Articles by SAE International

ABSTRACT: Consensus has been elusive between industry and government on the new Rule enforcing anti-counterfeiting wording in National Defense Authorization Act for FY 2012, Section 818. An immediate practical step is needed to address what is threatening to become an impasse on the issue. Adoption of an authenticity marking standard represents a specific way in which the industry can begin to comply with the new Rule. This need not be a definitive recipe, but can be delivered as guidance. Nor does this need to be holistic from the start; this is may begin as partial and practical, and will evolve and grow as the Federal and supplier working relationship against counterfeits grows. Without losing the flexibility of the current Rule, and without trying to impose an unworkable single solution, the government can establish ways industry can move forward right away.

The Federal Registry has published it. Every major stakeholder has commented on it. The Office of Secretary of Defense has been preparing internally for it. And a definitive Rule proposed in DFARS Case 2012-D055 is now due to be published in September.

The shouting, in sum, should be over.

But if anything, the noise level is higher than ever.

The uproar is over the National Defense Authorization Act of Fiscal Year 2012, Section 818, requiring that suppliers implement a systemto monitor and prevent counterfeit electronics. That legislation and the DFARS Rule which will partly implement it- which we will call Rule D055--has been a storm center from the beginning, and continues to rage to this very day. No sooner was the ink dry on the NDAA FY '12, signed by the President at midnight, December 31, then the Council of Defense and Space Industry Associations (CODSIA), began pleading for more consultation and more deliberation time, warning that the new legislation would "reshape the entire defense industrial base." Today, a year and half later, as Rule D055 emerged for public comment in June, important groups such as AIA continue to argue for longer deliberations, and more guidance.

Yet, with renewed worry in national security circles about sabotaged parts hiding in the vast sea of counterfeits, the threat has begun to cast, if anything, a more threatening and immediate shadow. The DoD Defense Science Board noted urgently in January, 2013 that "there is a nexus between cyber threat and relabeled and counterfeit hardware in DoD systems. Both DoD and industry counterfeit mitigation efforts should be developed further in conjunction with DoD cyber defense efforts." With these concerns pressing harder than ever, neither the Department nor Congress seems in a mood to "deliberate" for very long before even beginning to take action.

Moreover, the Department is clearly focused on "prevention and early warning," as the "primary" defense against counterfeits, (see Under Secretary Frank Kendall's April 26, 2013 memo "DoD Counterfeit Prevention Policy.") a proactive and strategic approach for which the industry is almost certainly not ready. As one spokesman for an industry group put it: "…my guess is there will be very few companies that will be able to comply from day one."⁴

In this paper, we propose practical steps to break out of this seeming impasse.

The industry viewpoint

For all the warnings of clear and present danger, counterfeiting is a complicated issue, that is certain. There is undoubtedly no one-size-fits-all solution for a $300 billion industry, whose products range from advanced, custom-designed microcircuits, to the tiny single-minded diode. That is one reason why Rule D055 has clearly been designed with flexibility in mind and in some ways has seemed to steer away from specific solutions and best practices, qualities that naturally grate on and confuse the industry. Is it possible to prescribe specific steps while still maintaining the flexibility needed to regulate such a formidable industry? We believe it is.

What is at the heart of the industry's objections to Rule D055? It is fundamentally the perception that, as written, the relevant language in the Rule imposes a penalty-driven, and not incentive-driven regime.⁵ The industry believes no exit is being offered from its financial liability for rework and replacement costs, no safe harbors like those which do exist for civil and criminal liability. No matter how rigorous are its measures and systems, the industry seems to assert, it still risks liability in a variety of scenarios. For medium to smaller concerns, this is posed as an existential concern: firms are worried they simply will not be able to survive in such a regulatory climate.

To oversimplify perhaps, the industry is looking for a regulatory regime which rewards contractors for doing the right thing, and does not mainly rely on setting out draconian consequences for doing the wrong thing.

This is compounded by a lack of specifics in Rule D055. While best practices have been set forth in the industry, such as SAE's AS5553, there is no reference to them in the Rule. So the "right thing"-the tests for effective "anti-counterfeit systems" called for in the Rule, steps which are acceptable to OSD--are seen as not well defined.

Also, industry observers notice that Section 818 calls for a "risk-based" approach to eliminating counterfeits, targeting first and primarily the most vulnerable and sensitive parts. But the Rule gives no guidance about how its suppliers can phase in anti-counterfeiting measures based on risk.

The good news, we think, is this: to the extent that contractors are looking for a practical solution, for immediate steps which will be acceptable to OSD, and are not simply foot-dragging, we think there are indeed practical actions that can be advocated by the Department. And we believe the Department is searching for such actions. As a senior official expressed to this author at a recent public hearing, industry buy-in and consensus is a foremost goal for the Department.

