I haven’t done adequate due diligence yet - could be inaccurate
I came across this article alleging that Germany is considering bailing on the F-35 aircraft because the US can remotely disable them.
If the US could do this to German F-35s, presumably they can do it to ours…
Additional reporting alleging concern in Canadian defence circles
Nothing in the article backs up the headline claim. The closest it gets is their quoted expert saying that he worries about the US doing to the F-35 what they’re doing to Ukraine. He’s almost certainly referring to the fact that parts and software updates are produced by the US, who could choose to withhold them, just like they’re withholding aid from Ukraine.
Every serious defence analyst has laughed at the idea that the F-35 has a secret killswitch. This would be the dumbest thing ever to include in an aircraft, because there is always the possibility that your enemies could find out about it.
Consider; if an F-35 kill switch did exist, any buyer of the craft could invest the resources required to go over every inch of circuit and line of code and find it, and then deactivate every US F-35. It would be more of a liability for them than it is for us. And, equally, our experts could simply patch around the killswitch on our planes. Nations like Canada and Germany are not lacking in technical expertise.
This bonkers notion seems mostly to be rooted in the broader fear that the F-35 is somehow “too advanced”, an idea that largely springs from the diseased brain of Pierre Sprey (seriously, if you chase down every bad thing said about the F-35, odds are ridiculously high that Sprey said it first). Sprey also believed that the ideal design for a modern attack fighter has a machine gun, no missiles, no computers, and no radar.
I’m not joking, not even slightly. Pierre Sprey wanted the modern world to fight Russia with planes that had no radar.
There are valid concerns to be raised about the idea of adopting a craft whose supply chain is centred on the US. That’s a discussion that NATO partners should be having. But this “killswitch” nonsense just derails that important discussion into paranoid conspiracy theorist nonsense rooted in the deranged ramblings of a self-aggrandizing madman.
just cryptographically sign the kill switch transmission. the fighter would contain the public key to verify, but enemies would need the private key to trigger it, which the NSA would keep buried in cold storage like the DUAL-EC-DRBG trapdoor key.
you’d probably also want to include the fighter’s serial number or IFF transponder code, so the enemy couldn’t capture or replay.
there’s something like 100M LoC of C++ (not Ada 😥) in an F-35. and Canada doesn’t have the sources, so they’d have to decompile that. maybe they could focus on the radios, radar and other devices direct connection to receivers, but the implant might be downstream, and there’s a lot of ways to hide an antenna.
even dumping the chips isn’t easy. many of them likely have security features, since they contain classified algorithms which the DoD would rather enemies not be able to extract from the downed wreckage of a fighter. certainly the JTAG pins are not going to be enabled. even die shots could be frustrated by metal meshes over the wafer or possibly even microscopic amounts of explosives triggered by de-lidding.
there’s secure ways to build a kill switch, there’s an abundance of places to hide it in a highly complex fighter, and this kind of spooky stuff is well within the NSA’s wheelhouse. it’s the kind of thing NSA is known for, even - the Crypto AG CIA front, the DUAL-EC-DRBG backdoor, TAO’s clandestine program to intercept and backdoor mailed routers and servers. they clearly can do this kind of thing, since they clearly have before.
did they backdoor the F-35? I don’t know, but it’s plausible, and CSIS/CSE should investigate.
There has to be some kind of direct connection between the communications systems and the flight critical systems for any of that to even be remotely plausible. That kind of connection is basically impossible to hide, and simply would not exist in a well designed piece of military hardware. It’s existence would be immediately obvious to the people buying the plane, and the people tasked with maintaining it.
Show me one single military analyst with worthwhile credentials who believes this is a serious concern. Not articles like this one where they take a quote wildly out of context and use it to backup an entirely fabricated claim. I mean an actual certifiable expert stating clearly and unambiguously that the possible existence of this killswitch is something we have to be worried about.
Buyers do not get source code either. Israel gets a special version with no US software control.
deleted by creator
The whole rumor kinda smells like a disinformation campaign designed to drive even more wedges between the US and the rest of NATO, TBH.
Honestly, it mostly just sounds like more fear mongering about the F-35, which has been going on for ages, and is mostly a Russian disinformation campaign. Pierre Sprey - the originator of all the F-35 criticisms that routinely get handed around - is very regularly a paid guest on RT and other Russian state controlled news outlets.
Basically Russia is really scared of the F-35 program and would much rather their enemies keep flying upgraded fourth gen fighters. If the US was selling the F-22 to the rest of the world you’d be hearing all the same noise but about that plane instead.
