoming ‘completely controlled’ by foreign software vendors,” the

Chinese government declared a plan at the beginning of this decade to invest heavily in a

Chinese-sourced Linux codebase.33 By putting government resources behind a new distribution,

Red Flag Linux, they hoped to create a more user-friendly alternative to existing Linux

distributions, with hardware support for common Chinese hardware products, and in so doing

push back against the Windows monopoly over Chinese consumers and businesses. At the same

time, the government signaled its intent to move its own sensitive government computing

applications off of Windows machines and onto the Red Flag operating system.34

Ultimately, the threat of losing a lucrative market to an open source competitor was used

to push Microsoft into opening up its source code to the Chinese,35 and Red Flag’s commercial

viability was limited once the Chinese government embraced Windows. Though many

government offices now use a version of Windows with custom cryptographic software,36 Red

33 Sam Williams, A Timeline of Open Source in Government, LINUX DEVCENTER.COM, July 15, 2002, http://linuxdevcenter.com/pub/a/linux/2002/07/15/osgov_timeline.html.

34 Will Red Flag Linux Displace Microsoft 2000 in Sensitive PRC Government Offices?, YANCHANG EVENING NEWS, Jan. 7, 2000, http://www.usembassy-china.org.cn/sandt/redflvsms.html (translated by the US Embassy in Beijing).

35 Jason Hiner, How Microsoft Beat Linux in China and What it Means for Freedom, Justice, and the Price of Software, TECHREPUBLIC, July 27, 2007, http://blogs.techrepublic.com.com/hiner/?p=525.

36 Id.12

Flag Linux remains popular in Chinese government circles,37 and its developer, Red Flag

Software, is working with other Asian open source operating system providers to convince Asian

governments that cybersecurity concerns are best addressed through the adoption of open source

software.38 Red Flag Software is a member of the Open Source Development Labs and

continues to make the source code of its operating system publicly available.

The Chinese military, meanwhile, has developed its own operating system in order to

“harden” government and military computers against cyberattack.39 Kylin, based largely on the

open source FreeBSD kernel,40 is intended to confound American offensive expertise in

Windows- and Linux-based cyberwarfare through a move to “China-owned computer

software.”41 The Chinese press has suggested that the new operating system is “more secure than

other server software [that] has been used in national defense.”42 While security experts are

dubious about the claims of Kylin’s enhanced security,43 they nevertheless agree that this move

away from an IT monoculture could be a valuable security strategy.44 Unlike Red Flag, Kylin is

a government project, and though the government has made test versions of its operating system

37 “[M]ost users of the operating system are government offices and businesses.” Chinese Authorities Enforce Switch from Microsoft, RADIO FREE ASIA, Dec. 2, 2008, http://www.rfa.org/english/news/china/microsoft%20to%20linux-12022008144416.html.

38 Jeremy Kirk, Vietnam Pushes Open-Source Software for Government Use, NETWORKWORLD, Jan. 8. 2009, http://www.networkworld.com/news/2009/010809-vietnam-pushes-open-source-software-for.html.

39 Bill Gertz, China Blocks U.S. from Cyber Warfare, THE WASHINGTON TIMES, May 12, 2009, http://www.washingtontimes.com/news/2009/may/12/china-bolsters-for-cyber-arms-race-with-us/.

40 Posting of Dancho Danchev to Zero Day, http://www.zdnet.com/blog/security/chinas-secure-os-kylin-a-threat-to-us-offensive-cyber-capabilities/3385 (May 13, 2009, 6:23 PDT).

41 Computer Server Operating System Developed, XINHUA, Dec. 15, 2006, http://www.china.org.cn/english/China/191263.htm.

42 Id.

43 See Posting of Bruce Schneier to Schneier on Security, http://www.schneier.com/blog/archives/2009/05/kylin_new_chine.html (May 18, 2009, 6:06 EST).

13

available to the public, it has not published the source code or offered the latest version for

public consumption.

These assorted Chinese and American projects are all motivated, in whole or in part, by a

desire to move away from a monoculture in the service of national security. Open source

software is the most obvious government alternative to a successful commercial product,

offering a baseline level of security and functionality (given a preexisting population of users to

work out the kinks) and ease of specialization. Whether a given project chooses to make source

code publicly available (e.g., SELinux) or chooses instead to move forward with closed source

development (e.g., Kylin), it will develop into a system which confounds the expectations of any

cyberattacker who expects to find a computer running Microsoft Windows.

Open source operating systems present their own cybersecurity issues, however. An

adversary who possesses source code can search for vulnerabilities with greater ease than one

who must probe a working system or reverse engineer software in order to find them. A system

running an unusual operating system may present a unique signature on the Internet and thus

attract unwanted attention. Where the use of Web applications or other third-party software

occurs atop uncommon operating system code, new vulnerabilities may emerge which have not

been found in testing under standard use conditions. Finally, where users are unfamiliar with a

system, user error may lead to security breaches. Though these objections have led to a fierce

debate over the value of open source software in securing cyberspace, they are less applicable to

another, less discussed means of enhancing cybersecurity: open source hardware.

44 See, e.g., Danchev, supra note Error: Reference source not found (noting that migrating to a new proprietary operating system is a means of undermining opponents’ capabilities in a cyber arms race, but also noting that in many cases, the inevitable appearance of additional higher-level vulnerabilities in an untested codebase may reduce the utility of switching to a more secure operating system).

14

III. The Rise of the Open Source Hardware Movement and its Promising Potential Future

Two recent developments make the expansion of an open source hardware movement

into a significant customer for American-made semiconductors possible. The first is the excess

of computing power provided by many application-specific chips and the resulting increased

salience of flexible chips which trade computing power for functional flexibility. The second is

the appearance of a set of resources – the existing open-source hardware movement and a series

of decommissioned American semiconductor fabrication facilities – which can be used to

incubate a larger movement. The section that follows discusses both, and then discusses the

history of successful government intervention in similar technology realms in the past.

A. Modern Computer Processors Have Become Overqualified for their Tasks, and Flexible Hardware is Becoming More Popular as a Result.

The capabilities of current computing platforms largely exceed the needs of the average

user. Word processing, email use, and streaming video require only a fraction of the processor

cycles available to the average computer. While a few users operate their general-purpose

computers to their fullest capabilities by playing graphics-intensive video games or compiling

significant amounts of code, a significant portion of computing power goes unused. Scientists in

need of spare processing cycles have even harnessed this unused power with distributed

computing projects designed to help them simulate protein folding or search for extraterrestrial

life.45 Part of this extra processor availability can be chalked up to the natural ebb and flow of

computer use – no tool is in use at all times – but for many users computers are increasingly

more powerful than they actually need to be.

45 Spreading the Load, THE ECONOMIST, Dec. 6, 2007, http://www.economist.com/science-technology/technology-quarterly/displaystory.cfm?story_id=10202635.

15

Meanwhile, processors with the operating speed of those that used to run 2000-era

laptops are now used to run handheld devices.46 Smartphones now operate with significant

excess processor capacity, running operating systems which permit the use of only one

application at a time atop hardware with the kind of computing power which once allowed users

to listen to music, write email, and play games online all at once. On modern handheld devices

and computers alike, when a given program churns to a standstill, it is much more likely to be the

result of a bug or a network throughput problem than a limitation on processing capacity.

