By Jane Lanhee Lee
OAKLAND, Calif. (Reuters) – When Silicon Valley chipmaker Marvell learned that one of its chips was found in a Russian surveillance drone recovered in 2016, it set out to investigate how that came to be.
The chip, which costs less than $2, was shipped in 2009 to a distributor in Asia, which sold it to another broker in Asia, which later went out of business.
“We couldn’t trace it any further,” Marvell Technology Group Ltd Chief Operations Officer Chris Koopmans said in a recent interview.
Years later, it reappeared in the drone recovered in Lithuania. Marvell’s experience is one of a myriad of examples of how chipmakers lack ability to track where many of their lower-end products end up, executives and experts said. That could stymie the enforcement of new U.S. sanctions designed to halt the export of U.S. technology into Russia.
While higher-end sophisticated chips that can build supercomputers are sold directly to companies, lower-cost commodity ones that might just control the power often go through several resellers before they end up in a gadget.
The global chip industry is expected to ship 578 billion chips this year, 64% of them “commodity” chips, said TechInsights’ chip economist Dan Hutcheson.
While Russia accounted for less than 0.1% of global chip purchases before the sanctions, according to the World Semiconductor Trade Statistics organization, new Western sanctions underscore the threat in human terms.
“All those drones we’ve seen were not armed,” said Damien Spleeters, deputy director of operations at the European Union- and Germany-funded Conflict Armament Research group, which found the chips in the drones.
“Some of these drones that we have documented, like the Forpost, are now used in their armed version in the current conflict” in Ukraine, he said.
The report that prompted Marvell’s tracking work published late last year by the Conflict Armament Research also found chips in Russian drones from Intel, NXP, Analog Devices, Samsung Electronics, Texas Instruments, and STMicroelectronics.
Texas Instruments and STMicroelectronics did not reply to Reuters for comment; NXP and Analog Devices said they comply with sanctions; Intel said it’s against its products being used for human rights violations; and Samsung said it does not make chips for military purposes.
Military weapons such as drones, guided missiles, helicopters, fighter jets, vehicles and electronic warfare equipment all need chips and experts say they often use older chips that are well tested out. Now, under new U.S. sanctions even some of the most basic chips cannot be shipped to prohibited Russian entities.
For the most sensitive chips, controlled under the International Traffic in Arms Regulations, the U.S. company selling them can be held responsible if the chip ends up with an entity on the U.S. banned list, said Daniel Fisher-Owens, a specialist on chips and export control and at law firm Berliner Corcoran & Rowe.
‘LIKE THE DRUG BUSINESS’
Figuring out where chips go is like tracking the flow of narcotics, experts say.
“It’s like the drug business,” said James Lewis, director of the technology policy program at Washington-based Center for Strategic and International Studies. “There’s cutouts. There’s middlemen. There’s money laundering … There’s a black market distribution network.”
The point of the Russian sanctions, Lewis said, isn’t to track every chip, but to disrupt their supply chain, which the intelligence community has been working on.
Finding a solution could take creative technical approaches.
“Knowing where the chips go is probably a very good thing. You could for example, on every chip put in essentially a public private key pair, which authenticates it,” and allows it to work, Eric Schmidt, the former Google chairman, told Reuters in a recent interview, discussing high-end processors.
Marvell says it has a growing number of products supporting fingerprinting and tracing, and is working with industry partners and customers to advance this area. The Global Semiconductor Alliance has proposed its members work on building a “Trusted IoT Ecosystem Security” https://www.gsaglobal.org/iot/ties to tag and trace chips, said Tom Katsioulas, technology executive at the industry group.
That may be a lot harder to do for a $2 chip, without making it prohibitively expensive. The answer could be a matter of manufacturing process, regulation and, perhaps, will.
“Ironically, the technology to do this, all of the things that we’ve got in there, the blockchain, the IDs in the device, this has all been done before for other applications,” said Michael Ford an executive at Aegis Software who is working with the industry standards group IPC for better supply chain security. “All that is needed is that catalyst to make it happen.”
Russia’s invasion of Ukraine could be that catalyst, he said.
(Reporting By Jane Lanhee Lee; additional reporting by Paresh Dave and Alexandra Alper; editing by Peter Henderson and Nick Zieminski)