And yet, intelligence agencies do that kind of thing all the time. If they’re sure only they have the key, or if they can patch it out of their own planes, the risk is pretty low. Which defence analysts are you thinking of?
Nobody can point at proof it’s there, but I’d be surprised as hell if it’s not, so at least I’m not looking for extraordinary evidence.
This is a good breakdown of both the mythical nature of the killswitch claim, and the actual real concerns that we should be talking about, in regards to the US tight control over the supply of firmware updates and parts for the F-35: https://theaviationist.com/2025/03/10/f-35-kill-switch-myth/
This is a really good and detailed look at the supply chain issues and what exactly those US updates do, thanks.
It doesn’t actually debunk anything about the “killswitch myth”, though. It pretty much just uses it as a prelude for the other stuff.
The problem here is that any serious debunking of the myth basically goes the same way; “No, that’s stupid, no one would do that.”
It’s the proving a negative issue. The internals of the F-35 are not something that anyone is at liberty to discuss, so anyone who wants to wildly speculate about what could be in there is free to make up whatever they want, and anyone in a position to prove them wrong is legally unable to do so.
But the idea simply does not pass the sniff test. You’re talking about handing these weapons over to advanced nations with access to serious technical know how, and just rolling the dice that none of them ever discover it before you get a chance to use it. And that’s assuming the idea is even plausible. It’s not like you can just ping this thing like a fucking router. It’s not flying around advertising its IP address. It was built to be a stealth aircraft; that means, among other things, removing all extraneous external communications. And there’s literally no reason to connect any part of the critical software to the external comms and every reason not to, given that the US’ enemies are pretty damn good at cyberwarfare. That would be a crippling vulnerability for a weapon system like that.
Basically, the reason no serious commenter believes a killswitch exists is because we simply do not build combat aircraft in a way that would allow a killswitch to exist.
But please feel free to show me an actual quote from someone with serious defence tech credentials saying otherwise. So far, I’ve not seen any.
Would they be updated by sneakersnet, then? I guess that would make sense, but the only difference is that it would take slightly longer for data to arrive.
It is a negative issue, so the only thing to consider is how plausible it is. It would be easy for them to push a malicious update, I assume that’s not in dispute?
Try to think about what you’re actually describing. It’s one year from now. Tensions between the US and Canada have steadily and rapidly escalated. US troops are massing on the Canadian border under the guise of “training exercises”… And some guy in the RCAF is like “Shit, better not forget to run that new firmware update that the Americans pushed for us, and absolutely no one else.” Is that the scenario we’re envisioning here?
No, in that situation we just wouldn’t do an update. I’d be more worried about a backdoor that’s triggered by not updating for an extended period, maybe along along with a few other hints, and was actually made with the possibility of the Iranians capturing an F-35 in mind.
More like, it’s a year from now and Trump decides to take his ball and go home, so he directs the NSA and DIA to build an update that will brick planes which aren’t parked in one of his favoured countries, after a delay of about a month to ensure he gets as many as possible.
At which point you would roll back to the previous firmware, because of course we’re going to keep copies. This sounds like a horrifically ineffective plan. We’re certainly better off having fifth gen fighters with that incredibly minimal risk attached than we are with fourth gen fighters that are completely outclassed.
And again, if we’re at the point where potential hostilities are close enough that a one month timebomb could matter then we’re at the point where we’re not loading any software the US sends us.
The far more meaningful risk here is that they can simply stop giving us new parts and software updates. That’s actually a real and valid concern.
Are you telling me NSA is incapable of adding in a backdoor that would pass German/Canadian inspections? Zero day backdoors by definition are undiscovered
There’s no such thing as a “zero day backdoor”. You’re conflating “backdoor” with “zero day exploit” which are entirely separate things.
And its not a question of whether or not the NSA is capable of doing that. It’s whether they’re capable of doing it in a way that they would absolutely 100% certain could never be discovered.
But more importantly, as I pointed out elsewhere, in order for it to even be possible for such a backdoor to exist, the entire aircraft would have to be designed in a way that was hilariously, outrageously and inconceivably unsafe to operate. You simply do not link mission critical system to external communications systems that are in operation while a vehicle is airborne. Such a design flaw would be immediately obvious to the people whose job it was to approve the purchase, because there’s no way you connect up systems like that in secret. While the US might supply the parts, it’s still our guys who maintain them and integrate them into the vehicle.