I haven’t done adequate due diligence yet - could be inaccurate
I came across this article alleging that Germany is considering bailing on the F-35 aircraft because the US can remotely disable them.
If the US could do this to German F-35s, presumably they can do it to ours…
Additional reporting alleging concern in Canadian defence circles
Nothing in the article backs up the headline claim. The closest it gets is their quoted expert saying that he worries about the US doing to the F-35 what they’re doing to Ukraine. He’s almost certainly referring to the fact that parts and software updates are produced by the US, who could choose to withhold them, just like they’re withholding aid from Ukraine.
Every serious defence analyst has laughed at the idea that the F-35 has a secret killswitch. This would be the dumbest thing ever to include in an aircraft, because there is always the possibility that your enemies could find out about it.
Consider; if an F-35 kill switch did exist, any buyer of the craft could invest the resources required to go over every inch of circuit and line of code and find it, and then deactivate every US F-35. It would be more of a liability for them than it is for us. And, equally, our experts could simply patch around the killswitch on our planes. Nations like Canada and Germany are not lacking in technical expertise.
This bonkers notion seems mostly to be rooted in the broader fear that the F-35 is somehow “too advanced”, an idea that largely springs from the diseased brain of Pierre Sprey (seriously, if you chase down every bad thing said about the F-35, odds are ridiculously high that Sprey said it first). Sprey also believed that the ideal design for a modern attack fighter has a machine gun, no missiles, no computers, and no radar.
I’m not joking, not even slightly. Pierre Sprey wanted the modern world to fight Russia with planes that had no radar.
There are valid concerns to be raised about the idea of adopting a craft whose supply chain is centred on the US. That’s a discussion that NATO partners should be having. But this “killswitch” nonsense just derails that important discussion into paranoid conspiracy theorist nonsense rooted in the deranged ramblings of a self-aggrandizing madman.
Every serious defence analyst has laughed at the idea that the F-35 has a secret killswitch. This would be the dumbest thing ever to include in an aircraft, because there is always the possibility that your enemies could find out about it.
just cryptographically sign the kill switch transmission. the fighter would contain the public key to verify, but enemies would need the private key to trigger it, which the NSA would keep buried in cold storage like the DUAL-EC-DRBG trapdoor key.
you’d probably also want to include the fighter’s serial number or IFF transponder code, so the enemy couldn’t capture or replay.
Consider; if an F-35 kill switch did exist, any buyer of the craft could invest the resources required to go over every inch of circuit and line of code and find it, and then deactivate every US F-35.
there’s something like 100M LoC of C++ (not Ada 😥) in an F-35. and Canada doesn’t have the sources, so they’d have to decompile that. maybe they could focus on the radios, radar and other devices direct connection to receivers, but the implant might be downstream, and there’s a lot of ways to hide an antenna.
even dumping the chips isn’t easy. many of them likely have security features, since they contain classified algorithms which the DoD would rather enemies not be able to extract from the downed wreckage of a fighter. certainly the JTAG pins are not going to be enabled. even die shots could be frustrated by metal meshes over the wafer or possibly even microscopic amounts of explosives triggered by de-lidding.
But this “killswitch” nonsense just derails that important discussion into paranoid conspiracy theorist nonsense rooted in the deranged ramblings of a self-aggrandizing madman.
there’s secure ways to build a kill switch, there’s an abundance of places to hide it in a highly complex fighter, and this kind of spooky stuff is well within the NSA’s wheelhouse. it’s the kind of thing NSA is known for, even - the Crypto AG CIA front, the DUAL-EC-DRBG backdoor, TAO’s clandestine program to intercept and backdoor mailed routers and servers. they clearly can do this kind of thing, since they clearly have before.
did they backdoor the F-35? I don’t know, but it’s plausible, and CSIS/CSE should investigate.
The whole rumor kinda smells like a disinformation campaign designed to drive even more wedges between the US and the rest of NATO, TBH.
Honestly, it mostly just sounds like more fear mongering about the F-35, which has been going on for ages, and is mostly a Russian disinformation campaign. Pierre Sprey - the originator of all the F-35 criticisms that routinely get handed around - is very regularly a paid guest on RT and other Russian state controlled news outlets.
Basically Russia is really scared of the F-35 program and would much rather their enemies keep flying upgraded fourth gen fighters. If the US was selling the F-22 to the rest of the world you’d be hearing all the same noise but about that plane instead.
Are you telling me NSA is incapable of adding in a backdoor that would pass German/Canadian inspections? Zero day backdoors by definition are undiscovered
There’s no such thing as a “zero day backdoor”. You’re conflating “backdoor” with “zero day exploit” which are entirely separate things.
And its not a question of whether or not the NSA is capable of doing that. It’s whether they’re capable of doing it in a way that they would absolutely 100% certain could never be discovered.
But more importantly, as I pointed out elsewhere, in order for it to even be possible for such a backdoor to exist, the entire aircraft would have to be designed in a way that was hilariously, outrageously and inconceivably unsafe to operate. You simply do not link mission critical system to external communications systems that are in operation while a vehicle is airborne. Such a design flaw would be immediately obvious to the people whose job it was to approve the purchase, because there’s no way you connect up systems like that in secret. While the US might supply the parts, it’s still our guys who maintain them and integrate them into the vehicle.
Every serious defence analyst has laughed at the idea that the F-35 has a secret killswitch. This would be the dumbest thing ever to include in an aircraft, because there is always the possibility that your enemies could find out about it.
And yet, intelligence agencies do that kind of thing all the time. If they’re sure only they have the key, or if they can patch it out of their own planes, the risk is pretty low. Which defence analysts are you thinking of?
Nobody can point at proof it’s there, but I’d be surprised as hell if it’s not, so at least I’m not looking for extraordinary evidence.
This is a good breakdown of both the mythical nature of the killswitch claim, and the actual real concerns that we should be talking about, in regards to the US tight control over the supply of firmware updates and parts for the F-35: https://theaviationist.com/2025/03/10/f-35-kill-switch-myth/
This is a really good and detailed look at the supply chain issues and what exactly those US updates do, thanks.
It doesn’t actually debunk anything about the “killswitch myth”, though. It pretty much just uses it as a prelude for the other stuff.
The problem here is that any serious debunking of the myth basically goes the same way; “No, that’s stupid, no one would do that.”
It’s the proving a negative issue. The internals of the F-35 are not something that anyone is at liberty to discuss, so anyone who wants to wildly speculate about what could be in there is free to make up whatever they want, and anyone in a position to prove them wrong is legally unable to do so.
But the idea simply does not pass the sniff test. You’re talking about handing these weapons over to advanced nations with access to serious technical know how, and just rolling the dice that none of them ever discover it before you get a chance to use it. And that’s assuming the idea is even plausible. It’s not like you can just ping this thing like a fucking router. It’s not flying around advertising its IP address. It was built to be a stealth aircraft; that means, among other things, removing all extraneous external communications. And there’s literally no reason to connect any part of the critical software to the external comms and every reason not to, given that the US’ enemies are pretty damn good at cyberwarfare. That would be a crippling vulnerability for a weapon system like that.
Basically, the reason no serious commenter believes a killswitch exists is because we simply do not build combat aircraft in a way that would allow a killswitch to exist.
But please feel free to show me an actual quote from someone with serious defence tech credentials saying otherwise. So far, I’ve not seen any.
Would they be updated by sneakersnet, then? I guess that would make sense, but the only difference is that it would take slightly longer for data to arrive.
It is a negative issue, so the only thing to consider is how plausible it is. It would be easy for them to push a malicious update, I assume that’s not in dispute?
Try to think about what you’re actually describing. It’s one year from now. Tensions between the US and Canada have steadily and rapidly escalated. US troops are massing on the Canadian border under the guise of “training exercises”… And some guy in the RCAF is like “Shit, better not forget to run that new firmware update that the Americans pushed for us, and absolutely no one else.” Is that the scenario we’re envisioning here?
No, in that situation we just wouldn’t do an update. I’d be more worried about a backdoor that’s triggered by not updating for an extended period, maybe along along with a few other hints, and was actually made with the possibility of the Iranians capturing an F-35 in mind.
More like, it’s a year from now and Trump decides to take his ball and go home, so he directs the NSA and DIA to build an update that will brick planes which aren’t parked in one of his favoured countries, after a delay of about a month to ensure he gets as many as possible.
Not a fan of speculation and we’re likely to never see any official documentation, considering it’s a military aircraft.
But I will say: If it is true, it’s probably the dumbest thing you could do to an advanced fighter like this. Just imagine that you’re in a conflict, then the enemy hacks your command and control systems and disables/hijacks all of your aircraft. Yeah, that’s pretty dumb.
Even the Star Trek writers realized this sort of thing is a bad idea.
This is exactly what happens in the Battlestar Galactica reboot with all the fancy newer ships in the first couple episodes.
I really need to re-watch that show. But I can’t stand all of the useless bickering lol
Are you telling me NSA is incapable of adding in a backdoor that would pass German/Canadian inspections? Zero day backdoors by definition are undiscovered
That’s not what I said, at all.
PS - I work in InfoSec (CISSP). Please tell me more about what I’ve been doing for past 20 years lol
for someone with two decades of infosec experience, it’s alarming you’d overlook asymmetric cryptography. it’s simple to build an unhackable kill switch using basic cryptographic primitives, unless you think the enemy has a quantum computer.
