Hacker News Reader

Comment by gouranga | Hacker News Reader

The bit that surprises the fuck out of me is that they're buying stuff in from China. I've never seen that - ever! They would buy expensive stuff fabbed specially in the US rather than import usually.

I did a lot of work for the UK Ministry of Defence and the US Department of Defence over the years on custom silicon and FPGA work and the paranoia factor is scary. We had the layouts of everything bought in - even 74-series logic which can pretty much be assumed to be inert. Samples were regularly decapped and scanned using an SEM to verify to make sure the vendors weren't screwing us or integrating backdoors.

Every part was asset managed to hell as well. Every part was traceable to the point that every finger that poked it was known (I moved from engineering to writing the asset management systems before leaving).

Crazy.

View on HN

I think the problem is that there are too many suppliers. Everyone wants to be a middle-man. If the government asks for domestic parts from it's big contractors, the big ones ask their small ones, and they ask theirs and so on. But at the end of the day someone realizes it's cheaper to outsource it - does so - and forges the documentation. As the part travels all the way back up the chain each one says it's domestic.

The chain is only as strong as its weakest link.

They need custody chain management. I assumed they had one. And everyone who signed for it has securety clearance meaning they signed a paper that basically says "I understand that I'll go to jail for twenty years if I'm caught lying about anything".

...now you tell me. Political candidates should be required to sign the same stuff. And managers. And physicists. And PR stuntmen.

Why physicists?

I think that was meant as a reference either climate change scientists to cold fusion.

I suspect it was just plain old fashioned sarcasm. Not that I'm in favour of sarcasm, ever. Honestly.

There is a problem of enforcing any kind of law or promises on the people at the top:

http://www.youtube.com/watch?v=YRUxmoq1weY

http://www.jeffreywigand.com/7ceos.php

Outing Valerie Plame Wilson as a CIA agent, a 100% treason charge

The chain is audited regularly.

A manufacturer outsourcing stuff has a hell of a lot of documentation to forge. Each screw, each washer, each resistor, has a batch number that it can be traced to.

There is this perpetual balancing game being played. The rules have changed for different US agencies over the years, originally it was only "100% made in the USA" or maybe some select partners (the UK and Israel perhaps) but due to competitive pressures and pricing for a lot of federal products, it's okay to assemble in the US and source parts from where ever. DoD has slightly stronger rules and then really strong rules for some devices.

Bottom line is to make any sort of computer at a remotely competitive price, you're probably going to use some Asian parts. At least some parts. Then it's a matter of where you draw the line and the price vs. risk. How about a Chinese power supply? It all depends on where and how the device is being used. Then it also depends on the system not "promoting" that device to another purpose.

You can manage it all and make it from only 100% trusted sources, but you know what? It's insanely expensive and by the time you get a computer, there are ones on the market 6x better.

Hopefully this isn't too political for HN, but I suggest combining your surprise with the news that China was given a direct line around Wall Street to buy Treasuries directly from the USG:

http://www.reuters.com/article/2012/05/21/us-usa-treasuries-...

There's a relationship here.

I'm not sure I see the problem. They let the biggest debt buyer cut out the middle man. I'm sure there was some backroom dealing going on there, but it seems like the biggest losers there are the middlemen who wound up getting cut out.

The middle man was getting a cut anyway. It was mainly to make China's purchases secrete.

  Primary dealers are not allowed to charge 
  customers money to bid on their behalf at Treasury    
  auctions, so China isn't saving money by cutting out 
  commission fees.

they still aren't secret. stuff like this still shows up on treasury's stats.

>make China's purchases secrete

Sometimes the typos are more fun than the whole thread.

If they were going through (presumably) private middle men, then were their purchases = a matter of public record in the first place?

I'm not sure I can articulate it very well, but my general point regards the access given to core functionality in both military hardware and finance. This doesn't really comport with the US's relationship to China that is portrayed in the mainstream.

Maybe they do not trust the FPGA's being supplied to Wall St.?

Does Wall St. check for backdoors in hardware?

That line is available to any other central bank in the world without going through primary dealers at all - it's just that China is using it to avoid giving info of its UST holdings or buying/selling trends to the open market.

This is especially important now as China has widened the Yuan trading band. You wouldn't want excessive FX volatility to manifest itself as a result of your foreign-reserve management decisions being (mis)-interpreted by investment banks.

> "China was given a direct line around Wall Street to buy Treasuries directly from the USG"

This isn't particularly surprising - several large "real money" investors (pensions and the like) have had this sort of relationship with the Treasury. It enabled them to directly place bids on Treasury issuance without going through Primary broker-dealers (Wall Street). They were called "Directs" and would bid through the "TreasuryDirect" system.

Basically enabled the largest investors in USG securities to bypass the "commissions" other investors would pay to Wall Street firms.