This modern boom in excessively powerful processors has its origin in the economics of

mass production. As long as a significant subset of users requires the enhanced processing

capabilities which newer processors provide, it continues to be worthwhile to build for the needs

of that group, which is the most likely to purchase new technology as it arises. Because

semiconductor fabrication presents tremendous startup costs and minimal marginal

manufacturing costs,47 manufacturers build semiconductor fabrication plants (fabs) to create

cutting-edge microchips and then use them in as wide an array of applications as possible.

46 Compare Posting of Mark J. Perry to Carpe Diem, http://mjperry.blogspot.com/2009/12/christmas-shopping-for-laptop-2000-vs.html (Dec. 20, 2009, 20:36) (noting the presence of a 550 MHz processor in a standard Gateway laptop in 2000) with Posting of Nilay Patel to Engadget, http://www.engadget.com/2009/06/10/iphone-3g-s-processor-specs-600mhz-cpu-256mb-of-ram/ (June 10, 2009, 13:03) (noting the 600 MHz processor in the iPhone 3GS). Newer processors are not identical, of course, but are instead optimized for handhelds - they process as much information as older laptop processors but use significantly less power to do so.

47 See, e.g., ILKKA TUOMI, THE FUTURE OF SEMICONDUCTOR INTELLECTUAL PROPERTY ARCHICTECTURAL BLOCKS IN EUROPE 134 (2009), http://ftp.jrc.es/EURdoc/JRC52422.pdf (European Commission Joint Research Centre, Institute for Prospective Technological Studies white paper) (“The main benefit of ASICs is that, after the non-recurring costs are paid, the marginal cost of producing new copies of the chip are low.”); ANA AIZCORBE, WHY ARE SEMICONDUCTOR PRICE INDEXES FALLING SO FAST? 18 n.17 (2005), http://www.bea.gov/papers/pdf/semiconductorprices.pdf (Commerce Department white paper) (describing disproportionate cost as a reason for modeling R&D and facilities costs as sunk costs in semiconductor manufacturing). Fabrication costs are not insignificant, but are overwhelmed by the tremendous cost of research, development, and facilities buildout. See, e.g., Jack Schofield, When the Chips are Down, GUARDIAN.CO.UK, July 29, 2009, http://www.guardian.co.uk/technology/2009/jul/29/computer-chips-moores-law (describing potential disruptions in Moore’s Law caused by the spiraling costs of fabrication facilities).

16

Most microchips are developed and produced in product lines – graphics chips,

cryptographic chips, embedded device chips, and so on. These chips, known as application-

specific integrated circuits (ASICs), are optimized and built with these particular applications in

mind. Because the chips are application-specific, manufacturers build only a few varieties of

each in order to take advantage of economies of scale. This often results in device manufacturers

paying for chip capabilities which exceed their requirements unless those manufacturers produce

enough output to justify creating a custom line. The most obvious example of this trend can be

found in embedded systems, which can be broadly defined as computers designed to perform a

strictly limited set of tasks. Designers of high-volume embedded systems such as mp3 players

can usually arrange to have a custom line of microchips manufactured to meet their needs, but

manufacturers of lower-volume systems, such as industrial controllers, often use general-purpose

computer chips and customize in software rather than in hardware.48

As advances in the physical sciences increase semiconductor fabricators’ ability to pack

more information onto a silicon wafer, this historical specialization starts to look less and less

necessary. The advent of overpowered microchips has led to the increasing popularity of

technologies which offer device manufacturers additional flexibility. Field-programmable gate

arrays (FPGAs) and other dynamic hardware modules allow device manufacturers to reconfigure

integrated circuits without replacing the underlying hardware. Unlike an ASIC, which is

designed for a specific task, a FPGA can change its functionality to suit the needs of the

application. As a result, the microchip fabricator requires a less detailed understanding of the

application for which an FPGA has been installed. Given the excess of computing power in

48 See, e.g., TUOMI, supra note Error: Reference source not found, at 133 (“Many IP cores are first developed and implemented using a FPGA. If the customer product is manufactured in large volumes, the design is converted into a custom made ASIC.”).

17

many devices, the efficiency loss entailed by the use of non-specialized hardware has begun to

look unimportant when compared to the attractiveness of having a smaller set of hardware

designs serve a larger set of hardware applications.

This new era of dynamic chip manufacturing may change the way computing is

performed for several different kinds of applications. In the embedded systems space, the

ongoing buzz centers around “smart” technologies – computers embedded in everyday

technology, from toilets to toasters to power meters, in order to increase the utility of that

technology. Smart technologies which have been suggested on a broader scale include smart

power grids, which increase the efficiency of power delivery, and smart traffic grids, which

adapt to changing traffic conditions. Notably, a defining characteristic of smart technologies is

that they previously were dumb – that is, easy to automate. This suggests that very simple

embedded systems will likely suffice to serve to operate them. Even the smartest traffic signal

only has a limited number of possible inputs and outputs for decisionmaking. Because of this

low level of required processor power and the novelty of the applications, early product runs of

smart technologies represent an ideal application for dynamically configurable integrated

circuits.

Changes in computer software for general purpose computing systems have also made it

easier to imagine a diverse array of ICs making inroads into higher-end computing. Process

virtual machines and hypervisors, in particular, are making intimate knowledge of the hardware

less important to software designers. Virtual machines emulate a hardware layer in software,

allowing multiple virtual computers to run inside a single operating system. Hypervisors run a

virtual machine as a thin software layer on top of the hardware itself, allowing multiple operating

systems to run simultaneously and giving each access to hardware resources. Both technologies

18

are already common in the server environment, where a single hardware server often emulates

multiple software servers, and both are making inroads into the general computing environment.

As virtualization technologies become increasingly common, the underlying hardware

configuration of a given machine is increasingly irrelevant to the vast majority of applications

developers. This means that as long as a given hardware configuration is capable of running a

hypervisor, its similarity to any other hardware configuration has no impact on its utility to a

large number of computer users.

The rise of these dynamic technologies suggests that the application-specific integrated

circuit may become less relevant in a number of areas and that the development of more versatile

platforms will become increasingly common. The United States may be better-placed to take

advantage of this transition than many imagine.

B. The Building Blocks for an Open Source Hardware Movement are Present and the Resources are Available

The open source movement in hardware is smaller, younger, and less well known than its

software counterpart, but it is beginning to take root. The rise of the open source software

movement, with its do-it-yourself ethic, catalyzed a number of engineers to go further and begin

experimenting with hardware. Make magazine, which has been called “the bible of this new

movement,”49 had tens of thousands of subscribers within four months of its launch in 2005,50

and now claims a quarter of a million readers.51 Within its first year, it started promoting the

49 Daniel Roth, The Amazing Rise of the Do-It-Yourself Economy, FORTUNE, May 17, 2005, available at http://www.danielroth.net/archive/2005/06/the_amazing_ris.html.

