State-backed cyber espionage exploits global supply chains: How systemic vulnerabilities in IoT devices enable transnational surveillance networks

Indigenous frameworks view technology as part of a living system requiring balance, contrasting with the extractive, commodified approach of global IoT supply chains. Traditional knowledge systems in the Pacific and Americas have long warned against the unchecked accumulation of power through surveillance tools, yet these warnings are dismissed in Western cybersecurity discourse. The focus on 'hacking' as a malicious act ignores how Indigenous communities have historically resisted surveillance through communal knowledge-sharing and decentralised governance.

The use of everyday devices for espionage mirrors historical precedents like the NSA's QUANTUM program (2000s) and Israel's Stuxnet (2010), which weaponised consumer tech long before China's current operations. Colonial-era telegraph and radio networks were initially framed as 'neutral infrastructure' before being repurposed for surveillance, a pattern repeating with modern IoT. The current narrative echoes Cold War rhetoric, where technological prowess was framed as a zero-sum game between superpowers, obscuring the role of corporate actors in enabling these systems.

In Africa, cybersecurity debates centre on 'digital sovereignty,' with countries like Nigeria and Kenya advocating for localised data centres to resist foreign surveillance—yet these perspectives are absent in Western coverage. Latin American activists argue that the 'China threat' narrative is a distraction from US and EU corporate exploitation of Latin American tech labour and mineral supply chains. In East Asia, scholars note how Japan and South Korea's tech industries have long been complicit in enabling state surveillance, complicating the 'China as sole villain' trope.

Peer-reviewed research shows that 90% of IoT vulnerabilities stem from supply chain shortcuts (e.g., reused firmware, default passwords) rather than targeted attacks, yet media focuses on geopolitical blame. Studies from MIT and TU Delft demonstrate that hardware backdoors are often introduced during manufacturing in low-regulation jurisdictions, a finding ignored in favour of state-centric narratives. The scientific consensus on IoT security highlights the need for hardware-level encryption and open-source audits, but these solutions are sidelined in favour of militarised cybersecurity responses.

Artists like Trevor Paglen have long exposed how surveillance infrastructure is aestheticised as 'neutral' tech, masking its oppressive functions—yet this critique is absent in mainstream cybersecurity discourse. Indigenous futurists like the Māori artist Lisa Reihana reimagine digital spaces as communal rather than extractive, offering alternatives to the hacker-vs-state binary. Spiritual traditions from Buddhism to African Ubuntu philosophy frame technology as a tool for collective liberation, not espionage, challenging the securitised framing of IoT vulnerabilities.

Scenario modelling by RAND Corporation suggests that by 2030, 60% of global cyberattacks will originate from non-state actors exploiting IoT vulnerabilities, yet current policies focus solely on state actors. Futurists warn that the militarisation of cybersecurity will lead to a 'cyber arms race,' where corporations and states compete to control the most vulnerable devices, exacerbating inequality. Alternative models, such as decentralised mesh networks (e.g., Guifi.net in Spain) or Indigenous data sovereignty initiatives, offer pathways to resist this trajectory.

Workers in tech manufacturing hubs (e.g., Shenzhen, Bangalore) face surveillance not just from foreign states but from their own employers, yet their experiences are erased in favour of geopolitical narratives. Disabled and elderly communities, who rely heavily on IoT devices for healthcare, are disproportionately affected by security flaws but lack representation in cybersecurity policy debates. Grassroots organisers in the Global South argue that 'cybersecurity' discourse often serves to justify further surveillance of marginalised groups under the guise of 'national security.'