Secure boot, root of trust, supply chain firmware integrity. Three weeks of field pentesting data from hardware engagements across four clients. The attack surface nobody in the boardroom understands — and every nation-state adversary does. This piece covers the toolchain, the methodology, and the three vulnerabilities found in every single engagement without exception.

The USGS has listed rare earths as critical since 2018. The IEA has published annual outlooks since 2023. The DoD invested $400M in MP Materials in July 2025 — enough to cover 3% of global demand at full capacity. This piece maps the gap between policy language and processing reality, and the 10-15 year timeline that makes reshoring a generational problem, not a quarterly one.

Every F-35 actuator contains neodymium and dysprosium permanent magnets. China processes 91% of those elements. The firmware controlling those actuators has no public audit trail. This is not two separate vulnerabilities. It is one vulnerability with two attack vectors — one physical, one digital — and the US defense industrial base has not mapped their intersection. This piece does.

In 2023, Swedish police raided Mullvad's offices. They left with nothing. Not because the staff resisted — because there was architecturally nothing to find. No logs, no user records, no connection metadata. This piece breaks down the technical design decisions that made that outcome structurally inevitable, and what it means for anyone building privacy infrastructure at scale.

Shodan, corporate registry databases, shipping manifests, satellite imagery, LinkedIn, government filings. Every piece of a mineral supply chain leaves a public trace if you know where to look. This piece is a live walkthrough — tracing a single rare earth element from mine to magnet to finished product using exclusively open source tools. The methodology applies to any supply chain in any domain.