What Supply Chain Security REALLY Means

[Opinion] How the $280 billion CHIPS & Science Act relates to exploding pagers in Lebanon

Good Evening from Taipei,

I wasn’t planning to write any more this week. But exploding pagers, and their weird Taiwan connection, prompted media outlets to reach out for my views. I turned down those requests because I didn’t really know what to say: it’s complicated.

In fact, there’s a very real link between the news I broke on Tuesday about TSMC Arizona and the detonation of electronic devices in the streets of Lebanon half a world away.

You see, TSMC was pushed, prodded and cajoled into building its Arizona factory against its better judgment. We all know by now that founder and godfather Morris Chang thought the idea is barmy, and he’s right. But Pat Gelsinger and a cohort of US industrial and political leaders felt strongly that US taxpayer money should be put forth to subsidize the construction of semiconductor factories on American soil under the mantra: Supply Chain Security.

TSMC wasn’t the only one who got some of that dough. Intel and Samsung also got a hand out. Today, Intel is a slow-motion trainwreck and Samsung isn’t faring too well in Texas, either. Ironically TSMC, which didn’t really want to be there and faced some early hiccups, is embarrassing its rivals with success at Arizona.

If chips are made in America, goes the thinking, then the US would have a more-secure supply chain which isn’t vulnerable to Turmoil in Taiwan, which includes earthquakes, typhoons, power outages and the increasing belligerence of Xi Jinping (will he? won’t he?).

But, here’s the thing. Once those fresh new wafers full of Apple A16 SoCs come out of the oven in Arizona, they’ll be popped onto a Boeing and sent straight back to Taiwan. The final stages of testing, slicing and packaging will be done in Taiwan — likely at TSMC facilities, but theoretically fellow-Taiwanese ASE could also do the job.

Once the chip is fabbed, tested, and packaged it’ll continue its journey. It might stay in Taiwan, or it might go to China, India, or Vietnam where it gets put onto a printed circuit board. Then it’ll head to Shenzhen or Zhengzhou in China, or over to India, for final assembly alongside the battery, the camera module, the screen and lots of other stuff.

Of course, it’s not Apple doing the work but Taiwan’s Foxconn and Pegatron. Wistron is exiting the business, India’s Tata is getting into the game, and China’s Luxshare-ICT and BYD are now on the list. Lots of names, lots of people handling the product.

So, before an iPhone even leaves the factory, we have that one chip — made in America’s taxpayer-funded Secure Supply Chain — tour three or four countries, handled by half-a-dozen suppliers, and pass through the hands of dozens of workers. Then there’s all the other components. All told, Apple has more than 180 suppliers working from over 430 sites across the globe.

Let me point out that Apple is both the most transparent major electronics brand in the world, and possibly the most secure. The company is fanatical about security. I don’t know anything about pager maker Gold Apollo, but I feel confident saying it’s not anywhere near as strict with security as Apple.

The New York Times has a deep dive into Gold Apollo, an Israeli front called BAC, and the process by which wads of explosive PETN was installed into thousands of devices before landing on the hips and pockets of targets in Lebanon. What’s interesting isn’t how sneaky Israel was, but how damn easy this whole intercept was to pull off. To me, it begs the question of why this wasn’t attempted sooner.

So when people talk about supply chains, they’d do well to remember the cliche about being as strong as the weakest link. If the US wants to keep spending money to build expensive chip factories because it makes people feel good, then go ahead. If $280 billion is the price to pay for photo ops and “Made in America” marketing campaigns, then so be it.

But, exploding pagers ought to be a wake up call about the challenges of Supply Chain Security.

In the context of manufacturing, security means two things: ensuring the product is what you expect it to be, and ensuring you get enough of it when you need to. Electronic devices are made in numerous countries at dozens of sites because no single place, not even China, can do it single-handedly. There’s certainly no way the US can go it alone, so let’s take that off the table

Instead, if people truly want a secure end-to-end supply chain, then they need to engage with those trusted countries that build, maintain and operate the global intellectual and capital infrastructure which makes global commerce possible. A Made in America slogan won’t get them there. And $280 billion won’t even get close.