Counterfeit Avoidance and

Detection

A Continuing Journey

Bob Bodemuller

Principle Supplier Quality Engineer

LaTasha Starr

Systems Engineer, Business Development

Can You Tell the Difference?

Commodity by Manufacturer’s Suggested Retail Price

2014 PercentCommodity MSRP of Total*Watches/Jewelry $ 375,397,333 31%Handbags/Wallets $ 342,031,595 28%Consumer Electronics/Parts $ 162,209,441 13%Wearing Apparel/Accessories $ 113,686,295 9%Pharmaceuticals/Personal Care $ 72,939,399 6%Footwear $ 49,522,859 4%Computers/Accessories $ 26,652,422 2%Optical Media $ 18,780,989 2%Labels/Tags $ 17,675,452 1%Toys $ 8,178,351 Less than 1%All Other Commodities $ 39,273,404 3%

Total FY 2014 MSRP $ 1,226,347,540 Total FY 2013 MSRP $ 1,743,515,581Number of Seizures 23,140 Number of Seizures 24,361

Data from:

Intellectual Property Rights

Seizure Statistics

Fiscal Year 2014

Source by Manufacturer’s Suggested Retail Price

FY 2014 Percent

Trading Partner MSRP of Total

• China $ 772,629,008 63%

• Hong Kong $ 310,437,365 25%

• Canada $ 12,460,242 1%

• India $ 20,683,669 1%

• United Arab Emirates $ 3,791,268 Less than 1%

• Taiwan $ 3,081,838 Less than 1%

• Singapore $ 2,538,079 Less than 1%

• Korea $ 2,514,596 Less than 1%

• Vietnam $ 2,422,050 Less than 1%

• Kenya $ 2,292,982 Less than 1%

• All Others $ 108,639,461 9%

• Total FY 2014 MSRP $ 1,226,347,540 Total FY 2013 MSRP $ 1,743,515,581

• Number of Seizures 23,140 Number of Seizures 24,361

Data from:

Intellectual Property

Rights

Seizure Statistics

Fiscal Year 2014

China and Hong Kong

made up 88% of 2014

seizures

Sources of Electronic Counterfeit Parts

* China photos courtesy of Tom Sharpe & SMT Corporation ** Photo courtesy of Basal Action Network

*Stacks of Scrapped Circuit Boards *Components Being Washed in River

**Components Being Removed From Boards

* Bags of Various Components*Components Being Sorted*Market Place for Components

This flow illustrates how counterfeit parts can be sourced and eventually sold.

Anything that can be counterfeited … will be…

Why is this issue so difficult?

• Aging systems resulting in obsolescence

– Diminishing Sources for parts / Continuing production of old product lines requires careful tradeoff of risk of counterfeit vs. cost to mitigate

• Economic

– Cost

– Schedule pressures

• International sources

– Authentic parts manufactured in Asia (Fabless model)

– Profitable and growing capability to counterfeit

– Organized crime

• Counterfeits more difficult to detect

– May not affect fit, form or function

– Tests, visuals and failure analysis may not detect counterfeits

Counterfeiters are good & getting better …

They are fast and agile …

Electronics Supply Chain

Electronics Market Mall

Shenzhen China

Electronic Supply Chain

• Original Manufacturers

– OCM

– OEM

– Aftermarket Manufacturers

• What about distribution?

– Authorized distributors

– Broker Distributors

– Stocking Distributors

– Third-Party Logistics (3PL) Providers

– Others

Electronic Supply Chain

IP Holder -

Designer

Authorized

Distribution

Independent

Distribution(Trusted Supplier)

CustomerOEM

Obsolescence

Cost

Schedule

OCM

Grey Market

Typical Counterfeit Entry Points

IP Holder -

Designer

Authorized

Distribution

Independent

Distribution(Trusted Supplier)

CustomerOEM

Grey Market

Obsolescence

Cost

Schedule

Clones

Mimics

Counterfeiters

RMA

Excess production

OCM

KNOW YOUR SOURCE

Entry points indicated by

red lines

LEGISLATIVE CLIMATE

Per the Semiconductor Industry Association counterfeits cost U.S.

semiconductor companies more than $7.5 billion annually in lost revenue,

and the loss of nearly 11,000 American jobs

Senate Armed Services Committee

• 2011 Levin McCain Hearings

– Sen. Carl Levin, D-Mich, Committee’s Chairman

– Ranking Member Sen. John McCain, R-Ariz

• Found a total number of suspect electronic counterfeit

parts in 1,800 cases exceeded 1 million parts

– U.S. Air Force said that a single electronic parts supplier, Hong

Dark Electronic Trade of Shenzhen, China, supplied

approximately 84,000 suspect counterfeit electronic parts into

the DOD supply chain

Senate Armed Services Committee

1. China is the dominant source country for counterfeit electronic parts

that are infiltrating the defense supply chain.