50 Id.

51 Make Advertising Sell Sheet, http://www.makezine.com/images/advertise/SellSheets2010-MAKE-Magazine.pdf (last visited June 19, 2010).

19

idea of open source hardware.52 Open source hardware operates on the same principles as open

source software, insisting that all the information required to recreate a given device be made

available to the users of that device. In the case of hardware, this includes the schematics and

layout data required to recreate a given device. Where FPGAs are included, it also includes the

logic required to configure the chip for the appropriate use.53 Those boards and chips still need

to be manufactured, but the lack of a premium paid on research and development lowers the

hardware costs significantly.54

Open source hardware has already scored some notable successes. The most widely

adopted platform for open source hardware to date has been the Arduino, an Italian development

board based on the Atmel AVR chipset.55 More than 50,000 boards have been shipped by

Arduino itself;56 many more have been shipped by other companies who manufacture using the

same designs. The open source hardware community has designed everything from mp3 players

to unmanned aircraft using Arduino boards. Businesses selling devices based on Arduino boards

have sprung up, including one which “developed an Arduino-powered device that monitors

house plants and phones you when they need to be watered.”57 Others find a microchip which

suits their needs and then start designing their own hardware – an Australian engineer

52 See Posting of Phillip Torone to Open Source Hardware 2008 http://blog.makezine.com/archive/2008/11/_draft_open_source_hardwa.html (Nov. 28, 2008 12:02) (noting that the 2008 gift guide to open source hardware was the third annual guide).

53 Mohamed A. Salem & Jamil I. Khatib, An Introduction to Open-Source Hardware Development, EEDESIGN.COM (July 1, 2004), http://www.eetimes.com/news/design/features/showArticle.jhtml?articleID=22103383.

54 Id.

55 See Arduino, http://www.arduino.cc/en/Main/Hardware (last visited May 7, 2010).

56 Clive Thompson, Build It. Share It. Profit. Can Open Source Hardware Work?, WIRED (November 2008), http://www.wired.com/techbiz/startups/magazine/16-11/ff_openmanufacturing.

57 Id.20

collaborating with the larger community used this method to develop a low-cost telephone router

for use in the developing world.58 Over the last few years, several successful American start-ups

have been founded to sell products based on open source hardware.59

The Arduino has proven to be a flexible platform for applications which require very

minimal computing power, but that set of applications is only a fraction of those found on open

source hardware designers’ to do list. In order to design more computationally involved devices

– e.g., telephone switches, handheld devices, and workstations – or to operate under specific

conditions – e.g., when limited electrical power is available – hardware engineers need a wider

array of open source hardware platforms, as well as microchips upon which to base those

platforms. These chips do not have to be state-of-the-art – indeed, the vast majority of open

source engineers would not be able to make use of them if they were – but as a class, they have

to provide more flexibility than the chips that power existing open source platforms. If these

future devices are to be part of the answer to cybersecurity concerns over the supply chain, these

microchips would ideally be sourced from the United States.

As it happens, domestic facilities for supplying these ICs already exist. Over the last ten

years, a large number of American fabs have been decommissioned and taken offline because

they are not equipped to produce the state-of-the-art chips which make domestic production

profitable. Such facilities are sometimes sold to lower-grade chip manufacturers or given

58 Id.

59 This year, thirteen hardware companies made more than $1 million in open-source related revenues. See Presentation of Phillip Torrone & Limor Fried, Adafruit Industries, to Foo Camp East 22 (May 1, 2010), slides at http://www.adafruit.com/pt/fooeastignite2010.pdf.

21

away,60 but are also often repurposed as warehouses or other business facilities.61 Such

applications fail to take full advantage of the billions of dollars which go into constructing clean

facilities for semiconductor manufacture.

The availability of these fabs offers a relatively inexpensive opportunity for the federal

government to incentivize the production of low- and mid-grade microchips and fill the needs of

open source hardware engineers. Even a single fab subsidized in part by the government could

be of great value. Initially, it would be used to produce a range of low-priced FPGAs to integrate

into open source hardware designs. If higher sales volumes made a transition to specialized

hardware cost-effective, it would also move into the business of assisting the open source

hardware movement in designing its own specialized FPGAs.62 Several corporations have

already donated older microchip specifications to the commons, so reference designs and starting

points already exist.63 Right now, the costs for developing prototypes or small shipments of new

hardware are extremely high.64 A domestic facility that subsidized entrepreneurial production of

prototypes and provided an opportunity to source smaller product runs would reduce those costs

and encourage those inventors to build using domestically manufactured ICs.

60 See, e.g., Stacey Higginbotham, Local Fabs May Be Sold, Austin Business Journal, May 24, 2002, http://www.bizjournals.com/austin/stories/2002/05/27/story2.html (describing the possible sale of older fabs owned by AMD to overseas buyers); University of Central Florida, Intersil Donates 100,000-Square-Foot Building to UCF, Apr. 21, 2010, http://news.ucf.edu/UCFnews/index?page=article&id=002400417c223ec20127fe232a46007202 (describing donation of an older fab to a local university).

61 See Higginbotham, supra note Error: Reference source not found (describing the repurposing of two local Motorola fabs).

62 If product runs were to reach very high volume, entrepreneurs might also turn to this foundry for American-made ASICs.

63 See infra note Error: Reference source not found and associated text for a discussion of their possible motivations.

64 See, e.g., Open Sesame, THE ECONOMIST, June 5, 2008, http://www.economist.com/science-technology/technology-quarterly/displaystory.cfm?story_id=11482589 (discussing some of the pitfalls small manufacturers find in working with chipmakers).

22

C. Federal Intervention to Promote Both Open Source Movements and Semiconductor Manufacturing Has Succeeded in the Past

Intervention on the part of the federal government to encourage technical development in

a specific area is not a new phenomenon. The Advanced Research Projects Agency (ARPA)65

famously funded the creation of the ARPANet, the progenitor of the modern Internet, and

opened up the protocols that underlie its operation.66 Any federal government action to promote

an open source hardware movement would follow in the footsteps of previous government

intervention to promote both semiconductor manufacturing and open source software.

In the 1980s and 1990s, the federal government stepped in to reinforce the American

position of power within the semiconductor industry. Previously unchallenged American

manufacturers faced a surging Japanese industry with new, lower-cost manufacturing facilities

and a dominant position in the equipment and material supply infrastructure.67 American

semiconductors dropped from an 85% share of the world’s semiconductor market in the 1970s to

43% in 1985,68 and “[b]y 1986, the U.S. semiconductor industry was calculated to be within

eighteen months of irrecoverable loss of production capability….”69 Congress and the

Department of Defense (DOD), worried about the threat to national security,70 began to look at

alternatives. They first considered having DOD pay semiconductor manufacturers to retain

American manufacturing capabilities, but rejected that solution because of its expense and, 65 ARPA later changed its name to the Defense Advanced Research Projects Agency, or DARPA.

66 See KATIE HAFNER & MATTHEW LYON, WHERE WIZARDS STAY UP LATE 68-81, 232-256 (1996).

67 LARRY D. BROWNING & JUDY C. SHETLER, SEMATECH: SAVING THE U.S. SEMICONDUCTOR Industry 5-6 (2000).

68 Id. at 13.

69 Id. at 6.

70 See, e.g., PHILIP C. WEBRE, CONGRESSIONAL BUDGET OFFICE, THE BENEFITS AND RISKS OF FEDERAL FUNDING FOR SEMATECH 28-30 (1987).

23

“more important, [because] these solutions would ignore the interactions between maintaining a

secure domestic supply of semiconductors and the ability of domestic suppliers to maintain

technical expertise.”71 Instead, it turned to Sematech.

Sematech was a manufacturing consortium whose members included all of the major

American semiconductor manufacturers.72 The Semiconductor Industry Association (SIA), the

industry’s trade group, developed the idea of a consortium fab which would be staffed with

people from the various companies and funded in part by the federal government and in part by

the companies themselves. This consortium fab would be devoted to developing new, cutting-

edge microchip technologies to ensure continued American dominance in the industry.73

Congress signed on to fund the creation of Sematech with $100 million dollars a year for

each of the first five years.74 The members of the SIA, working from recommendations laid out

by the Defense Science Board, developed the “Black Book,” a detailed plan of operations for

Sematech,75 and over the next several years halted the losses to the American semiconductor

industry. By 1994, the consortium had been so successful that it stopped taking federal

funding,76 though the industry continued to collaborate in supporting its research. The success of

the Sematech experiment allowed the American semiconductor industry to develop the

technologies which eventually drove the expansion of the Internet and the economic boom which

followed.

71 Id. at 29.

72 BROWNING & SHETLER, supra note Error: Reference source not found, at 21.

73 Id. at 31-32.

74 Id. at 29.

75 Id. at 27.

76 Id. at 182-83.24

Sematech was only a solution to the problems of its time, however: the subsequent slow

transition of much of the semiconductor industry from an integrated device manufacturing (IDM)

model to contract fabrication at so-called “pure-play” foundries has led to the rise of fabless

chipmakers.77 Over 70% of the foundry market is now owned by companies in Taiwan, China,

and Singapore,78 and much IDM manufacturing now takes place there as well. However, this

transition is of minimal concern to most of the American semiconductor industry, which has

profited from the outsourcing of its manufacturing. If the federal government is to intervene in

the market again, it needs a different model.

One possible exemplar can be found in the federal government’s role in encouraging the

open source software movement. The development of the UNIX operating system, in part at

Berkeley National Labs, provided the operating system base upon which Richard Stallman built

the first open source tools.79 The eventual release of the codebase of BSD UNIX into the public

commons played a critical role in the development of several common open source operating

systems, including Linux, FreeBSD, and OpenBSD.80 Without this release of this federally

developed code, the open source movement (and the private companies that leveraged that open

source movement81) would have been significantly worse-off.

77 See TUOMI, supra note Error: Reference source not found, at 27-42.

78 Id. at 30.

79 See supra note Error: Reference source not found.

80 BSD UNIX code formed the basis of FreeBSD and OpenBSD. Given the ongoing battle between AT&T and the BSD team over the ownership of the UNIX codebase, the Linux community was wary of importing any code directly because of concerns over lack of ownership, but used the BSD TCP/IP stack and other components as a model. See WEBER, supra note Error: Reference source not found, at 95-105.

81 One example of commercial software based in part on the FreeBSD codebase is Apple OS X. See Posting of Zephrin Lasker to War Room, BUSINESS INSIDER, http://www.businessinsider.com/apple-keeps-winning-because-its-a-giant-startup-2010-4 (Apr. 28, 2010, 10:18) (“[T]he original OS X is based upon the Mac kernel which is itself based on open source FreeBSD.”).

25

A federal push for more open source hardware production would require a few simple

steps. One would be a subsidization of the reopening of one or more shuttered semiconductor

fabrication facilities and a push for the production of more flexible hardware. A second would

be increasing the seed intellectual property in the hardware space by releasing older federally-

owned board and microchip designs into the commons and by incentivizing hardware companies

to push a few key patents into the commons more quickly. In addition, the federal government

could directly subsidize the open source hardware designers who take advantage of the new

American chips by purchasing hardware from those manufacturers. The next section will

explain why taking these steps would promote American cybersecurity.

IV: A Robust Open Source Hardware Movement as a Valuable Tool in Addressing the Supply Chain Problem

Taking steps toward an open source hardware movement is one of the few ways in which

the federal government can make significant gains in addressing the supply chain problem. A

robust open source hardware movement will increase the difficulty of targeting both specific

computing devices and the general population of computing devices with cyberattacks, reduce

the cost of sourcing hardware purchases from American manufacturers, and improve American

education and innovation in engineering.

A. Open Source Hardware Will Increase Both the Supply of Domestically Manufactured Integrated Circuits and the Difficulty of Targeting Whole Sectors Which Use the Same Hardware

Federal support for the fabrication of flexible, low-cost microchips will give device

designers more choices when sourcing their hardware. Currently, integrated circuit

26

manufacturing is increasingly centered in Asia.82 Reinvigorating mothballed American fabs

would provide additional choices to security-conscious device manufacturers and downmarket

consumers who might otherwise be forced to buy from foreign companies simply because of

their stranglehold over the industry.

Manufacturers and consumers would benefit from the increased availability of dynamic

microchips and dynamic microchip designs. By encouraging the production of FPGAs and other

dynamic microchips, the federal government can drive down the cost of American microchip

manufacturing without having to subsidize the bewildering variety of application-specific chips

which would otherwise be required. As American fabs offer cheaper FPGAs to the public, a

broader array of hardware manufacturers will take advantage of the new economics of microchip

supply and become comfortable with the use of FPGAs in specialized applications.

This increased comfort with dynamic chips will be further aided by the government’s

promotion of open source hardware design. Just as the early open source software movement

created a base of publicly accessible code which demonstrated to later software designers how to

use software to solve problems common to both open and proprietary software,83 so too open

source hardware will create a base set of available solutions to common problems in the use of

dynamic microchips. Examples include the hardware description language (HDL) specifications

which permit dynamic chips to be set for particular applications and the schematics and layout

data which explain how to use the chip on a hardware board.

82 In 2004, China and Japan alone accounted for more than 40% of all semiconductor manufacturing. MICHAEL PECHT, CHINA’S ELECTRONICS INDUSTRY 96 fig. 5.1 (2007). These numbers do not include Taiwan, home to the world’s largest single semiconductor manufacturer, TSMC. More recent statistics for market share are hard to come by, but it is clear that the Asian industry’s share of the marketplace has only grown since 2004. See TUOMI, supra note Error: Reference source not found, at 27-42.

83 See, e.g., the replication of the BSD TCP/IP stack described supra, note Error: Reference source not found.27

Most obviously, this will help by promoting open source production itself as a viable

means of creating marketable hardware. It will also assist commercial use of the new chips both

directly and indirectly: directly because many open source hardware designers are commercial

engineers working in their free time, and the enhanced human capital which they develop during

open source design informs their day jobs, and indirectly because even commercial designers

who have no interest in open source design prefer to have a codebase which explains how to use

their hardware. An open source codebase increases the likelihood that engineers will advocate

for the use of dynamic ICs in all varieties of hardware.

