Logic bombs: malicious firmware could sabotage military, security systems.

• Position: SECURITY BEAT

Microscopically small and enormously complex circuits inserted surreptitiously into military or security hardware could potentially turn U.S. weapons against their users, warned one of the nation's leading experts on the threat.

[ILLUSTRATION OMITTED]

Altered circuitry, also known as "malicious firmware," can lie dormant in a piece of electrical equipment for several years until it recognizes a high degree of mobilization and lets loose a "logic bomb" on the system, said Scott Borg, director of the U.S. Cyber Consequences Unit, a nonprofit research institute.

"The logic bomb could shut down the larger information system or, worse, turn the equipment controlled by the information systems against those operating the equipment," Borg wrote in an Internet Security Alliance report, "Implementing the Obama Cyber Security Strategy Via the ISA Social Contract Model."

When asked at a press conference whether such an incident of sabotage had ever taken place in the United States, Borg said, "I can't comment on that."

The Obama administration acknowledged the problem in the Cyberspace Policy Review, which was released in May.

It is important to remember that inserting such technology into a U.S. weapon system is much harder than inserting malicious software, Borg said. It is expensive and time consuming to infiltrate a supply chain. Nation states may have the means and wherewithal to insert such technology, though.

"They are very interested in targeting hard-to-access systems, such as highly protected military, intelligence and infrastructure facilities," the report said.

Such firmware could be installed in the design, fabrication, assembly, distribution or maintenance phases of the supply chain.

If caught, a nation might be subject to boycotts of its...