I'm guessing that for some reason foreign accounts such as governments and sovereign funds had not been given access to this system for some reason, and after a point, the Chinese government investment funds (which are some of the largest in the world both in terms of funds managed and funds committed to the US) laid bare the inconsistency that they'd been disallowed this, simply on the grounds of being foreign.

Otherwise unremarkable.

How do you balance that with the post below that the commissions you identify aren't allowed to be charged for these kinds of transactions?

Any and everybody can bypass Wall Street to purchase US Treasury bonds:

http://www.treasurydirect.gov/

There is still a lot of semiconductor manufacturing in the US.

http://en.wikipedia.org/wiki/List_of_semiconductor_fabricati...

The bit that surprises the fuck out of me is that they're buying stuff in from China. I've never seen that - ever!

Where else are they going to get the chips in the quantities required since the US outsourced most of its commercial silicon foundries? Of the few remaining in the US, the largest is wholly owned by the Taiwanese company TSMC. Post-industrial economics is idiotic, and this is one of the major examples of why.

> Post-industrial economics is idiotic, and this is one of the major examples of why.

You say that like the US Military (among other US and non-US government victims) doesn't have the ability to dictate sourcing of parts to the point of driving the growth of domestic foundries.

This looks more like poor decision making, not a fact of "post-industrial economics".

The US military might, but they are not in charge, and the military in general hasn't been in charge ever since the city machine subsumed the war machine.

[edit] Wouldn't claiming that post-industrial economics is not the problem, by suggesting a course of military funded industrial economics as the solution, not be agreeing with the point that post-industrial economics is the problem, even while claiming otherwise?

Senate Armed Services Report: http://armed-services.senate.gov/Publications/Counterfeit%20...

You can get anything made in the US, it just may cost an egregious amount. The military will do it without batting an eye.

We (government contractor) pay a bunch extra to buy tools made in the US - even if they aren't normally manufactured here - just to satisfy the buy US provisions.

Typically what happens is that a subcontractor says it is US made, and then outsources to a foreign country and pockets the difference. Obviously there is money to be made there.

However, that is defrauding the government and those subcontractors can/will/do go to federal prison.

Commercial silicon foundaries, yes, but Intel, IBM, TI, National, etc all still have their own fabs in the US. Also, isn't Global Foundaries building a new fab in New York right now?

I simply do not believe one could find a "back door" looking at a chip in a SEM. It sounds to me like you are describing destructive physical analysis whose purpose is to make sure requisite manufacturing practices are being followed.

The way I read that is that they make the designs and look for circuitry that does not match the designs, which is presumed to be backdoors. I would think that defects and intentional backdoors would both be findable on an SEM. Do you think otherwise? I don't have a ton of experience with bare silicon, so I'd be interested to know if that's unreasonable.

I do think it is unreasonable. With a SEM you only get to look at the surface of things, which is going to be either glass or metal or polysilicon. The only way to see a transistor in a sem is if you chemically remove all the top layers (which are the connections between transistors), or perform a cross section.

In the cross section case you are going to see a few dozen transistors out of the millions in a design of any complexity.

It would be remotely feasible to discover some sort of shenanigans if you knew the exact layout of the design, which would basically mean you are a foundry yourself. In that case you might get lucky and spot some difference between the mask you made, and the mask that was used to produce the part under inspection.

But the scales involved make this not believable to me. It would be roughly like scanning the whole of, say, America, and checking every street and intersection of every town, and comparing it against some known quantity to see if something changed in Springfield Missouri.

Maybe somebody could automate this, but the chemical processes for removing layers is less than perfect. Those strands of metal stretching across the ASIC have some built in tension, and if you remove the layer of glass above them, then tend to spring up and jumble. Good luck trying to do something with that.

This. You've articulated the complexity of looking at circuitry schematics for backdoors better than I ever could.

Just to add... Any "advanced" backdoors take significant silicon and would be visible from the top of the device as a significant design change would be required to accomodate them. Subtle flaws in designs are another thing altogether.

Even then - the manufacturer could supply design documents that surreptitiously include backdoors... there's simply so much to look at when it comes to actual circuit schematics, I can't see how anyone would spot "backdoor" circuitry amongst everything else that is presumably legitimate. I don't know much about silicon, so maybe I'm wrong.

There are companies that specialize in reverse engineering schematics from silicon. It's entirely possible (albeit relatively expensive and time-consuming compared to good old-fashioned industrial espionage) to recover schematics from silicon.

Have a look at this video from ChipWorks http://www.youtube.com/watch?v=Il5sTZKBLO0

See the schematics? They've created those from scratch by deconstructing the chip. (I can say with certainty that this is the case because I'm familiar with the original schematics for this part. The ChipWorks ones are much neater!)

Doing this for a larger, all-digital chip is substantially the same. In that case you can probably step up from identifying individual transistors and identify the standard cells directly, since they tend to have distinctive-looking gate structures.

Reply on news.ycombinator.com