For more, check out the previous Standing Panel on Technology Leadership meeting here.

When Paperwork Replaces Physical Reality

Across the United States, thousands of local utilities, healthcare facilities, and municipal networks face a quiet crisis that rarely makes headlines. The digital hardware running our water treatment plants, power substations, and emergency communication systems is not what we think it is.

Independent assessments reveal a troubling pattern: approximately 65% of delivered devices do not match what the customer believed they purchased. This is not always the result of sophisticated nation-state tampering. Often, it is the consequence of razor-thin manufacturing margins where suppliers quietly substitute memory chips, microcontrollers, or network components during distribution without disclosure. In other cases, counterfeit parts and unauthorized physical modifications bypass procurement oversight entirely.

The root cause is not a lack of rules. We have compliance frameworks, Hardware Bills of Materials, and security attestations. The problem is that these mechanisms rely on paperwork rather than physical verification. As Angela Brescia, co-founder and CEO of Synderys, emphasized during a recent National Academy of Public Administration panel, “Hardware verification should be treated as a security control going forward and not just a paperwork exercise. We need to have tangible trust.”

The NAPA panel, titled “Technology Leadership Standing Panel Session on Hardware-Level Cybersecurity”, was skillfully moderated by Dr. Alan Shark and explore what happens when a critical device contains unverified silicon and when static compliance becomes theater. We are accumulating massive technical debt across foundational infrastructure, and our current governance model is failing to protect the public interest.

The Frontline Reality: Small Utilities, Big Threats

The vast majority of our critical infrastructure is not operated by large federal agencies with dedicated cybersecurity teams. It is managed by local water districts, rural healthcare hubs, municipal power cooperatives, and small-to-medium enterprises. These frontline organizations are expected to defend against global threats with limited budgets, minimal technical staff, and procurement guidance that assumes expertise they do not possess.

As Dr. David Mussington, Professor of the Practice at the University of Maryland and former CISA executive, pointed out during the discussion, the frontline challenge centers on “the water and wastewater treatment plant in, name your county or state in America, that are given instructions on what to do to deal with tech debt in their infrastructure. They know it's legacy, it works, but they're told it's vulnerable on what they should do. And they are then supposed to do what with the accepted equipment list that they don't have so that they can procure trusted equipment that they can't define.”

This is not a failure of intent. It is a structural mismatch between the speed of technological change and the capacity of our governance systems to respond. As Dr. David Bray, Chair of the Accelerator and Distinguished Fellow with the Stimson Center noted during the panel, we rarely ask state governments or local governments to buy surface-to-air missile launchers to defend themselves against nations, yet “we find that perfectly OK to do in cybersecurity… something's wrong here.”

Waterfall policymaking which takes years to craft static mandates cannot keep pace with commercial technology cycles measured in months. By the time new compliance frameworks are finalized, the threat landscape has already shifted.

Bobbi Stempfley, NAPA Fellow and senior security executive at Dell Technologies, captured the operational mindset required to fix this: “I come at this topic from the point of view of someone who just likes to get stuff done.” She emphasized that instead of expecting small entities to become hardware experts, we must focus on “finding the best ways to have the technology do the reporting, not the paper do the reporting.” 

Three Strategic Take-Aways for Public and Private Sector Leaders

1. Transition from Paperwork Compliance to Continuous Hardware Interrogation

Leaders must recognize that static certification provides zero visibility into physical tampering that occurs in transit or during distribution delays.

Organizations should deploy automated, non-destructive verification tools that validate silicon integrity before equipment is connected to operational networks. This capability must not remain a single point-in-time assessment. Maintaining continuous independent verification and validation across the operational lifecycle ensures that hardware anomalies are detected before they compromise critical missions.

As Brescia emphasized, “All these things we've been talking about are possible. The chipset level verification, the things that we need to increase our confidence in our hardware.”

2. Mobilize Technical Assistance and Shared Risk Frameworks for Frontline Entities

The vast majority of our critical infrastructure is operated by local utilities, municipal water districts, rural healthcare hubs, and small-to-medium enterprises. These frontline organizations rarely possess dedicated cybersecurity engineering teams, yet we expect them to defend against sophisticated global threats.

State and federal leaders should establish shared technical assistance networks, such as expanding cyber reservist initiatives and supporting state-based information sharing organizations like the Multi-State Information Sharing and Analysis Center.

As Stempfley noted, accessible guidance is vital: “The production of a playbook that we can put in the hands of procurement helps us scale the people side of this.”

Dr. Mussington underscored the foundational nature of this challenge: “I think that education is a huge part of this.” Beyond technical assistance, building workforce capacity and organizational literacy around hardware security is essential if frontline entities are to make informed procurement decisions and manage infrastructure risk effectively.

3. Build Market Incentives That Reward Provable Hardware Provenance

Real resilience cannot be achieved through government mandates alone; it requires aligning market incentives so that vendors are rewarded for verifiable security.

Boards of directors, procurement executives, and insurance underwriters should establish a visible “halo effect” for technology providers that offer cryptographically verified hardware provenance. When buyers demonstrate a willingness to pay a reasonable premium for provable integrity over lowest-cost bidding, market competition will drive manufacturers to eliminate opaque component substitution.

Dr. Bray emphasized the importance of cultural change in cybersecurity: “Right now in cybersecurity, there is not a culture that rewards finding things.” Organizations need to shift from blame to preparedness, ensuring they have the equivalent of seatbelts and airbags when inevitable incidents occur.

A Networked Path Forward

Securing our shared future is ultimately a people problem and a collective action opportunity. When government assumes the private sector will solve technical debt, and industry assumes government will provide protection, both fall into paralysis.

As moderator Dr. Shark framed the challenge at the opening of the NAPA panel, we need to pay attention to all that goes on inside the things we take for granted. We do not need to solve every problem at once, nor should we wait for a catastrophic failure to motivate proactive investment. By focusing on our most critical nodes, deploying automated verification tools, and fostering trusted networks across the public and private sectors, we can build infrastructure that is truly resilient.

The technology exists to verify our systems, protect human agency, and secure our communities. The work begins now, and it begins with intentional collaboration.

Many thanks to Kate Kellen for helping to produce these important events!