US FPGA supply chain faces China-linked availability and security risks
The US FPGA supply chain lacks security and resilience against disruption; Chinese legacy-node semiconductor expansion increases both availability and security risks across defense, telecom, and AI sectors.
Sourceatlanticcouncil.org — open the original
What to check
- Applies to
- Whether this concerns you is not assessed; the names the report mentions are listed below.
Field-programmable gate arrays (FPGAs) are specialized, reprogrammable semiconductor chips critical to US military systems (F-35, Javelin missile), cloud infrastructure (Microsoft Azure), automotive (Volvo EX90), and 5G telecommunications. Unlike leading-edge logic chips, FPGAs have 20+ year product lifecycles and operate at legacy process nodes (16–28nm), making them fundamentally different from the semiconductors addressed by recent US policy like the CHIPS Act. The Atlantic Council report identifies three primary supply chain risks: cost (vendors prioritizing price over security), availability (geographic and supplier concentration, potential disruption from Taiwan-based foundries, PRC regulatory decisions), and security (complexity enabling hardware/gateware tampering, insufficient security investment). US firms prioritize cost minimization, significantly underinvesting in security resilience. China's ongoing buildout of legacy-node manufacturing capacity will reduce costs but introduce additional availability and security risks, particularly given PRC control over production and potential for supply restriction or compromised hardware. The report recommends four policy interventions: establish a government data-sharing hub for FPGA supply chain intelligence, invest in long-term FPGA security measures, stockpile critical FPGAs for military and commercial use, and conduct cross-sector supply disruption planning coordinated by DoD or Commerce.
Source reporting: https://www.atlanticcouncil.org/in-depth-research-reports/report/to-secure-reprogrammable-chips-the-us-must-address-supply-chain-risks
Free public brief. The indicators are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs