Computer Hardware (CS 141) – Spring 2022

Module Topic: Hardware Backdoors and Responsibility
Module Author: Eliza Wells

Course Level: Upper Level Undergraduate
AY: 2021-2022

Course Description: “This course introduces fundamentals in designing and building modern information devices and systems that interface with the real world. It focuses on digital devices and systems, and it complements ENG-SCI 152, which focuses on devices and systems that use analog electronics. Topics include: combinational and sequential logic; computer architecture; machine code; and altogether the infrastructure and computational framework composing a MIPS processor. Consideration is given in design to interactions between hardware and software systems. Students will design application specific hardware for an embedded system.” (Course Description) 

Semesters Taught: Spring 2021, Spring 2022

    Tags

Module Overview

This module focuses on hardware backdoors, which allow agents to bypass normal security measures on a device. Hardware backdoors can be created by malicious agents, corporations, or governments, and pose security threats to users, while being difficult to detect. The first question the module asks is: is it ethical to create hardware backdoors? The module shows students how security risks like those posed by hardware backdoors threaten users’ rights, and asks what kinds of reasons would count as a strong justification for disrespecting those rights. The second question is: how should we respond to the possibility of hardware backdoors? Given that hardware backdoors pose significant threats but are difficult to detect and prevent, the module encourages students to use their moral judgment to think about the responsibility they have to protect rights as computer scientists.

    Connection to Course Material

The topic of this course is hardware design. The backdoors discussed in the module exploit design features in microprocessors that students have learned about. Hardware backdoors pose different threats than better-known software backdoors, one of which is that they are more difficult to test for. Being aware of these threats is important for future work that students may do in hardware design.

Goals

Module Goals

1. Discuss rights and strong justifications for disrespecting rights in the context of security ethics.
2. Introduce the possibility of hardware backdoors and the threats they pose.
3. Practice using moral judgment in response to hardware backdoors in different cases.

    Key Philosophical Questions

1. Why is cybersecurity ethically important?
2. What rights are at stake in cases of hardware backdoors?
3. What is a strong justification to disrespect a right?

Materials

    Key Philosophical Concepts

• Rights
• Strong justifications for disrespecting rights
• The right to autonomy

    Assigned Readings

• Andy Greenberg, “This ‘Demonically Clever’ Backdoor Hides in a Tiny Slice of a Computer Chip,”

Implementation

Class Agenda

1. Introduction to security ethics: backdoors in one’s house
2. Rights and strong justifications to disrespect rights
3. Cybersecurity ethics: hardware backdoors
4. Discussion of the right to autonomy and how hardware backdoors can threaten it
5. Is it ethical to create hardware backdoors? Discussion of cases.
6. How should we respond to the possibility of hardware backdoors? Discussion of case.

    Sample Class Activity

Students were presented with several different cases in which they imagined themselves either a) considering whether to create a hardware backdoor or b) considering whether or not to test for hardware backdoors. They were asked to discuss in small groups how that choice might impact users’ rights to autonomy, whether there was a strong justification for making that choice, and what they thought they ought to do and why.

Case example:

You are an engineer at a small company that does not have many resources for testing and customer support. You are considering installing a hardware backdoor to bypass user authentication because that will allow you to more quickly test updates to your product and resolve customer issues remotely.

    Module Assignment

The assignment was a short essay response question on the final exam that was another version of the activity. Students were given the following case and questions.

You are the CEO of a large company that provides motherboards to tech companies. In order to produce the motherboards more cost-efficiently, you are considering using hardware that is manufactured in several different facilities overseas. Testing hardware for backdoors is expensive and time-consuming and may not catch everything.

• What are the potential consequences of this choice?
• What rights are at stake?
• What do you think you should do, and why?

Lessons Learned

• Students were engaged with module content and were able to bring out the situational dimensions of corporate or government decision-making. In discussion of cases, it was helpful to emphasize the different options that agents have: one reason why it’s difficult to find a strong justification for creating hardware backdoors is that they’re often not the only means to one’s end.
• One issue that came up in discussion was the idea of informed consent, and whether hardware backdoors would be acceptable if users were aware of their existence and the risks. Future modules could focus more on consent as a way of understanding how these backdoors relate to rights.
• The question of what burdens computer scientists ought to shoulder to test for hardware backdoors given the ethical issues they face was interesting to the class Students could be better positioned to tackle this question by considering the ethics of risk.
• Since students are more likely to be in the position of encountering already-instantiated backdoors than the position of choosing to create one, focusing more on this question could be productive.