In February 2005 a group of Pentagon industry advisers warned that the "migration of critical microelectronics man?u?facturing" from the U.S. to other countries compromised national security. To ensure a steady supply of safe microchips, the Defense Science Board--which advises senior defense officials--recommended establishing "trusted foundries" to make critical hardware. But that is only part of the picture. According to the science board, any effort to improve the safety and supply of microchips would be of "limited utility" without a comparable focus on software--especially on what the Pentagon calls "foreign-influenced software."

The Department of Defense once created its own software, but today only the most highly classified code is written in-house, at places such as the secretive National Security Agency. But a good deal of code for some of the military's most sophisticated weapons--fighter aircraft and missile defense systems, for example--is written in other countries.

In 2004 the Government Accountability Office (GAO) found that the military "is experiencing significant and increasing reliance on software and information systems for its weapon capabilities, while at the same time traditional DOD prime contractors are subcontracting more of their software development to lower-tier and sometimes nontraditional defense suppliers." Those suppliers, the GAO added, use "offshore locations and foreign companies" for some software development.

Software developed overseas can be manipulated in several ways, says Nancy Mead, a senior member of the technical staff at the Carnegie Mellon Software Engineering Institute. The code itself can be tampered with and set up to do subsequent damage; it can also be laced with surreptitious "back doors" designed to allow access to a system at a later date. And the possibility exists that software could be copied and sold to adversaries.

"You don't have day-to-day control over what's going on" at some overseas facilities, Mead notes. U.S. companies that look to foreign suppliers must keep an eye on the software-development process as much as possible, she says, because the development phase is the point at which errors or intentional flaws can most easily be prevented. Complex software contains millions of lines of code, and "it becomes more difficult" to spot such flaws later on, Mead explains: "At that point you're just looking for a needle in a haystack."

According to a former Pentagon official who requested anonymity, software written abroad has become the subject of high-level discussions and secret threat assessments within the DOD. The department went back to its science board last October for a look at both why the military has become so dependent on software of "foreign provenance" and what is currently being done to test it. The board will probably finish its analysis sometime this year.

Leading the science board study is Robert Lucky, an esteemed engineer, author and research consultant. Lucky says he was concerned the military might deem too many systems as "mission-critical," meaning that they must have the highest levels of software security. Such classification would make the task of ensuring security that much harder--and more expensive. Lucky and his panel will have to address that question of resources: the Pentagon has asked them to evaluate the investments the DOD could make to increase confidence in military software. Like many choices in life, "it all comes down to money," Lucky remarks. "How much security can you get for how much money?"