As the use of new chips becomes more common, it will increase the viability of the

American manufacturing facilities which produce those chips and make it easier for hardware

manufacturers to buy from domestic producers. As the controllers, switches, and other hardware

which depends on those chips are integrated into the publicly accessible Internet, the threat from

placement of foreign-sourced embedded hardware at key points in the network will be

diminished.

The dominant East Asian suppliers of ICs are unlikely to sit and observe this transition to

dynamic chips complacently. Fierce competition in the supply of FPGAs is to be expected.

However, the creation of additional competition is itself a cybersecurity benefit, even if the

market is highly fractured. It increases the ability of purchasers to mix and match parts from

multiple providers and thus reduces the ability of suppliers to predict where their microchips and

the derived hardware will end up. When a given company supplies all of the FPGAs used in

manufacturing a given device manufacturer’s graphics boards, it can analyze their customer base

and guarantee pervasive placement in a downmarket product. On the other hand, when it is one

of several suppliers, it cannot guarantee delivery to a given sector.

28

Given that by definition open source companies have little in the way of an intellectual

property advantage over their competitors, any companies who succeed in creating

commercializable open source designs based on those chips will soon face competition from

alternative providers. However, this still represents an advantage over the status quo, in which

many pieces of hardware are sourced overseas. If a malicious hardware provider knows that it is

shipping all of the tower controllers to implement a smart grid for a particular American utility

company, it can arrange a hardware vulnerability which will take down that entire electrical

network. If, instead, that design is open source, and the utility can therefore source from a

number of different providers, the range of options available to the malicious hardware provider

is correspondingly limited. Because open source design increases the ease with which hardware

manufacturers can source from multiple providers, it may no longer be possible for malicious

hardware designers to enable pervasive attacks on the networks which run on top of the devices

they provide.

B. Widespread Use of Dynamic Hardware or Open Source Design Would Also Increase the Difficulty of Targeting Specific Corporations or Consumers

Regardless of whether open source hardware becomes commercially successful,

increasing the use of FPGAs is itself desirable from a cybersecurity standpoint. As noted in the

previous subsection, increasing competition between domestic and foreign providers makes it

more difficult for a malicious manufacturer to predict downmarket use. Even if all of the

American FPGA providers were to fail, however, the increased use of dynamic ICs would make

it more difficult for foreign manufacturers to predict downmarket uses because of the nature of

dynamic microprocessing.

29

FPGAs are useful because of their dynamic configurability. Hardware manufacturers use

them to design hardware for many different applications, and they are accordingly optimized for

flexibility rather than performance of a particular task. An open source hardware movement also

encourages the creative use of FPGAs. The expected outcome of the increased use FPGAs is a

hardware manufacturing industry which takes established chip designs and places them in any

number of individual devices – from telephones to transmission towers. While particular FPGAs

may be better for particular uses because of size, power consumption, or cost considerations,

further optimization for a given use is performed in HDL. Toasters, boiler overflow switches,

and certain local power station applications, all of which need to withstand high heat and make

relatively simple decisions, might run off of the same FPGA.

As a result, FPGA manufacturers without a great deal of insight into the supply chain will

be largely unable to predict the future uses of their ICs. It will therefore become both more

difficult to target particular industries or regions and also more difficult to predict the end-user of

a particular chip.

C. Open Source Hardware Will Bring Down the Cost of Hardware and Make a Transition to American Suppliers More Palatable

Intellectual property costs are a major component of hardware purchasing. Materials,

labor, manufacturing, and shipping represent a small part of the cost of a chip – the rest is

research and development costs and other intellectual-property premiums, including a substantial

profit margin.84 In addition, there are significant transaction costs involved in licensing current

84 See, e.g., Michael Kanellos, Intel’s Manufacturing Cost: $40 Per Chip, CNET NEWS, Sep. 13, 2005, http://news.cnet.com/Intels-manufacturing-cost-40-per-chip/2100-1006_3-5862922.html (noting that in 2005, while the cost of a Pentium 4 chip went as high as $637 dollars, the cost to Intel of making an individual Pentium 4 chip was $40, with research and design costs excluded).

30

chips.85 Even more intellectual property overhead is added at the device manufacturing layer.

Reducing those overhead costs would reduce the absolute cost of hardware in a consumer’s

budget. American-manufactured chips and hardware would likely remain more expensive in

relative terms than their foreign counterparts because of differences in fixed labor and

environmental regulation costs, but an absolute reduction in price would leave purchasers with

additional marginal cash from each hardware purchase. Government regulation could then

ensure that some of this windfall is spent on purchasing open source American-made devices

rather than their foreign equivalents, in order to improve the national cybersecurity posture.

An open source hardware movement would eliminate the IP premium. Open source

software has demonstrated the comparative advantage of possessing no intellectual property

costs. Red Hat Linux has become a successful provider of end-user operating system software

by undercutting its major competitor on product price (by charging nothing at all) and profiting

on sales of support services.86 The use of open source hardware would not be entirely free, given

the fixed costs of production. Nevertheless, cutting the fat would provide substantial savings and

make open source solutions more attractive.

D. Open Source Hardware Will Diversify Available Hardware Platforms and Create Barriers to Cyber Attack Through this Diversification

While certain characteristics of open source hardware and dynamic chipsets make them

inherently attractive for cybersecurity reasons, introducing them to the larger hardware 85 See, e.g., Robert Ristelhueber, Rapid Chairman Vows to Remedy IP Licensing Lags, EE TIMES, Oct. 27, 1999, http://www.eet.com/story/OEG19991027S0030 (discussing excessive delays associated with the sale and licensing of semiconductor-related IP).

86 See Jessica Hodgson & John Kell, Red Hat Profit Rises 37%, WALL ST. J., Sept. 24, 2009, http://online.wsj.com/article/SB125379354205337405.html (“Red Hat's core Linux product is free, but the company makes its money on providing maintenance and support to corporations and large organizations who use it to operate computers.”).

31

ecosystem also brings cybersecurity benefits in the form of diversification. Diversity is an

especially effective weapon against malicious code embedded in hardware – the closer to the

hardware layer code is, the more difficult it is for it to compensate for unexpected surroundings.

When it becomes more difficult to predict the target environment, it becomes harder to write

malicious code. Open source promotes diversity both by providing a direct alternative to

existing hardware monocultures and by creating more ways to customize that hardware and thus

indirectly diversify the target environments of malicious code.

Environmental diversity is a very powerful weapon against malicious code. Code

designed to attack Windows XP may be useless against Windows 98, or even against a Windows

XP machine with an unexpected set of network drivers. This is particularly true of code

embedded in hardware, which must be exceedingly compact because of the limited memory

space available. These limits give embedded code less room for decision trees which permit a

program to evaluate its environment and find the correct sequence of actions which will give it

control over the operating system or other hardware components and allow it to proceed with

additional commands. If a given chip does not possess a given instruction set or does possess

unexpected privilege escalation instructions or memory protection, malicious code may fail. If

certain peripherals are not present or are in unexpected locations, malicious code may be

rendered inert. Because of the expectation dependencies of hardware-based malicious code, it is

possible that hardware monocultures such as the Intel/AMD domination of desktop computing

present a greater threat to cybersecurity than the software monocultures which have raised so

many hackles in the cybersecurity community.87

87 See supra note Error: Reference source not found.32

One critical component of the open source design aesthetic is modularity – the

subdivision of a system into individual parts which perform separate tasks. This enhances the

flexibility of the design, reduces the costs of development by increasing the reusability of the

parts in question, and helps to cordon off bugs or errors into one particular area of the system.

