A Homeland Security official confirmed last week that tech components imported from overseas, many of which end up in some of the most popular American gadgets, are often infected with malicious software.
“This is one of the most complicated and difficult challenges that we have,” Greg Schaffer, acting deputy undersecretary at DHS’ National Protection and Programs Directorate, said during a Thursday hearing.
Schaffer was responding to questions from Rep. Jason Chaffetz of Utah, chairman of the House Oversight Subcommittee on National Security, Homeland Defense and Foreign Operations.
“Clearly, supply chain risk management is an issue that the administration is focused on,” Schaffer said when asked how the U.S. was battling this problem. When pressed for details, Schaffer was reluctant to expand except to say, “I am aware that there have been instances where that has happened.”
“The range of issues goes to the fact that there are foreign components in many U.S. manufactured devices,” Schaffer continued. “There is a task force that DHS and DOD co-chair to look at these issues with goals to identify short-term mitigation strategies and to also make sure that we have capability for maintaining U.S. manufacturing capability over the long term.”
Chaffetz expressed concern that the private sector was not in the loop with what the government was doing on this issue, but Schaffer insisted that DHS does indeed consult its private-sector partners.
This is not the first time this issue has been raised. In a 2009 Cyberspace Policy Review, the White House said “a broad, holistic approach to risk management is required rather than a wholesale condemnation of foreign products and services. The challenge with supply chain attacks is that a sophisticated adversary might narrowly focus on particular systems and make manipulation virtually impossible to discover.”
Of course, while “foreign manufacturing does present easier opportunities for nation-state adversaries to subvert products; however, the same goals could be achieved through the recruitment of key insiders or other espionage activities,” the White House said.
“The best defense may be to ensure U.S. market leadership through continued innovation that enhances U.S. market leadership and the application of best practices in maintaining diverse, resilient supply chains and infrastructures,” the administration concluded.
For more from Chloe, follow her on Twitter @ChloeAlbanesius.
