- Open source hardware initiatives including RISC-V, the Open Compute Project, and Open Radio Access Network technology are described as moving toward de facto standards for core digital infrastructure.
- The report argues that OSHW could commoditize the hardware stack from microprocessors to servers and routers, potentially disrupting incumbent hardware firms headquartered in the United States and friendly nations.
- Hardware-layer vulnerabilities, including hardware trojans, can be difficult or impossible to resolve through software patches and may require costly removal and replacement of affected components.
- The paper says IoT, cloud, edge computing, and cyber-physical systems could magnify OSHW risks because critical infrastructure increasingly depends on embedded semiconductors and networked devices.
- The report identifies China as especially positioned to capitalize on OSHW because of its electronics manufacturing role, official embrace of open source technologies, and legal requirements for firms to support state directives when requested in intelligence matters.
This report examines open source hardware (OSHW) as an emerging national cybersecurity risk, focusing on RISC-V microprocessor architecture, the Open Compute Project for servers and data centers, and Open Radio Access Network technology. It argues that as open source principles migrate from software to hardware, commodity components could become de facto standards for critical digital infrastructure, IoT, cloud, telecommunications, and cyber-physical systems. The paper draws on the author’s research, conversations, site visits, and firsthand observations from meetings with government officials, industry, academia, and technology firms from 2000 to 2022, along with cited studies and examples. Its principal finding is that OSHW can lower costs and spur innovation, but may also create hardware-layer attack vectors that are difficult to detect, trace, or repair through software patches. The report emphasizes potential risks from hardware trojans, opaque supply chains, and production in countries of concern, especially China, which it says is positioned to benefit from commoditized electronics manufacturing and open standards. Policy relevance centers on the paper’s call for a U.S. response: national security reviews, a Center for Open Source Technology Security, hardware-level standards, stronger supply-chain disclosure, possible import restrictions, and greater R&D funding for hardware-based cybersecurity and traceability.
The new open source hardware paradigm presents a cybersecurity threat vector for which we are unprepared.
SCSP
- Ensure the U.S. Government is organized to mitigate cybersecurity threats from OSHW. The DHS and DOD should undertake a national security review of OSHW initiatives and identify vulnerabilities.
- Set strong minimum rules and certification procedures for OSHW cybersecurity and verification. U.S. authorities should develop standards to ensure cybersecurity at the hardware level and work with industry.
- Require technology firms servicing critical infrastructure to disclose open source hardware used. Firms must disclose open source hardware used in their servers and networks, including detailed supply chain data.
- Block OSHW components produced in countries of concern from U.S. critical infrastructure. U.S. authorities should conduct an investigation into OSHW produced in countries of concern as a step toward blocking imports.
Published by the Special Competitive Studies Project. Co-publishers and external authors, where they exist, are credited in the byline above.