Pieces can be discarded, upgraded, or replaced without affecting the rest of the system. Many

large software projects are modularly designed, but open source projects almost always fall into

this category.88 While hardware design, like software design, is often modular – think of a

desktop computer, in which monitors, graphics cards, and RAM modules can all be swapped

without replacing the central processor – this is less true at the hardware board-and-chip level.

An open source hardware movement would create a more diverse hardware environment,

enabling a kind of “mix and match” approach to building individual systems.

There are two advantages created by this diversification of hardware platforms. The first

is in creating direct alternatives to existing components. Currently, a device manufacturer may

only be able to choose between a limited subset of providers for a given component – for

example, desktop computer builders usually use either Nvidia or AMD for graphics processing

units (GPUs). This makes it easier for someone designing malicious code hidden within a CPU

to assume that there will be an associated GPU with one of two architectures on the same board.

By contrast, having additional FPGA-based solutions for graphics processing makes it harder for

a malicious designer to predict the target environment.

The second is in the diversification of the architectures in which the components

themselves are placed. Currently, a malicious designer might feel entitled to assume that a cell

88 Committing to open one’s own source code does not require any more modularity than developing proprietary code, but the practical considerations inherent in having multiple developers unfamiliar with a program tinkering with the same code base at the same time strongly militate for as much modularity as possible.

33

phone will have a GPS chip on the same board as the CPU (as many cell phones now do), and to

develop code which takes advantage of that fact. Open source hardware designs which use those

same chips in new configurations, as in the plant water meter which calls its owner when

rehydration is required, also confound the expectations of the malicious hardware designer. The

idea is to increase “the number of hardware platform types and their features… to the point

where adequate detailed knowledge about design and implementation vulnerabilities will be

difficult to extract without significant risk of exposure and substantial investments.”89

While open source hardware can enable this diversification, virtualization can also make

it transparent to the user on more complicated systems. Software is programmed to run atop a

given hardware configuration. Operating systems abstract away much of the functionality of the

hardware, allowing most users to largely ignore the differences between machines, but those who

write hardware drivers and other programs which interact directly with the underlying

components still need to understand architectures. This puts pressure on hardware manufacturers

to standardize their chip and component architectures to appeal to software designers.

Virtualization removes this pressure by allowing programmers to write for an underlying virtual

machine. Once the hardware manufacturer releases a version of that virtual machine which sits

atop his underlying architecture, the software designers are satisfied.

Insofar as diversifying the available hardware promotes virtualization, there is an added

cybersecurity bonus. Virtualization itself makes embedding malicious code in microchips more

difficult by encouraging a diversity of software platforms atop a given hardware configuration.

The abstraction works in both directions. Until 2006, a malicious microchip designer could

assume that a personal computer with a PowerPC CPU was running an Apple OS, while an x86

89 Stephen Kent & John Lowry, DDRE/IARPA Cyber Security High Payoff Technology Initiatives – BBN (Jan. 8, 2010) (on file with author).

34

CPU probably indicated Windows. As virtualization becomes more common, these kinds of

assumptions will no longer hold – all software designers will write for virtual machines. If an

open source hardware movement can hasten the movement toward virtualization, it will be a

boost to cybersecurity.

E. An Open Source Hardware Movement Will Increase American Innovation and Thus Domestic Competitiveness

In the middle term, promoting American innovation in the design of ICs is the surest way

to improve the health of the American semiconductor manufacturing industry. One way to foster

that innovation is to offer startups and other innovators relatively inexpensive access to

technologies which allow them to critique each others’ designs and build test models. By

streamlining the barriers to fab access and the conversation among these small- and mid-size

designers, the United States can create a new reason for semiconductor manufacturers to house

their operations domestically.

American corporations have long dominated semiconductor design because of American

advantages in engineering human capital. American universities provided the best engineering

education, and the United States offered a lifestyle which appealed to incoming immigrants.

Silicon Valley became a repository of expertise, and the resulting concentration of talent

generated further interest from semiconductor designers who wanted to set up shop.90

Semiconductor manufacturing unsurprisingly followed semiconductor design. Though a large

90 See ANNALEE SAXENIAN, THE NEW ARGONAUTS 29-40, 48-54 (2006) (discussing the “Silicon Valley model” and its ability to attract the best engineers from all over the globe before the fragmentation of the industry).

35

fraction of semiconductor manufacturing has since moved overseas, a portion has stayed in the

United States, gaining some competitive advantage from its proximity to designers.91

As third-world countries build up their own centers of expertise, America can turn to a

second advantage that it still possesses over those nations – the combination of entrepreneurial

drive with free time – to continue to assume leadership in hardware design and encourage this

portion of semiconductor manufacturing to remain in the United States. Currently, open source

hardware is mostly the province of individual designers and small-scale side-businesses taking

advantage of the downtime provided by the American work week to develop new devices and

new uses for old hardware.92 These users are creating in their free time, for the enjoyment of the

process. Yochai Benkler has suggested that this kind of self-actualizing peer production is a

new, sustainable model for economic development.93 Encouraging its growth will in turn

encourage semiconductor manufacturing to continue to domestic operation in order to better

serve this user base.

F. An Open Source Hardware Movement Will Promote Engineering Education and Increase American Human Capital

Finally, cybersecurity experts agree that a comprehensive plan to address cybersecurity

vulnerabilities must encourage American students to acquire expertise in relevant fields. One of

the best ways to make hardware engineering accessible to students is to lower barriers to entry,

both in cost and in knowledge. Enhancing the profile of the open source hardware movement

91 See id. at 43-47 (discussing the importance of localization and the benefits that accrue to design communities which stay in contact with existing knowledge centers in Silicon Valley).

92 But see supra, note Error: Reference source not found.

93 YOCHAI BENKLER, THE WEALTH OF NETWORKS 95-127 (2006).36

will provide American high schools and universities more opportunities to engage in hardware

design and will interest more students in engineering as a career.

Open source software has become a standard teaching tool in many American schools.

Teachers use open source code to demonstrate the utility of programming skills in real-world

applications.94 They can access it without complicated licensing arrangements or expensive fees.

Open source hardware could serve the same function for hardware design, and in so doing would

help to develop the technical expertise which America needs in order to defend against

cyberattack.

V. Counterarguments and Challenges to the Use of Open Source Hardware to Promote Cybersecurity.

While promoting an open source hardware movement appears to offer a number of

significant cybersecurity benefits, there are reasons for skepticism on the part of policymakers.

