"...and a government might try to induce a manufacturer to remotely brick or backdoor devices in a hostile country in the future, even if the devices weren't ba

"...and a government might try to induce a manufacturer to remotely brick or backdoor devices in a hostile country in the future, even if the devices weren't backdoored at the time they were sold." In my opinion any or all of these are distinct possibilities, especially so during any serious war or conflict. During war anything goes and no serious effort is ever spared (one only has to look at the enormous and successful British efforts to break Enigma during WWII to realize this). Successful hacks to critical infrastructure such as aerospace, nuclear, medical/pharmaceutical technologies, etc. pose both great security risks and a danger to life and it's clear to me that many of the existing protections in place are either inadequate and or are haphazardly applied. Thus, when it comes to the production of both software and hardware for critical systems we need a whole new set of industry-wide manufacturing and security protocols that a both consistent and as watertight as is possible to make them to ensure that hacks (including HW backdoors) are much, much more difficult or nigh on impossible to implement. Furthermore, these protocols would apply to every critical link in the manufacturing chain—CPUs, support chips, software routines, subsystems and a multitude of other componentry. Implementing any new protocols along these lines in the current political and economic climate would be nigh on impossible and I wouldn't anticipate any changes of significance in the immediate future as it would require manufacturers to be much more open about the way they do business. While once that might have been possible—as adrian_b rightly points out in his post†—that's no longer the case. Can you imagine Intel open-sourcing its CPU microcode or Elon Musk providing the embedded source for his company's Tesla vehicles? Not bloody likely! Nevertheless, I'm convinced something along these lines will eventually have to be implemented before we can reduce the breaches and threats to manageable levels. Consider physical bank robberies: they still happen but not with the frequency they one did nor on the enormous scale of present-day electronic fraud for the very reason that over the decades we've developed and evolved methods to make robbing banks a difficult and very risky business for the perpetrator. When it comes to electronic security and cyber crime, we've nothing anywhere near as effective. In effect, we've 21st Century problems and we're still applying Dark Ages solutions. Whilst I'd like to think we could find solutions comparatively soon but I'm nevertheless very doubtful—as it seems to me that nothing short of a command (war) economy (as we had in WWII) where the government mandated both standards and inter-business cooperation would solve the problems. How important is it to harden the security of critical systems further? Clearly, it's very important to do so as the consequences could be dire if we do not. Security breaches could result in electricity grids going down; a hack on the control system of a nuclear reactor could result in another Chernobyl, similarly a hack to avionics could end in a plane crash. As I'm restricted from discussing my experience I'll use a well known albeit somewhat prosaic example to illustrate the point: that being the Volkswagen emissions scam‡. (I say it's prosaic in the sense that its immediate impact isn't as devastating as bringing down a country's electricity grid or the uncontrolled opening of a dam sluice gate that could quickly kill many thousands (that said, I'm not making light of it, what VW did was extremely serious and in my opinion it wasn't sufficiently punished for its crime).) My point is that if universal safety and security standards/protocols that were open and understood by all had been in place during the development and manufacture of the "Clean Diesel" Volkswagen Golf then it would have been essentially impossible for VW to implement the fraud—as too many protections protocols would have been in place to allow it to happen. The point is that a company or any entity should not be able to hide behind a manufacturing process or any other activity whose product thereof has the potential to cause serious harm. Until such time that all such potentially dangerous process can be openly inspected and carefully examined by third parties, we will continue to experience inordinately high numbers of serious security breaches. † https://news.ycombinator.com/item?id=32396390 https://news.ycombinator.com/item?id=32396390 ‡ https://en.wikipedia.org/wiki/Volkswagen_emissions_scandal https://en.wikipedia.org/wiki/Volkswagen_emissions_scandal