2. The Chinese government has failed to take steps to stop counterfeiting operations that

are carried out openly in that country.

3. The Department of Defense lacks knowledge of the scope and impact

of counterfeit parts on critical defense systems.

4. The use of counterfeit electronic parts in defense systems can compromise

performance and reliability, risk national security, and endanger the safety of military

personnel.

5. Permitting contractors to recover costs incurred as a result of their own failure to detect

counterfeit electronic parts does not encourage the adoption of aggressive counterfeit

avoidance and detection programs.

6. The defense industry’s reliance on unvetted independent distributors

to supply electronic parts for critical military applications results in

unacceptable risks to national security and the safety of U.S. military

personnel.

7. Weaknesses in the testing regime for electronic parts create vulnerabilities that are

exploited by counterfeiters.

8. The defense industry routinely failed to report cases of suspect counterfeit parts, putting

the integrity of the defense supply chain at risk.

Conclusions

Legislative Actions

• Section 818 of the 2012 NDAA

• DFARS 252.246-7007 - Released May 2014

• FAR 2012-032 – Higher Level Quality Contract Requirements

– Released November 2014

• FAR 2013-002 – Expanded Reporting of Nonconforming Items

– On hold per DARC director to complete study regarding feasibility of

changing GIDEP since 3/17/15

Pending Regulations

• DFARS 2014-D005 – Further Implementation

– Defines Trusted and Trustworthy suppliers

• DFARS 2015-D020 – Trusted Suppliers for Electronic

Parts

– … establishes qualification requirements to identify trusted

suppliers

• DFARS 2016-D010 – Cost of Remedy for Use or Inclusion

of Counterfeit Electronic Parts

– Defines the allowability of costs … that may be required to

remedy the use or inclusion of counterfeit parts.

• DFARS 2016-D013 – Amendments Related to Trusted

Suppliers

– Makes contractor and subcontractor identification and use of

contractor-approved distributors subject to review, audit

and approval by DoD…

DFAR 252.246.7007 Criteria

System Criteria

1. Training

2. Inspection and test

3. Processes to abolish

4. Traceability

5. Procurement controls

6. Reporting and quarantining

7. Identification and evaluation of suspect counterfeit

8. Systems to detect and avoid (e.g. AS5553)

9. Flow-down

10.Process to keep informed

11.Process for screening GIDEP report

12.Control of obsolete electronic parts

DFAR is 19 pages long in the Federal Register

– 2/3 pages of requirements

– 16/17 pages of interpretation

INDUSTRY STANDARDS

Technical Standards History

• SAE formed the AS5553 writing committee, now

known as G-19CI, to address counterfeit

electronics– Industry and Gov. approached SAE to develop an industry

consensus standard for electronics

– Published in early 2009

– Intention was to provide information and guidance, not necessarily

requirements

• AS5553 targets Primes, system integrators, etc.

G-19 Expansion

• Industry recognized the electronics

supply chain is extremely complex– OCM

– Authorized Distribution

– Independent Distribution

– Aftermarket manufacturer

– Stocking Distributor

– Broker

– ????

• Identified need for standards to cover

various parts of the supply chain

Prime Customer

Technical Writing Committees Formed

• G-19– G-19A Testing AS6171

– G-19AD Authorized Distribution AS6496

– G-19C Compliance Various

– G-19CI OCM, System Integrators, etc. AS5553

– G-19D Independent Distribution AS6081

– G-19T Definitions TBD

• G-21 Materials AS6174

Standards look in review view mirror.