Without losing the flexibility of the current Rule, and without trying to impose an unworkable unitary solution, the DoD can establish ways that the industry can move forward right away. These need not be a definitive recipe, but can be delivered as guidance. Nor do these need to be holistic from the start; they may begin as partial and practical, and will evolve and grow as the Federal and supplier working relationship against counterfeits grows.

As we advocate below, we think a standard authenticity marking protocol for electronic parts, of the highest security and stability, can be such a step. A authenticity marking program has been thoroughly tested by DLA, and, because it involves quarantine of suspect parts, is inherently preventative. Authenticity marking is already cited in the NASA Reauthorization Act of 2012, as a way of enforcing a trusted or approved electronics manufacturers list.⁶

Common Ground?

Let us attempt to summarize the contours of possible common ground:

Industry expressed need:

• Guidance: best practices and practical steps
• Consultative role in shaping guidelines
• Rule flexibility based on varying commodities, production flows, industry segmentsMove from strict liability/punishment regime to incentive-driven regime
• Risk-based approach

OSD expressed need:

• Urgent actions based on continuing spike in counterfeits in military supply chains, and immediate threat of sabotage through cyber exploitation
• Rule flexibility by allowing industry to lead
• Industry buy-in and consensus
• Primary emphasis on preventative and early warning systems
• Offer specific ways in which the industry can immediately begin to comply, yet allow this guidance to evolve and grow.

A marking protocol as a practical step

In October 2012, SAE published our white paper "Traceability in the Age of Globalization, A Proposal for a Marking Protocol to Assure Authenticity of Electronic Parts." In this paper we called for an industry and OSD-backed standard for a mark that would assure the originality and identity of electronic parts. The mark could be implemented by various technologies and would not be geared to any one vendor, as long as the information delivery-the assurance of originality-was uniform and the platform chosen was at the highest level of quality, including stability and security.

This mark is not seen as a serialized identifier, such as the IUID standard, although the two are not exclusive. It aims to remain as simple and therefore effective as possible-a robust, uncopyable mark which assures the origin or the immediate source of a part. We believed then and now that there is a benefit to solutions which are quickly practicable, tested, and proven. We wrote:

We believe that such a standard for marking to origin for high reliability electronics is possible and necessary; more, it is the order of the day. Success depends first and foremost on the quality of the mark, especially its absolute resistance to malicious back-engineering and reproduction. The mark itself must not be counterfeited. There are those who say that may not be possible, but we think we can demonstrate that it is. In a more visionary sense, if our defense industrial base can produce ballistic missiles which can intercept others in mid-flight, surely we can accomplish this.

Marking standards are far from marginal in electronics. Indeed, one could say that they have been at the center of standards proliferation for decades. 2-D bar code marks and other machine-readable marks have become critical to traceability and transparency in electronics, MIL-STD-130 provides detailed marking guidance, and the IUID standard has been an approach. The table below lists marking standards already playing a key role in government and industry:

Industry Specification & Guidelines
International Standards
ISO/IEC 16022	Bar Code Symbology Specification - Data Matrix
ISO/IEC 15415	Bar Code Print Quality Test Specification - Two-Dimensional symbols
Automotive Industry Action Group (AIAG) Standards
B-1	Bar Code Symbology Standard
B-4	Parts Identification and Tracking Application Standard
B-13	2D Symbology White Paper
B-14	Guidelines for use of Two-Dimensional Symbols with the B-10 Trading Partner Labels
B-17	2D Direct Parts Marking Guideline
U.S. Dept. of Defense (DoD) Standards
MIL-STD-130	Identification Marking of U.S. Military Property
Air Transport Association (ATA) and International Aerospace Quality Group (IAQG) Standards
ATA Spec 2000 Chapter 9	Automated Identification and Data Capture
AS9132	Data Matrix (2D) Coding Quality Requirements for Parts Marking
NASA Standards
NASA-STD -6002	Applying Data Matrix Identification Symbols on Aerospace Parts
NASA-HDBK -6003	Application of Data Matrix Identification Symbols to Aerospace Parts using Direct Part Marking Methods/Techniques
Electronics Industry Association (EIA)
EIA 706	Component Marking
EIA 802	Product Marking

We believe that the time for such a marking standard specifically to mitigate the risk of counterfeit electronics, has come.

Today, the Defense Logistics Agency has taken the lead in anti-counterfeiting practices with a program of four initiatives including use of SigNature DNA marking. The program should be explored and leveraged by DoD; it provides ample evidence and rich experience in the benefits of a marking standard.

Tomorrow concrete steps can be taken by both industry and government. On the industry side a standards committee perhaps under aegis of SAE, could be tasked with the job of creating an authenticity marking standard. We would hope that OSD could then make it clear that exploring such a standard is it in its area of favorable consideration for compliance with rule DO55. Simple effective steps can begin the job of moving toward an elusive, but critically necessary public and private sector alliance on this watershed issue.