Inside a two-storey office building on the outskirts of Ottawa, a team of engineers has dismantled a flat-screen TV and ripped out its microelectronic guts. Chip by chip, they’re analyzing millions of circuits embedded in layers of copper and silicon thinner than a human hair.
Powerful electron microscopes allow them to bore down to the level of individual silicon atoms.
Hidden in all that microcircuitry is someone’s patented technology. And the engineers are hunting for the forensic evidence to prove it.
Welcome to CSI Kanata.
“We’re like the crime lab,” explained Harry Page, chief executive officer of UBM TechInsights of Kanata, a high-tech suburb that officially became part of Ottawa in 2001. “We do all the investigation, and put all the pieces together. We find the needle in the haystack – that indisputable evidence of use.”
Down the street from where Canada’s semiconductor industry was born a generation ago, a vibrant new industry has sprung up – reverse engineering. Many of the same engineers who once made and designed computer chips for Nortel Networks and JDS Uniphase are now dismantling and decoding a new generation of microprocessors.
History and opportunity have made Ottawa the world capital of this growing and increasingly vital high-tech business – tearing down everything from iPhones to game consoles to decode the maze of circuits that makes them work. UBM TechInsights, along with Chipworks Inc. and Global Intellectual Strategies, form the core of an industry that employs hundreds of people in the Ottawa area, and sells its services to customers around the world, including the United States, Europe and Asia.
The explosion of high-stakes international patent litigation has pushed reverse engineering from a primitive back-room activity into an essential business. Intellectual property has become a valuable and marketable asset, as well as a competitive weapon.
And yet these companies, and the work they do, is virtually unknown outside the intellectual property intelligentsia.
“It’s a bit of an accident of geography, but we’re the industry leaders,” explained Terry Ludlow, CEO of Chipworks.
Canada leads the world in reverse engineering mainly because it got there first. Mr. Ludlow, who’s widely regarded as the father of Ottawa’s reverse engineering industry, worked for Kanata-based Mosaid Inc.’s chip-testing division in the 1980s. He left Mosaid to help form Semiconductor Insights (now UBM TechInsights), and then moved on to create Chipworks in 1992.
That head start was all Canada needed in a business that depends on deep knowledge of the latest chip-making techniques plus a heavy investment in high-tech scientific and forensic tools. Electron microscopes, along with the custom software to run them, can cost as much as $1-million apiece. And these companies each have half a dozen or more of them, which must be continually upgraded to keep pace with ever-shrinking chips.
Canada’s other competitive advantage is that it’s not the United States, where the global patent wars are largely fought. Mr. Page of UBM TechInsights pointed out that some of its customers feel more comfortable dealing with a Canadian company, convinced their confidential information is better shielded from the prying eyes of patent lawyers and U.S. court orders. “Our clients like that we keep … all the dialogue surrounding their programs on Canadian soil,” he explained.
The intellectual property (IP) business has become huge, and fraught with risk. A string of massive patent infringement awards in U.S. courts, including Research In Motion Ltd.’s big $612.5-million (U.S.) licence payout in 2006, caused high-tech companies to take a much harder look at the cash they have sunk in their intellectual property. A single patent might cost anywhere from $250,000 to $1-million to develop, and as much as $100,000 a year to maintain and defend in the global marketplace.
“People are really starting to realize they have huge amounts of money invested in these assets and they need to start generating a return,” remarked Mr. Page of UBM TechInsights. “That mindset didn’t exist 10 years ago.”
Think of reverse engineers as the “arms dealers” of the IP wars, as one industry insider put it. They provide the ammunition that device makers, lawyers and patent-holding companies use to enforce their ownership rights – either in court or in licensing negotiations.
Reverse engineers are also silicon spies. When they’re not helping customers build legal cases, they’re helping tech companies figure out what kind of chips, circuits and fabricating techniques their competitors are using.
Forensic work by UBM TechInsights helped crack one of the costliest and longest-running corporate espionage cases of all time. The case pitted Taiwan Semiconductor Manufacturing Co., the world’s largest contract chip maker, against China-based Semiconductor Manufacturing International Corp. TSMC suspected that dozens of former employees had stolen vital chip-making methods and provided them to SMIC, but couldn’t prove it. So engineers at UBM TechInsights tore apart various semiconductor devices made by the Chinese and identified strikingly similar features to TSMC’s own chips.
The evidence, plus UBM TechInsights’ technical analysis, was crucial to a $175-million licensing deal between the companies in 2005 and a subsequent 2009 TSMC victory in a California court. The two sides quickly settled the second case for $200-million plus an undisclosed amount of stock.
The best outcome for device makers and chip manufacturers isn’t to wind up in court. The goal is to get people to pay for the technology they use, either through licensing or by identifying potential buyers for patents they no longer deem core to their own business.
“Cross-licensing has become the name of the game in microelectronics,” said Mr. Ludlow of Chipworks. “It’s a matter of keeping score. Who’s going to collect from who?”
In a world where just about every device maker is using at least some of someone else’s prized technology, it’s become a war of attrition. And the best result for many technology companies is simply “getting to zero,” Mr. Ludlow explained. That’s where, say, a cellphone maker generates roughly the same amount in licensing fees as they’re paying out to others.
“Everyone who builds a cellphone these days is suing each other,” he pointed out.
A decade ago, the business was pretty primitive. Engineers would photograph chips with a 35 mm camera or even a Polaroid, Scotch tape the images into a single collage on the floor and then trace the circuits with coloured markers.
Today, the reverse engineering process starts with a tear down of everything from computers to digital cameras, cellphones, TVs and gaming consoles. The object is to get at the circuit boards, which are then x-rayed and scanned to figure out how they’re put together.
Then it’s on to the “wet lab,” where engineers use saws, polishers and chemicals baths to “delayer” chips, separating metal from silicon. A modern chip has up to 10 layers, with as little as 1/1000th of a human hair between layers.
“We don’t know beforehand what we’re going to encounter,” acknowledged Jason Abt, product manager of technical intelligence at UBM TechInsights. “The materials and the manufacturing are always changing.”
The real extraction work is done under electron microscopes, which can be programmed to collect and digitally stitch together millions of images, a process that can often take several days. The ultimate objective is to create a complete wiring map of the target part.
Every week, UBM TechInsights collects roughly a half a terabyte of data, about the storage capacity of a handful of PCs. In addition to a vast and searchable digital library, the company also stores 25,000 parts – the largest collection of its kind found anywhere in the world.
“The key is creating the tools to mine the data we collect,” said Mr. Page of UBM TechInsights. “Our own intellectual property resides in the techniques we use and the rich database we have from all the analysis we’ve done.”
The company does roughly 2,000 projects a year, including the dismantling of 1,000 cellphones. And just like a crime lab, UBM TechInsights must show a “chain of custody” for any physical evidence, in case its engineers are called on to testify in court or in sworn legal depositions.
But for all the trappings of a science, reverse engineering is also an art. Reverse engineers are trying to match the written claims contained in one company’s patent to a complex wiring schematic. The match is seldom crystal clear, even under a powerful microscope.
“It’s almost never obvious,” Mr. Ludlow of Chipworks pointed out. “You have to look at the features and understand how it works. And then you see if it matches what’s claimed in the patent.”