Counterfeiting creates vulnerabilities in critical infrastructure to cyberattacks – and the risk is increasing

As described earlier, a supply chain is a system of systems. The majority of these systems rely on Commercial Off-The-Shelf (COTS) components, which brings numerous advantages such as the reduction of cost and time to market. Moreover, the use of common components increases the interoperability between the different systems and enhances the adoption of the different related standards, if compared to the use of its own proprietary hardware and software [36]. However, the use of COTS in supply chain can lead to severe security issues. One of the main issues is the use of counterfeit components/products. According to the Agreement on Trade-Related Aspects of Intellectual Property Rights (TRIPS Agreement) the counterfeit trademark goods are those with similar trademarks as the valid ones which makes it difficult to differentiate them from the genuine products [33]. Indeed, COTS components/devices that are supplied via an unauthorized channel, are not authentic, and would fail a sufficiently rigorous validation. Because of financial gain motivations, counterfeiters buy counterfeit components/devices and supply them as genuine products [36]. Therefore, their negative impacts on each of the supply chain links are often an unintended consequence (e.g., system failure). However, attackers can also use them as an entry point to their target. Indeed, by inserting counterfeit components (hardware or software) during system design and development and across the supply chain, adversaries can gain various advantages such as system control for later remote exploitation or the deployment of malware that will degrade or alter the system’s performance, either through presetting or event-triggering [37, 38].

According to the European Organization for Economic Cooperation and Development (OECD) [34], the risk of a consumer purchasing counterfeit goods in the United States or the EU is roughly one in 20 and it increases each year. Indeed, according to [39] the amount of total counterfeiting globally reached $1.2 Trillion in 2017 and is expected to double in coming years. To put that in perspective, it represents almost 2% of everything sold worldwide [34].

When counterfeit goods are unknowingly added to supply chains, parts, sub-assemblies and products can be compromised which endanger future systems and consumers that use them. The counterfeit problem concerns all the supply chains and industries. However, the consequences or impact can vary according to the use case. Indeed, using counterfeit components in aerospace, pharmaceutical, or defense sectors can lead to more disastrous consequences than the use of counterfeit products in watches or game consoles. For example, in Panama in 2006, because a pharmaceutical supply chain was not properly controlled, the use of a counterfeit component of a medicine caused the death of more than 78 persons [40]. In this paper, because all the digital supply chains depend on digital technologies, and therefore mainly rely on the supply chain for electronic devices as Figure 2(a) shows, we focus on counterfeit problem for COTS and electronic devices. Moreover, the scope of this problem is much broader with regard to inner electronic components (e.g., semiconductors, integrated circuits, and so on). Next, we discuss some examples.

The US Department of Justice (DoJ) closed a counterfeiting operation of producing, importing, and selling counterfeit Cisco computer networking equipments consisting mainly of routers, switches, network cards, and secure communication devices[41].These routers power government and companies’ networks all over the world [5]. Therefore, if these equipments contain backdoors or are vulnerable to security issues, all the traffic that go through them can be easily accessed. Similarly, in 2005 X-bit labs reported that forged hard disk drives similar to Maxtor Corps MaXline II HDDs were being sold on the Japanese market [42].

In January 2005, Advanced Micro Devices (AMD), working in cooperation with Taiwanese authorities, seized a total of 60,000 counterfeit AMD microprocessors worth $9.46 million during a raid on an electronics company in Tainan [42]. The latter were intended to be sold and implemented in computers.

All domains can be a victim of some counterfeit parts in the large supply chain process, including the rigorous military sector, which can lead to more disastrous consequences. For example, a U.S. naval submarine base in Connecticut, used more than 33 counterfeit semiconductors in repair works that were intended for active-duty nuclear submarines. These counterfeit circuits were used for radio transmissions, alarm panel, submarines' secondary propulsion systems, and many other repair works [5, 43]. The consequences of the failure of such components could be disastrous. In October 2006, the Government-Industry Data Exchange Program (GIDEP) issued an alert about a counterfeit silicon-controlled rectifier of General Electric (GE) that caused a high failure rate on the Lockheed Martin Missiles and Fire Control [44].

In 2010, VisionTech Components, a Florida-based company, sold 60,000 counterfeit integrated circuits from Asia that went into U.S. Department of Defense (DoD) missile programs, U.S. Department of Homeland Security (DHS) radiation detectors, and U.S. Department of Trans- portation (DoT) high-speed trains [45]. Failures of the Information Technology (IT) systems that deploy these components in such sectors could lead to catastrophic consequences.