Some of the arguments which might be made against the policy include: (1) encouraging

competition with proprietary solutions may undermine the semiconductor design industry, an

American economic powerhouse and the source of a national cybersecurity advantage; (2)

eliminating intellectual property overhead in hardware manufacturing only makes providers

whose costs are lower look more appealing; (3) promoting low-powered dynamic chips will do

little to solve the cybersecurity problem for high-end computing applications; (4) pushing

virtualization-based solutions merely relocates vulnerabilities; (5) if such policy were effective, it

would also reduce the effectiveness of cyber attack against nations other than America and thus

would do nothing to improve our overall cyberwarfare posture; (6) any policy implementing this

94 Open source software is used in both primary and secondary schools and institutions of higher learning. Keith J. O’Hara & Jennifer S. Kay, Open Source Software and Computer Science Education, JOURNAL OF COMPUTING SCIENCE IN COLLEGES 1, 4 (2003).

37

potential solution fails a cost/benefit analysis; and (7) random testing of components may

provide a less expensive alternative. Each of these arguments is considered in turn.

1. Promoting open source hardware undermines the American semiconductor industry.

The American semiconductor design industry is an economic powerhouse – semiconductors are

America’s second-largest export.95 The industry also provides the country with best-in-class

technical expertise, an advantage in any hardware cybersecurity confrontation. American

companies have dominated the semiconductor design industry for much of the last fifty years

precisely because of their control over intellectual property and willingness to put the profits

earned through that control back into advancing IC technology. Creating an open source

movement might put that remaining American technical advantage in jeopardy by undermining

the source of those profits.

On a related note, by reducing the ability to recoup profits from research and

development, open source software may reduce the incentives to engage in that research and

ultimately retard the progress of the semiconductor industry. Given that the research and

development costs in semiconductor design are staggeringly high,96 any policy which might

disrupt the profits needed to support that research may be viewed with suspicion.

This argument is flawed: based on past experience, it seems likely that the open source

hardware movement will pose minimal danger to the well-being of the existing commercial

semiconductor industry. The competition from open source software providers has done little to

95 Semiconductor Industry Association, Public Policy, http://www.sia-online.org/cs/public_policy (last visited May 12, 2010).

96 See, e.g., Mark LaPedus, Schemes Strip Cost out of Chip R&D, EE TIMES, July 26, 2007, http://www.eetimes.com/news/semi/showArticle.jhtml?articleID=201001339 (“In 1978, total semiconductor R&D was $600 million, according to IC Insights. Intermolecular claims that figure had grown to $45 billion by 2006 and is expected to hit a whopping $100 billion in 2012.”)

38

sap the strength of American proprietary software design champions such as Microsoft and

Adobe. Certain successful open source software products have succeeded in exerting downward

pressure on the prices of proprietary competitors,97 and a subset of proprietary chips which find

themselves in direct competition with open source hardware products may analogously suffer

from reduced profit margins. However, the ability of proprietary companies to develop on the

cutting edge will not be challenged, and thus the incentive to leverage their comparative

advantage by pursuing improvements through research and development funding will, if

anything, be greater.

There may even be advantages to the industry in this policy. First, by opening up their

older designs for open source development, industry members may spark new uses and

reinvigorate old product lines. Certain industry players have already donated some of their

designs to the commons, hoping to gain traction in the marketplace by increasing engineers’

comfort levels with their architectures.98 Second, by increasing student interest in hardware

development, this policy increases the future availability of workers with the requisite technical

interest and expertise.

Moreover, any small loss in American semiconductor design leadership is likely to have a

minimal impact on cybersecurity. The comparative American knowledge advantage has already

been reduced in recent years.99 The corresponding advantage in analyzing hardware deficiencies

has also been reduced. Moreover, any such advantage in analysis pales in comparison to the 97 As noted supra note Error: Reference source not found, Apache-driven Linux web servers have successfully competed with Windows Server Edition for many years. Windows Server Edition has seen substantial price decreases as a result.

98 See Linda Geppert, IBM Goes Open Source on Key Microprocessor, IEEE SPECTRUM (April 2004) (discussing IBM’s decision to open the source code for its Power processor line), http://spectrum.ieee.org/semiconductors/processors/ibm-goes-open-source-on-key-microprocessor; Posting of Phillip Torrone to Make Blog, MAKE, http://blog.makezine.com/archive/2007/08/suns_new_sparc_gpld_open.html (Aug. 8, 2007 08:00) (noting Sun’s decision to open the source code for its new SPARC processor).

39

supply chain problem itself, which creates the relevant vulnerabilities. Such analysis might

assist in uncovering some small subset of those vulnerabilities, but it will never be as valuable as

reducing the incidence of the problem.

2. Bringing down hardware cost to the cost of inputs only helps foreign providers.

Reducing the intellectual property premiums charged by various providers reduces the cost of

manufacturing to basic input costs such as labor and materials and a few additional input costs,

such as that imposed by environmental regulations. Since lower costs for all these inputs is the

core advantage of foreign providers, this policy will do nothing to advantage the American

manufacturers, and will instead more starkly underline the corresponding differences in hardware

pricing.

This argument makes the mistake of assuming that a reduction in the relative price of

domestic and foreign goods is required to make domestic sourcing possible.100 Given that

foreign manufacturers fail to enforce American intellectual property rights as consistently as

American manufacturers, the base assumption of no relative change in costs may even be

incorrect. Several of the countries which are competing with American manufacturers have a

questionable track record when it comes to patent licensing.101 If American hardware

manufacturers are passing on the full cost of the intellectual property of their components, but

99 See generally SAXENIAN, supra note Error: Reference source not found (discussing the progress of Taiwan, China, Israel, and India from Silicon Valley feeder nations to manufacturing bases to design partners).

100 See supra section IV.C (discussing the possibility of using windfall savings to finance regulatory costs).

101 See, e.g., Chip Makers Reach Another Court Settlement, CHINA DAILY, Nov. 24, 2009, http://ip.people.com.cn/GB/152255/10439749.html (detailing the settlement of IP theft claims by TSMC, a Taiwanese manufacturer, against SMIC, a mainland Chinese manufacturer); Press Release, Fairchild Semiconductor, Fairchild Semiconductor Files Patent Lawsuit Against Power Integrations in China (Mar. 2, 2010), http://www.fairchildsemi.com/news/2010/1003/PR_POWI_Lawsuit_China_030310.html (discussing a patent infringement lawsuit filed by Fairchild, an American manufacturer, against Power Integrations, a Chinese manufacturer).

40

foreign corporations are not, then eliminating the unequal intellectual property overhead will

reduce the cost of American goods more and make American manufacturers more competitive.

3. An open source hardware movement would do little to solve the supply chain problem

at the high end of computing. One of the most pressing areas of cybersecurity concern is

protecting military and intelligence computing from malicious code. Alternative architectures

and FPGAs promote cybersecurity only for those hardware applications for which they are a

viable alternative, and many suggest that general-purpose computing, especially that requiring

significant processing power, will never fall into that category.

This argument has some merit. Right now, the mass production of open source CPUs is

limited. While some open source designers may hope someday to see a market-competitive top-

to-bottom open source hardware computer, that day will not arrive in the near term. However,

virtualization increases the likelihood that some individual peripheral ICs or hardware boards

(e.g., graphics devices) can be open-sourced sooner. A solution which increases the resilience of

only a subset of computer components is nonetheless a start.

