From Fab to Table: Liberty Phone Supply Chain Security
Purism
Latest posts by Purism (see all)
- PureOS Crimson Development Report: August 2024 - September 12, 2024
- PureOS Crimson Development Report: July 2024 - August 6, 2024
- Abside and Purism Partner to Deliver Secure Mobile Solution for U.S. Government and NATO Countries - July 19, 2024
There are a number of different reasons why someone might be excited about the Made in USA electronics in the Liberty Phone ranging from the patriotic to the environmental to the security-minded. The Liberty Phone has a more secure supply chain for reasons beyond that the electronics are made in one country instead of another. In this post I will explain why it’s so important that the Liberty Phone is made where it is and why that makes it a more secure product than the Librem 5. Even if you aren’t from the US or don’t find the US a more trustworthy manufacturing location than anywhere else, by the end of my post you will hopefully agree with me.
Locally Sourced Ingredients
Whenever I talk about supply chain security, I like to draw analogies from the food supply chain, because it’s something most people are more familiar with. In my Protecting the Digital Supply Chain article, I went all-in on the analogy to explain how we protect the firmware and software supply chains in our products. To understand what makes the Liberty Phone more secure, let’s compare it to the recent “farm to table” trend in restaurants.
The idea behind farm to table is that instead of relying on restaurant supply warehouses that get ingredients from thousands of miles away, often grown in massive factory farms, a restaurant partners with local farms to source ingredients. While a farm to table restaurant might still get a few exotic or hard-to-find ingredients from other places, the restaurant’s menu is generally based on what’s available locally each week. Patrons get fresh, seasonal ingredients in their dishes, support local farmers, and reduce some of the environmental impact involved in shipping food around the world. By having a direct relationship with farmers, the restaurant also has more control and knowledge of the quality and age of the ingredients, how they were grown, and how they have been treated since they were harvested. Tainted ingredients are much easier and faster to detect, trace, and contain, especially when compared to, for example, tracing and containing salmonella outbreaks from factory-farmed spinach.
The recipe for a Librem 5 calls for over 140 unique ingredients. To make the Liberty Phone we started by finding new sources for those ingredients with a separate, local supply chain using US distributors and fabrication whenever possible. Some exotic ingredients essential for the recipe aren’t grown in the US like the Dutch NXP CPU, which is grown in South Korea and had to be flown in. By starting with new, local suppliers, we had more direct control and knowledge of the quality of the ingredients. Also, given the unprecedented problems in the electronics supply chain, we can rely on the talents of our Certified Hardware Electronics Fabrication Specialists (CHEFS) to modify our recipe based on what ingredients are available.
Fab to Table
Anyone who has planted a garden at home will tell you that the tomatoes you grow yourself are significantly better than the kind you can buy at a supermarket. One reason for this is that supermarket tomatoes have been bred to have tougher skins, and are often picked unripe so they can survive the long trip from the farm to groceries without being damaged. The resulting flavor and texture is inferior to a vine-ripened tomato grown at home, but it’s a trade-off groceries have to make so the tomatoes survive.
Farm to table exploits the fact that by sourcing ingredients close to the restaurant, fruit and vegetables can hit peak ripeness before picking which results in a better tasting dish at the restaurant, and the option for ingredients that don’t travel well. It’s not that the restaurant is sourcing tomatoes from the USA instead of Italy–both countries grow wonderful tomatoes–it’s that the restaurant is sourcing tomatoes from a farm close to them, wherever they happen to be.
The main thing that makes the Liberty Phone more secure isn’t that it’s made in the USA versus another country, it’s that the electronics are made right next to where we assemble and fulfill orders. We take a “fab to table” approach so that instead of fabricating the PCBA, loading it in an airplane, and shipping it across the world to be assembled into a phone and shipped, we fabricate the PCBA next to where we assemble and ship it. Instead of using an airplane, we can push the freshly picked PCBAs on a cart. We maintain a chain of custody starting from the unpopulated PCB, to the completed PCBA, to the assembled phone, all the way to the completed and shipped order. We know where the PCBA has been, who it’s been with, and everything that’s happened to it along the way to becoming a Liberty Phone.
This is the same reason that we decided to build our Librem Keys in the USA. Originally they were made by Nitrokey in Germany, but we didn’t move production to our facility because either Nitrokey as a company or Germany as a country were untrustworthy (far from it!), it’s simply that the closer production is to fulfillment–wherever fulfillment might be–the fewer links in the chain, the fewer hands and less travel components have, with a lower risk of tampering, damage, or other issues. This is important for something like the Librem Key that handles security-sensitive operations and stores secrets, and arguably equally important for something like a phone.
Seeds of Change
The fab to table approach we’ve taken with the Librem Key and now the Liberty Phone is only the beginning. Just like we have continued to remove or replace any remaining proprietary blobs from our products as we can source or create alternatives, we will continue to tighten and improve the links in our supply chain at every opportunity. When we identify local alternatives to exotic ingredients, we will continue to improve the recipe (and its security) along the way.
Purism Products and Availability Chart
| Model | Status | Lead Time | ||
|---|---|---|---|---|
 | Librem Key (Made in USA) | In Stock ($59+) | 10 business days | |
 | Librem 5 | In Stock ($699+) 3GB/32GB | 10 business days | |
| Librem 5 COMSEC Bundle | In Stock ($1299+) Qty 2; 3GB/32GB | 10 business days | |
| Liberty Phone (Made in USA Electronics) | Backorder ($1,999+) 4GB/128GB | Estimated delivery date pending | |
| Librem 5 + SIMple (3 GB Data) | In Stock ($99/mo) | 10 business days | |
| Librem 5 + SIMple Plus (5 GB Data) | In Stock ($129/mo) | 10 business days | |
| Librem 5 + AweSIM (Unlimited Data) | In Stock ($169/mo) | 10 business days | |
 | Librem 11 | Backorder ($999+) 8GB/1TB | Estimated delivery date pending | |
 | Librem 14 | In Stock ($1,370+) | 10 business days | |
 | Librem Mini | Backorder ($799+) | Estimated delivery mid-October | |
 | Librem Server | In Stock ($2,999+) | 45 business days |
Recent Posts
Related Content
- A Secure Foundry for Government Mobile Computing Needs
- PureOS Crimson Development Report: August 2024
- Flipping the Script: Exploring New Paradigms in Secure Mobile Computing
- Phone Kernel Development at Purism
- The Evolution of Smartphone Security