Potentially give counterfeiters the

blueprint for detection

CLONING – NEXT STEP IN

COUNTERFEITING

AND AN INTRODUCTION TO THE CYBER

SECURITY CONNECTION

What is a Clone?• A group of anything that are descended from and identical to

that of a parent something

• Used legitimately to manufacture obsolete electronics using the

original designers IP

• Used illegitimately to copy a design for profit

– Reversed engineered

– Parts are newly manufactured

– Probably do not have the reliability of the original design

– Indistinguishable from the original

• Visual

• Electronically – at least at ambient

• Can contain malicious circuits!

How Can Clones Affect Us?

Target Effect

Energy Power Grid Outages

Military Limited Operational Availability

Internet of Things Compromised Response Times

(Fire, Police, Communication)

Malware

Malicious

Intent

Sources

Understanding The Risks

• Electronic devices performing critical functions – Telecommunications

– Transportation

– Defense

– Energy

– Health

– Others

• Internet shopping – personal or business– Hardware has to be properly analyzed during acquisition and qualification

phases of the supply chain.

• Can you validate electronic components they contain. – Any device could be equipped with a software or hardware backdoor

• Decline in the use of authorized dealers– Cost

– Schedule.

Potential Dangers

• Loss of mission from poor reliability

• Backdoor into systems

Cloned

iron or

tea pot?

Malicious Intent

• Breaking services, obtaining them with piracy

• Imitating user authentication for system access

–

• Information leakage

– Business

– Personal

• Unlocking devices, to gain access to an internal

shell or to increase control of a system

• Unlocking hidden features

Backdoor Into Systems

• Manufacturing backdoors;

– malware

– software and hardware

– embedded radio-frequency identification (RFID) chips and memory

– Company IP theft

– Identity theft

• Eavesdropping by gaining access to protected memory

• Inducing faults causing interruption of normal behavior

• Hardware modification tampering with invasive

operations

• Gain malicious access to systems

Attack Method

Prevention

• Prevent the insertion of hardware backdoors

– Know your sources

• Implement prevention methods in different phases of

production:

– Design - Create trusted circuits

– Fabrication – Use of trusted foundries

Prevention Is Key

Detection

Early Detection

Trusted Foundry Program

• Initiated in 2004

• Ensure mission-critical systems have access to

integrated circuits from secure, domestic sources

Should you use the Trusted Foundry Program?

• Is your program mission critical or essential to national security or

national defense?

• Do you worry about the alarming number of counterfeit microelectronics?

• Do you want to protect your system against backdoor access or other

deliberate mischief?

WHY DO WE CARE?

Why Do We Care?

• ICC estimates counterfeit goods were worth $650 billion in 2008

• By 2015, ICC expects the value of counterfeit goods globally to

exceed $1.7 trillion.

– 2% of the world's total current economic output

• “Phony medicines”

– Can result in the deaths of people using them

– medicines with insufficient doses can lead dangerous

pathogens to become resistant to legitimate drugs.

• Examples of counterfeit or mislabeled products having fatal

consequences

– Toxic cough syrup in Panama

– Tainted baby formula in China

– Fake teething powder in Nigeria

"When the toy that you thought was from Disney contains lead

paint, then you care."

Why Do We Care?

• $5 Million worth of fake degrees and diplomas for fake schools

– None of the colleges had any faculty or courses

– Associate Degree was $475, a Bachelor’s Degree was $495, Masters

Degree was $525, and a Doctoral Degree was offered for $550

• Cigarette smuggling causes $50 Billion in lost tax revenue to

governments around the world

• Counterfeit vodka operation that was managed by the Irish

Republican Army (IRA)

– Fake alcohol from Eastern Europe and filled empty bottles with

counterfeit alcohol

• A 10 day crackdown against counterfeit drugs coordinated by

Interpol in May 2014 lead to 8.4 million doses of fake drugs.

– 10,603 websites that were selling counterfeit medicines were shut

down.

Traditionally industry systems and methods were not designed to

detect deliberate and deceptive product alterations

Threat is Real & Growing …Prevention Methods must Out Pace the

Threat

Continue to Evolve, Educate, Communicate & Enforce Prevention

Measures

Engaging with Customers & Industry to Develop the Most Effective,

State of the Art Prevention Measures Possible

Hardware qualification is crucial as Microcircuits and firmware are

present in every device around us, from our cars to sophisticated

defense systems.

Summary

Questions