You might want to give this a read, then re-read my original post. I never said there wasn’t a backdoor, just that it would be stupid.
While speculation, I don’t doubt it one bit.
It’s unlikely you’d be able to fly these without US maintenance and supplies in the first place, but even if you could, I’d trust them as much as pagers from Israel.
BAE Systems (in the UK) has full F-35 manufacturing capabilities. The Brits could tell them to toss it any day now and I wouldn’t be surprised, with the way things are going.
Just because you put kill switches in the ones you sell, doesn’t mean you’ve got to put them in your own.
But yeah, being able to remotely kill a fighter jet is incredibly stupid.
Just because you put kill switches in the ones you sell
That right there is what it is. I can almost guarantee this to be the case, as a Canadian I have always opposed the F-35’s. We need twin engine for our Arctic climates and who cares about stealth when you are defending your territory. We aren’t an aggressive country.
You care about stealth when defending your country because stealth is how you win air to air combat now.
Dogfighting is as meaningful to modern air combat as the horse and lance are to modern ground combat. Fighter planes work like submarines now; the goal is to detect and kill the enemy before they can detect and kill you. Kills happen from outside of visual range.
A defensive aircraft without advanced stealth can be shot and killed by an aggressor before they ever have the ability to target that aggressor.
To put it another way, do you think that our soldiers only wear camouflage when they’re planning a sneak attack? Do our troops wear hazard vests and strap road flares to their helmets when they’re defending a location to make sure the enemy knows exactly where they are? Or is it, in fact, always beneficial to see your enemy before they see you?
And be careful with Switzerland ammo. They forbade Ukrainians to use it because of war. Literally. “You can’t use our ammunition during the war”.
Does anyone know of a FOSS F-35 alternative?
As an average Windows user, I feel like that shouldn’t be necessary. If you don’t want your F-35s remotely disabled, just go into the system settings and disable the cockpit personalization, DoD telemetry, flight control suggestions, and especially uncheck the “Help make America safer by sending usage and crash statistics to the Pentagon” box.
Of course you also need to double check after every system update to make sure that none of these settings ended up getting patched back on without notice, but for the average pilot, it couldn’t be more user friendly.
And remember, please try to press the OK button to send Microsoft your anonymous crash analytics before your F-35 smashes into the ground.
Give it a week and Arch users will have it running on the F-35
I believe it. Full Doom port on the avionics/helmet system by Week 2.
My understanding is that there’s some weird shenanigans going on with an encryption key or something of that ilk that has to be renewed daily from US servers for the aircraft to continue to function, but I’m not sure how reliable the source I got that from is. However, I wouldn’t buy F-35s either, if I were a nation-state shopping for aircraft.
That seems like just a rumour, I doubt anybody would have accepted it. The software is written exclusively in the US and proprietary, though, including every update.
If true, that could be a massive problem if communications get damaged in a conflict, even if the US is not acting maliciously.
I haven’t been able to identify the source from which I first got the information, unfortunately, but other stuff I’ve found while looking makes me think there may indeed be a comms issue: ODIN, the new software platform for these birds that’s now being put into production, is repeatedly described as “cloud-based”. That and one site’s cryptic reference to “F-35 crypto ignition keys” do not exactly inspire confidence in me. Or at least, if whatever I read first was a misinterpretation, I can kind of see where it was coming from.
crypto ignition keys (CIKs) are just setup tools to load bootstrap keys into a device.
like, for instance, if you’ve just unboxed a secure telephone, there’s no keys in it, so you have to use a CIK to load keys/ciphers into the phone before you can make calls from it.
the private sector doesn’t use them much, but NSA invented them and they’ve been a staple of IC infra for decades.
This is why you don’t buy US.
Boeing taking a page from the John Deere playbook…
And out of curiousity… what’s to keep these other countries from swapping out the software and/or hardware that causes this? They bought it and the US can go pound sand. Am I saying it’s easy to do? No. But it’s not impossible and a far sight cheaper than buying all new planes from someone else.
The risk is the US sticking a logic bomb into a firmware update that physically breaks chips without regular updates that are signed by the US manufacturers CA.
Trust is important and frankly the US isnt very deserving of trust at the moment.
Edit; tbh id be surprised if something like this isn’t already there for the purpose of guaranteed support contract money for each major component. Stop paying? Go find another component, shits bricked.
Gotta keep that MIC money flowing.
Can still swap out hardware. And firmware chips can be replaced.
Poland, Finland and all three Baltic states are buying F-35s, which is less than ideal.
I wonder what Putin would have to offer Trump to nerf, say, Estonia’s F-35s at an opportune moment.