Moreover, the high-performance computing problem is only one of many cybersecurity

issues. As noted in Section I, military hardware and civilian SCADA systems raise at least as

many concerns. The simple microcontrollers and microprocessors used to operate such systems

are much more likely to have lower processing power requirements. Because individual

industries and the military often require smaller hardware production runs than consumer

hardware manufacturers, they are also less likely to be able to take advantage of economies of

scale in specialization and more likely to be willing to outsource production to midsize

providers. Such consumers are more likely to benefit more quickly from a robust open source

hardware movement.

41

The military has also already taken steps to address the supply chain problem for high-

end computing. The Trusted Foundry initiative pays American manufacturers to create and

maintain trusted fabrication facilities for fabricating high-end computer chips.102 While this

solution addresses the need for trusted chips for the most critical applications, it is not highly

generalizable. Chips built through the trusted fabrication process come at a significant

premium,103 and using such chips in chemical factories, on power lines, or in every piece of

military weaponry would be prohibitively expensive at current prices. Trusted foundries and the

open source fabrication initiative are complementary policies: one addresses the need for highly

trusted high-end computing components, and the other addresses the need for measurably

increased trust in embedded controllers more generally.

4. If hardware platforms diversify, malicious code will proliferate at the virtualization

layer, which may be an even more dangerous outcome. The successful disassociation of

hardware and software in high-end computing applications will require a small set of common

virtualization platforms. Attacking the hardware monoculture simply pushes more of the need

for standardization to the virtual machine layer, and makes it a more tempting target for

malicious code which otherwise would target hardware or software. Malicious code at the

virtual machine layer may be the worst of both worlds: it is nearly impossible to detect from the

operating system, like malicious code in hardware, but it can be written to be more flexible, like

malicious code in software. Proof-of-concept bugs for a virtualization layer have already been

102 See Markoff, supra note Error: Reference source not found.

103 Id.42

presented.104 Encouraging more standardization at that level is asking for a cybersecurity

headache.

As virtualization becomes more common, virtual machines will undoubtedly present a

tempting target. However, it does not present the same danger of imbalance between our own

domestic capabilities and foreign capabilities that the hardware manufacturing gap does. A

hardware manufacturer has a unique ability to implant malicious code in hardware which can

often only be discovered through shaving down the chip, layer by layer – unless the recipient

destroys the microchip, he can never guarantee that it is secure. As more and more chips are

manufactured in a small subset of countries, those on the outside of that manufacturing bloc

simply have to live with that insecurity.

Virtualization, by contrast, happens in a thin layer of software between the traditional

operating system and the hardware. Virtualization software can be tested and replaced before

shipping the final product, and, depending on the implementation, may also be able to be

replaced remotely in the field. Even if all virtualization software were written overseas,

American semiconductor firms would be able to double-check that work before shipping.

Exploitable bugs in the virtualization layer would be a serious problem, but would not present

the same potential for industrial sabotage that the semiconductor manufacturing gap does today.

5. Increasing open source competitiveness creates cybersecurity benefits which accrue to

foreign computer users as well, which does not improve the overall national cybersecurity

posture. Because open source designs are open to all comers, the benefits of diversifying the

hardware layer are available to other nations as well.

104 See Posting of Joanna Rutkowska to The Invisible Things Lab’s Blog, http://theinvisiblethings.blogspot.com/2006/06/introducing-blue-pill.html (June 22, 2006) (discussing a possible means of creating malware undetectable from the operating system by replacing an existing virtualization layer with a malicious hypervisor).

43

It is true that diversifying the hardware layer will make it harder to mount hardware-

based attacks on foreign adversaries. Since the United States is currently at a disadvantage in

inserting such code, given its relative weakness in hardware manufacturing, it would be

worthwhile to take that hit on our cyberattack capabilities in order to enhance our cyberdefenses.

6. This policy fails a cost/benefit analysis. Open source hardware and dynamic chip

technologies are already succeeding in the marketplace. Open source hardware is growing in

popularity,105 and will be given a further boost by the advent of 3D printing technologies.106

FPGAs continue to find use in more and more applications, and subsidizing the production of

small product runs of open source microchips or chips to be used in open source hardware

applications is merely an expensive way to implement a transition the market itself is already

promoting.

These technology transitions are indeed already occurring, but accelerating them would

provide significant cybersecurity benefits. As utilities across the country consider plans to

transition to smart power grids and factory floors start to upgrade their existing SCADA systems

for cybersecurity reasons, there is a boom in secure embedded systems purchasing coming. In

order to ensure that this increased need for microchips is not filled exclusively by hardware using

ICs and designs from foreign providers, the government should offer support to the open source

hardware industry now.

Moreover, the government has intervened in the semiconductor market before, with

significant success despite significant cost.107 Here, the intervention is smaller – retrofitting old

105 See Open Sesame, supra note Error: Reference source not found.

106 See Chris Anderson, In the Next Industrial Revolution, Atoms Are the New Bits, WIRED (February 2010), http://www.wired.com/magazine/2010/01/ff_newrevolution/.

107 See supra notes Error: Reference source not found-Error: Reference source not found and associated text.44

facilities rather than helping build new ones and disclaiming patent rights to preexisting

technologies – and the payoff in increased cybersecurity may be substantial. Compared to the

Trusted Foundry initiative, which subsidizes the continued operation of new state-of-the-art fabs,

this is a minimal investment.

7. Overbuying and sampling may provide a cheaper alternative. For relatively

inexpensive chips, rather than promoting domestic manufacturing, it would be easier to buy more

of a given product than is required for the hardware application and then randomly test selected

chips in the product run for design flaws. Even if such testing is destructive, it is still less

expensive than the alternatives.

This argument has merit; assuming that purchasers of ICs for critical infrastructure

applications can be persuaded to participate in such a testing regime, or required to do so through

regulation, this may be easier than attempting to move the market. Still, it comes with fewer

ancillary benefits to education and innovation than the promotion of an open source hardware

movement, and chip testing is expensive enough that the cost efficiency of this approach is not

immediately clear.

Conclusion

As the Congressional Budget Office noted during the Sematech funding debates, simply

funding dedicated defense-only manufacturing facilities is not a sufficient solution to the national

security challenges posed by the outsourcing of semiconductor manufacturing.108 The United

States must continue to support domestic innovation which spurs demand for domestic

108 See supra note Error: Reference source not found and associated text.45

manufacturing. Promoting an open source hardware movement is one relatively inexpensive

way to encourage that innovation.

Government action to support the development of open source hardware and dynamic

microchips could come in many forms: a public-private partnership like Sematech to manage

fabrication resources, a DARPA Grand Challenge for new computing platforms, an In-Q-Tel like

agency devoted to funding startups, or a targeted release of government IP and out-of-use

commercial IP. No single policy will solve the supply chain problem overnight or over the next

couple of years, but promoting open source would be a positive step towards reinvigorating

American innovation, diversifying computing platforms, and enhancing the national

cybersecurity posture.

46