Tariffs and Innovation in Cybersecurity
Year of Hacking - 0x17
On April 2nd, 2025, President Trump announced "Liberation Day," where he enacted country-specific tariffs to push foreign nations to eliminate their trade deficit with the United States. Everyone knows this rollout has been disastrous, but how does this impact cybersecurity, a field that deals mostly in networks and software? Let's look at a case study I encountered while working with my smartest friend Evan Cook AKA sh0rtange.
This year, I ran BYU's End of Semester Capture the Flag competition for a second time. sh0rtrange volunteered to create a super cool tool called M.R.A.C.S., themed after the Severance show. The M.R.A.C.S. system has three different keycard interfaces that will teach competitors how to exploit vulnerable access control systems. It also has some radio and NFC challenges. I messed around with it for a bit, and it is a perfect learning tool to get people into this particular sector of cybersecurity. Access control systems are the overlooked fabric in secure environments, and most are dangerously vulnerable, even in the highest security use cases. Teaching beginner hackers how to break into these buildings unintuitively makes these buildings more secure. When we enter the workforce, we'll be equipped to recognize a new threat vector and work to mitigate it.
One of the challenges requires you skim the card around Evan's neck without him noticing, duplicate it, and then "enter" the building, which will give you a flag.
Evan is awesome for taking the time out of his busy junior year schedule to design not only the physical M.R.A.C.S. system but also creating the challenges and being present for the duration of the competition to help competitors get started, troubleshoot, and geek out about access control systems. I’m super grateful he was willing to contribute to the event. He’s barreling towards being one of the most knowledgeable people in the space. You can catch him at the next DEFCON. Hire him.
While the largest expense to get into the cybersecurity industry is typically a decent laptop, things can start getting pricey if you're a bright student or professional who wants to develop a hardware tool,. Americans' ability to import Cheap Chinese Crapâ„¢ has enabled our inventors to quickly and cheaply prototype new products, no matter their financial resources. Cheap materials from overseas have helped keep the United States as the top innovator even after globalization.
What does it mean for national security and innovation if Evan can't access the components used to build prototypes? Immediately, it means that the M.R.A.C.S. doesn't get made, and now he has been robbed of the ability to start a business selling this product. The second-order effects are that the hackers and students that he would teach with M.R.A.C.S. don't get taught, meaning they lose out on a valuable skill in an increasingly difficult job market for new grads. Finally, the most secure and critical sites like NSA datacenters, power stations, Air Force bases, and semiconductor fabs will have weak physical security, opening themselves up to espionage and tampering that can threaten the national security of the United States. It isn't difficult to see the national security impacts of students' and enthusiasts' inability to import Cheap Chinese Crapâ„¢.
The M.R.A.C.S. system wasn't cheap. Evan doesn't have an itemized list of components and costs, so I spent some time gathering a list of prices of all the components to see how the price to build M.R.A.C.S. changed after the tariffs were introduced. I only use MSRP, whatever I can find on Amazon, or other readily available retailers.
By my count, there are 39 different line items involved in M.R.A.C.S. Of that 39, 20 line items belong to the doorsim subsystem, an open-source system that acts as the server for all the different access control systems used. There are two doorsim PCBs in M.R.A.C.S., so the estimated cost is doubled. Evan got some of the components at a discount at our University electronics store. However, we're only going to view this from the angle of a hobbyist who doesn't have the resources of a large research university (Go Cougs!). Because you typically can't buy single digit batches of PCB prints, I estimated that each doorsim PCB costs $10 USD, and bought 10, totaling $100 USD.
The most significant cost is, shockingly, the actual keycards and keycard readers. The High Frequency (HF) card reader costs about $220 USD on Amazon, and one kind of HF card costs about five bucks per, of which he bought about 25, totaling $125 USD. There's also a Raspberry Pi and screen, costing a combined $145.58.
Overall, I estimate the final cost to be $965.60 USD. This number doesn't include some essential tools that competitors could borrow for the competition, like Proxmarks, Flipper Zeros, NFC tags, or Magstripe readers. Now, let's assume that every single line item is made in China and would have the realized 103.3% tariff, estimated by the Peterson Institute for International Economics, applied to them. That takes our final cost of materials up to $1,963.07! About four months' rent for a private room in my town.
What if we want to buy Vietnamese instead? Vietnam is one of the manufacturing powerhouses outside China, and we are their primary export destination. Let's adjust that tariff rate to the 46% announced on Liberation Day for Vietnam:
That's not much better. A markup of $413.27 USD instead of $928.05 USD. Let's try South Korea's 25%. Remember that South Korea is one of the jewels of the American defense network in the Pacific:
A markup of $241.40 USD for buying from a democracy bordering a rogue nuclear-armed state.
If Evan had decided to hold off on the M.R.A.C.S. project until after the busiest year of our degree, he might not have been able to build it on a college student's income. These tariffs will kill American innovators' ability to build tools that keep our country safe. The effect won't be immediate, but over the next four years, hundreds of thousands of broke college kids will choose not to try, not to experiment, and not to build, because beer will be cheaper than Cheap Chinese Crapâ„¢.
