State-Level Cyber Espionage Efforts and Hardware Backdoors
While software-based backdoors (such as Trojan horses) are more common and relatively easier to detect, the real major threat is posed by hardware and cryptographic backdoors.
Kaspersky's Global Research and Analysis Team (GReAT) experts reported that cyberattack rates in the META region remained stable in the first quarter of 2025 compared to the previous quarter, while in the Middle East, over 57,000 mobile attacks were recorded, representing a 43% increase. Photo by Anadolu Images.
W
ith the advancement of the digital age, international relations and power struggles have shifted from the physical realm to the virtual world, taking on a new and complex dimension. The conventional intelligence gathering methods of the past have now been replaced by far more complex, difficult to detect and wide-ranging cyber espionage activities. One of the most critical fronts in this new arena of conflict is the chips, hardware, and software at the heart of the technological devices that are indispensable parts of our daily lives.
States’ desire for technological superiority and information dominance drives them to embed hidden backdoors even in the most innocent devices we use, fundamentally shaking the global technology landscape and the international security paradigm. This practice is evolving beyond a niche intelligence tactic and moving towards the centre of geopolitical competition. This process, spanning from the physical hardware manipulations of the Cold War to the systemic compromise of today’s software and supply chains, presents a dilemma for states.
The impact of the quest for information dominance on national security
A backdoor, in its most basic definition, is a method designed to provide covert access to a system by bypassing normal security controls. These deliberately placed mechanisms aim to provide persistent and privileged access, even after the initial security vulnerabilities have been patched. In state-sponsored espionage activities, backdoors can be divided into three main categories: software, hardware, and cryptographic. While software-based backdoors (such as Trojan horses) are more common and relatively easier to detect, the real major threat is posed by hardware and cryptographic backdoors.
A hardware backdoor embedded in a device’s microchip or factory firmware operates below the operating system level, making it nearly impossible to detect with software-based security measures. Installing such a backdoor is highly costly and difficult, as it requires intervention in the supply chain during the design or manufacturing phase. However, it offers the highest level of persistence and stealth.
At this point, the argument that the pursuit of absolute information dominance through backdoors creates a paradoxical scenario that makes nations using these methods more vulnerable gains significance. A state that installs backdoors in technological infrastructures to monitor its rivals also renders its own infrastructure more vulnerable to similar attacks. For the backdoor created inevitably becomes an entry point for criminals, terrorists and hostile states as well, dragging everyone into greater insecurity. This situation erodes global security while ushering in a new and more dangerous era of technological conflict.
From the Cold War to the digital age
The roots of modern digital espionage activities lie in intelligence operations during the Cold War. The physical hardware manipulations of that era served as a model for today’s complex cyber-attacks and supply chain interventions. One of the most striking examples from this period is Operation Rubicon, in which the CIA and the West German BND secretly took control of the Swiss encryption machine manufacturer Crypto AG.
Thanks to this operation, which lasted for decades, the secure communications of more than 120 countries were illicitly intercepted and read. While secure machines were sold to NATO allies, weakened and easily breakable versions were sold to neutral or hostile countries. The Crypto AG operation established the playbook for covertly taking over a trusted global supplier, weakening most of its products, and using the intelligence gained for diplomatic and military advantage. Another significant case from the Cold War era is the crypto wars of the 1990s and the famous Clipper Chip initiative.
In 1993, the U.S. government proposed a hardware chip that would be mandatory for secure voice communication and would contain a backdoor known as a key escrow. Under this system, each chip’s unique key would be stored in two separate government agencies, and law enforcement could access these keys with a court order to decrypt communications. However, this proposal failed due to significant backlash from civil liberties advocates and the technology industry. The failure of the Clipper Chip’s overt, legally mandated control mechanism prompted intelligence agencies to pursue more covert and deniable methods to undermine encryption. The public crypto wars of the 1990s did not end; they merely went underground.
Actors and strategies in global cyber espionage
Today, cyber espionage and the use of backdoors have become a global phenomenon. All major intelligence services have concluded that the most effective method is to be invited in through a compromised trusted product or update, rather than infiltrating a target’s network from the outside. This tactical convergence is creating a universally fragile and unreliable technological ecosystem. In the United States, Edward Snowden’s revelations documented how the NSA systematically built backdoors into the global digital ecosystem through programmes such as PRISM and BULLRUN.
Through the PRISM program, the NSA collected user data directly from the servers of major US internet companies, while the BULLRUN program attempted to undermine encryption standards. One of the most notorious examples is the NSA imposing Dual_EC_DRBG, a flawed random number generator, as a standard and being able to break the encryption of countless products thanks to the cryptographic backdoor in this algorithm. It has also been revealed that the NSA’s Special Access Operations unit physically interfered with network equipment destined for export to install backdoors.
Chinese telecommunications giants Huawei and ZTE have been viewed as a national security risk due to allegations that their equipment may contain backdoors accessible to the Chinese government. China’s 2017 National Intelligence Law, which compels all organisations to cooperate with state intelligence, has heightened these concerns. Although no definitive evidence has been made public, these allegations have led many countries to ban Huawei equipment from their 5G networks.
On the other hand, it is known that Russian state-sponsored groups, particularly in the SolarWinds case, infiltrated software supply chains, putting thousands of government and corporate networks at risk. Furthermore, allegations that Russian-made Kaspersky antivirus software has the potential to be used as a spy tool demonstrate deep mistrust of software originating from strategic rivals. Finally, the Pegasus spyware developed by the Israeli NSO Group is one of the most dangerous examples of the ‘spyware as a service’ model. Sold to governments, this tool has been widely used to target journalists, activists and political opponents, highlighting the risks of the privatization and proliferation of state-level surveillance capabilities.
Supply chain security and the importance of Turkey’s National Technology Initiative
All these examples demonstrate that today’s global technology ecosystem presents a security dilemma in which no country can fully trust another’s technology. Any intervention in any link of the supply chain, from the design to the production, distribution and updating of hardware and software, has the potential to fundamentally undermine national security. While the US voices its concerns about China’s Huawei, its own physical backdoor installation in products from companies such as Cisco highlights the hypocrisy in this area and the fierce nature of the struggle. This situation is pushing countries towards cyber/technological balkanization (cyber-balkanization, internet-balkanization, splinternet), protectionism and, most importantly, a race to develop sovereign domestic technological capabilities.
In this new era, where national security is directly linked not only to military power but also to technological independence, the importance of Turkey’s strategic vision, exemplified by its National Technology Initiative, is increasing. The use of domestic solutions in critical infrastructure, the defense industry, and public services constitutes the most effective line of defense against cyber espionage and hardware-based backdoor threats. Strict controls at every stage of the supply chain, increasing domestic chip production capacity, and training qualified human resources in the field of cyber security will be the cornerstones of Turkey’s efforts to solidify its sovereignty in this technological war. For in the 21st century, full independence is achieved through digital sovereignty.
(Originally published in Turkish by Kriter)
