Turns out you can create unique signatures from plant DNA. The idea is to spray this stuff on military components in order to verify authentic items and detect counterfeits, similar to SmartWater. It’s a good idea in theory, but my guess is that the security is not going to center around counterfeiting the plant DNA, but rather in subverting the systems that apply, detect, and verify the chemicals.
Peter A. • January 24, 2012 10:19 AM
@PrometheeFeu: indeed this is a problem.
I would assume that the threat was not at the manufacturer itself but at the supply chain. Like various bulk resellers of electronic parts which stock up on parts bought from various manufacturers or other bulk sellers, often multiple times, making the whole chain untraceable, then selling to anyone that wants them, including the military. Within goverment procurment, often the price is the only or major factor in choosing a supplier, so for small contracts (i.e. ordering a small batch of replacement parts) they often end up buying from some intermediary, not directly from a manufacturer, as the manufacurers often sell in large quantities only, or set the price for small batches very high.
Also, in case of parts long out of production, you have to rely on someone having still some stock of them stashed in a dark corner, now completely untraceable, and simply can’t buy directly from the original manufacturer. I think this is where various ‘counterfeit’ parts enter the chain.
There are other issues, like controlling the distribution of the magic DNA paint itself.
PrometheeFeu • January 24, 2012 10:42 AM
@Peter A:
If that’s the problem they are trying to solve, the only way to do it is to have the manufacturers in question (lots of people, many of which are not in the US) spray all their components. That doesn’t sound really likely to happen and if it does, I can’t imagine it will be hard to get counterfeited stuff sprayed.
As for the stashes of old parts, well, they’re out of luck.
Captain Obvious • January 24, 2012 11:18 AM
It seems like this is trying to fix an insecure supply chain (caused by being cheap and so avoiding reputable suppliers) by applying an expensive integrity check.
Just go buy a real iPad from the store instead of the cheap (wooden) one in the McDonalds parking lot.
Mark S • January 24, 2012 2:19 PM
Somehow, all this DNA marking reminds me of grade school: “I licked that apple, it’s mine”.
anonymous • January 24, 2012 2:20 PM
If it can be swabbed off for analysis presumably multiple times throughout the supply chain, it can also be reapplied to the counterfeit items from a legitimate item.
Also, DNA analytical methods operate by duplicating the specimen to test thousands of times over. The agents to effect the replication are readily available to all kinds of laboratories. While in fact it may be difficult to recreate a specific strand from scratch, it sure is not difficult to replicate it once a specimen is obtained.
Clive Robinson • January 24, 2012 5:45 PM
To me it looks like a not particularly good or robust solution looking for a problem it might appear to solve.
I really don’t think people are doing their problem analysis correctly from a sufficiently great distance.
Fundamentaly the problem was the US Government trying to do things on the cheap because they had allowed themselves to fall into a trap of being owned by their suppliers who were basically taking them thus the US tax payer for a ride.
The standard economic solution to “being owned by your suppliers” is to get rid of what put’s the suppliers in a monopolistic or cartel possition. In effect a competative thus open market. The problem with “open” is it does not sit well with various aspects of “National Security” items which require the very opposite of open in the form of secrecy.
The other problem with many “National Security” items is “life time” most consumer products have lifetimes measured in sub five year spans, most NatSec items have product lifetimes that start around twenty five years…
One change the military and others that actualy use NatSec items have not yet caught up to is that technology change is now so fast that many NatSec items are actually compleatly obsolete before the end of their design cycle let alone first production and test cycle. And that the supposed “technology edge” of many NatSec items is now nologer the “bleeding edge” but the “trailing edge” when compared to consumer product technology. That is the average smart phone in a soldiers pocket is way more technicaly advanced than the NatSec kit they draw out of stores…
Something has to change, either NatSec has to get with the conssumer program fully and accept the 18month or less product cycles. Or the Government has to be responsable for not just holding a secure and verifiable inventory of spares but ensuring that they hold sufficient for the entire NatSec item product span…
Anything else is going to be a failure, and to be honest so is attempting to hold a secure and verifiable inventory of spares…
There are other solutions but most suffere from the exponentialy increasing complexity issue…
SMSF • January 24, 2012 6:44 PM
Wouldn’t it be possible for others to counterfeit the plant DNA, as there are only so many plants they could possibly use. They would of have to change their plant DNA non-stop to keep up with the counterfeit. Sounds like a lot of work to me.
Miramon • January 24, 2012 8:56 PM
It’s just a new kind of security through obscurity. The number of “locksmiths” who have the equipment to analyze the DNA marker and to reproduce a sample and install a copy would be vanishingly small at first. But if, say, Iran, came out with this kind of security on their centrifuges, I’m pretty sure someone or other not to be named would be able to reproduce the DNA markers.
I also wonder how easy it is to denature the DNA. It would be a shame if you could just spray formaldehyde or acetic acid on an item and destroy the marker, and if you then did that to a warehouse full of billions of dollars worth of stuff that had to be thrown away because it could no longer be verified…. Also, they’re talking about using it on electronics that may perhaps run very hot in operation. Some kind of acceptance stress test might also destroy the marker.
Daniel • January 24, 2012 11:06 PM
“to me it looks like a not particularly good or robust solution looking for a problem it might appear to solve.”
That fits about 2/3 of the things Bruce blogs about. (Not blaming Bruce there, just the state of the industry.)
Subscribe to comments on this entry
Sidebar photo of Bruce Schneier by Joe MacInnis.
PrometheeFeu • January 24, 2012 9:57 AM
I’m confused by this. Is the claim that people will swap out real for counterfeits at some point in the production process? I mean, what’s their threat model like? I would imagine the counterfeiter sells you the counterfeited part before you have had time to apply the plant DNA spray.