Open-source hardware could defend against the next generation of hacking

Open-source software isn’t inherently or automatically more secure. But it creates more possibilities, and market pressure, for improving security. Just as when choosing a safe to store a secret document in, customers must decide – should they pick a system whose security is vouched for by the company that makes it, or a system that can be explored, examined and tested?

Open-source software users choose not to trust a program unless they can verify it independently. Many of them don’t have the expertise themselves to be able to evaluate security claims, of course – but they can wait until consumer-protection groups do so independently, hire a verified expert to check things out, or even learn the skills needed to investigate for themselves. They could even decide to pay for a version of the software that has been checked out and is supported by experts.

Security with open-source hardware
Open-source hardware offers users the same choice. Many people who buy electronics have no idea what’s inside them. Even technically sophisticated companies like Amazon have to hire outside forensic experts to be sure of exactly what is in the hardware their companies rely on.

Open-source hardware would mean each device’s designs and components would be open for public view at any time. People could study the information, follow the directions to build a device, test it and distribute it – or even sell it. All that transparency would give attackers more data about their potential targets, for sure. But it would help customers downstream much more, by giving them the means to verify their own devices’ security themselves.

This does not mean people would be left to build their own hardware. The open-source software movement has found a number of opportunities for entrepreneurs and innovators to sell systems and services based on software that itself is free. For instance, 90 percent of the companies on the Fortune Global 500 list pay for a brand-name version of the open-source Linux operating system from Red Hat, a company that makes billions of dollars a year for the service they provide on top of the product that can ostensibly be downloaded for free. The open-source hardware movement is not yet as mature as its software counterpart, but it could catch up fairly quickly.

The future of distributed manufacturing
Making open-source hardware systems more available increases regular people’s security by giving them verifiably secure options. If someone is especially concerned, they could even manufacture their own electronics. There are a wide range of designs already publicly available on sites like Hackaday, Open Electronics and the Open Circuits Institute. There are also many communities based on specific products like Arduino.

Even open-source chips are gaining traction. It’s already possible for people to build electronics that are open-source from the chips all the way up to the physical components. If hardware hacks become more common, that may be a key way for people to protect their cybersecurity. Companies and governments can also be expected to adopt policies that favor open-source hardware and require better testing to ensure their equipment is safe to use.

Joshua M. Pearce is Professor of Materials Science and Engineering, and Electrical and Computer Engineering, Michigan Technological University. This article is published courtesy of The Conversation.