Work

From Containers to Code: Applying Post-9/11 Trade Security Lessons to the Software Supply Chain

Year: 2025

Type: article

Abstract: This working paper examines how lessons from post-9/11 global trade security initiatives can inform current open source software supply chain security challenges. The authors argue that despite dealing with different domains—physical goods versus digital code—both face similar fundamental questions about managing risk in complex, multi-actor systems where trust is essential but vulnerable to exploitation. The ongoing research, funded by the Digital Infrastructure Insights Fund, analyzes successful trade security programs like C-TPAT and CSI, focusing on their incentive-based structures, public-private partnerships, and harmonized international standards, to develop actionable recommendations for software security policy. Rather than punitive regulatory approaches, the authors advocate for a framework that emphasizes positive incentives, investment in critical infrastructure, collaborative risk assessment tools, and international standards—moving beyond simple analogies like Software Bill of Materials to create trusted actor programs similar to those that succeeded in trade security

Source: Zenodo (CERN European Organization for Nuclear Research)

DOI: 10.5281/zenodo.17387645

Authors: Lieggi, Stephanie, Gomez, Juanita, Shaw, Robert, Gagoshidze, Tekla, Shah, Shayiq

Institutions: University of California, Santa Cruz, Middlebury Institute of International Studies at Monterey

Language: English

Topic: Information and Cyber Security

Subfield: Information Systems

Field: Computer Science

Domain: Physical Sciences

SDGs: Peace, justice, and strong institutions, Industry, innovation and infrastructure

Open Access status: green

OpenAlex ID: W7103149154

FWCI:

Cites:

Cited by:

Related to: