The Observatory: The Policy on Detecting Counterfeit Electronics
The Observatory is a new weekly series that brings together students, alumni, and professionals associated with OSU Battelle Center to write about topics that are relevant to the mission of our center. Our guest writer this week is our first industry professional contributor to the series, Dr. Katie Liszewski. Dr. Liszewski is a mathematician working on next generation anticounterfeiting and hardware security technologies at Battelle Memorial. Over the past 5 years she has published and presented several papers on novel algorithms and process optimization techniques for detection of counterfeit electronics. Her interests include quantifiable security, automated experiment design, and functional imaging of electronics. Dr. Liszewski is writing as an individual in this piece, not as a representative of Battelle Memorial.
NASA recently added clarity to their contract language around avoiding the use of counterfeit electronics. This is a follow-on to a storied (at least in the government contracting realm) FAR 52.246–26 clause, an attempt by the US government to mitigate the risk of counterfeit electronics entering their systems through contractor acquisition.
These pieces of legislation are a result of a 5+ year trend of increased awareness and concern of counterfeit electronics in DoD systems. Both the DoD and the contractor community appreciate this concern and the legislation comes at a time when counterfeiters are getting increasingly sophisticated and pervasive. However, I call the FAR clause “storied” as the field of counterfeit electronics detection is still an active research community with no clear standard as to what is a legally and technically adequate attempt at detecting counterfeit electronics, particularly advanced counterfeits flooding the market in the past few years.
By introducing requirements for elimination of counterfeits rather than specific test standards, the DoD is effectively requiring the community to choose an appropriate level of risk reduction. Until the mid-2010s, counterfeit electronics were largely used or remarked devices. Parts brokers sourcing obsolete or difficult to find components through untrusted third parties would test for incorrect markings, damage, or signs of alteration. These tests are well standardized and well understood. However, over the past several years so called cloned devices, devices manufactured from the ground up by counterfeiters, and fourth shift devices, genuine devices which did not pass through quality control, have taken over the counterfeit market as manufacturing is more scalable than reclamation of used devices. To counter these new threats, several detection strategies involving some manner of electrical testing, which is capable of detecting functional rather than just structural differences, have evolved. However, cost/benefit analysis for such methodology is still in its infancy. Electrical tests are complex and individualized to each device usually by the original manufacturer. A parts broker meanwhile may have little documentation to compare a device against or even assess test coverage. Further, customized testing for counterfeit detection is unscalable; a single test house examines thousands of different types of components in a year. Quantifiable risk mitigation in the presence of cloned devices is thus an open problem.
While the FAR 52.246–26 has so far allowed some leeway for new test methods to evolve, NASA’s language shows increasing definitiveness. Considering the potential years of testing required for a space worthy system, NASA is among the agencies most frequently forced to purchase obsolete electronic components. This combination strongly encourages the acceleration of both technical and standards development for counterfeit electronics testing.
