On September 17, 2024, thousands of pagers exploded across Lebanon within the same minute. The next day, a second wave of walkie-talkies detonated. Dozens of people were killed and roughly 3,500 were injured. It was, by any measure, a horror.

Set the horror aside for one paragraph, though, because the mechanism is what matters for everyone who carries a device. Those pagers were not hacked over the air. No one clicked a bad link. The devices were compromised in the supply chain, before they were ever delivered. Over a period of years, an intelligence service infiltrated the procurement channel, routed the order through shell companies posing as a legitimate brand, and implanted the payload during manufacturing or shipment. A source close to the group put it plainly: the devices were “sabotaged at source.” By the time they reached their owners, they were already weapons. The owner never had a chance, because the attack happened before the device was in their hands.

That is the part worth internalizing. A device can be compromised before you ever turn it on.

Interdiction is not rare, and it is usually silent

Security professionals have a word for this: interdiction. Goods are intercepted somewhere between the factory and the recipient, tampered with, and passed along as if nothing happened. Discussing the Lebanon attack, a former senior US intelligence official said interdiction operations are “rampant.” A former FBI official added that infiltrating a supply chain is “a pretty standard tool of intelligence services,” used mostly to collect information, and, as the world just witnessed, sometimes for far worse.

The explosive version made headlines precisely because it was so extreme. The common version makes no sound at all. A US National Security Agency document from 2010 described the agency intercepting computer hardware in transit to certain buyers, implanting surveillance tools, repackaging the equipment, and sending it on to its destination. No blast. Just a device that quietly worked for someone else from the first day it was plugged in, tampered with somewhere between the assembly line and the desk it landed on, its owner none the wiser.

This is the threat almost no one accounts for when they think about phone security. People worry about apps, passwords, and encryption, all of which live on the device after they own it. Interdiction happens before that, in a window the owner cannot see and cannot audit.

What interdiction actually requires

Here is the useful insight, because it points straight at the defense. Interdicting a specific person’s device requires two things.

First, the adversary has to know which devices are headed to the target. Somebody ordered them, from somebody, and that order is a thread to pull. In Lebanon, the group made a centralized, identifiable purchase of special-purpose devices from a vendor an adversary could reach. That procurement channel was the opening.

Second, the adversary has to be able to lay hands on those specific devices in transit, a known shipment, going to a known place, that can be intercepted and rerouted.

Take away either one and the whole operation collapses. If you cannot tell which devices are the target’s, you cannot tamper with the right ones. If there is no identifiable shipment, there is nothing to intercept. The victims in Lebanon, tragically, handed their adversary both: a special order, from a known vendor, in a shipment that could be found. Trust in a specific vendor plus an identifiable supply chain is the entire vulnerability.

So we built our approach to deny an adversary both, and it comes down to two choices that sound almost too simple to matter, and matter enormously.

Choice one: commercial off-the-shelf hardware

We build on standard, commercial off-the-shelf devices, Google Pixels, the same phones anyone can buy anywhere. This is a deliberate security decision, not a cost-cutting one.

Your phone is one of tens of millions of identical units coming off the same mass-production line that the entire planet buys from. There is no bespoke “secure phone” manufacturing run for an adversary to infiltrate. There is no boutique vendor whose small, special shipments can be watched. There is no unique procurement channel that points at you. You disappear into the largest, most scrutinized, most redundant consumer electronics supply chain on earth, one that no targeted adversary can practically pre-compromise for you specifically, because they have no way to know which of those millions of units will end up being yours.

Neither do we, for that matter, until the moment you buy it. Which is exactly the point.

Choice two: cash, at varied locations

This is the choice that closes the loop, and it is the one people underestimate.

When you buy your device with cash, from an ordinary retailer, and ideally not the same store every single time, something quietly powerful happens: there is no order in your name. No shipment addressed to you. No card, account, loyalty number, or delivery record tying a specific serial number to a specific person. The unit that becomes yours was picked, effectively at random, off a shelf, by you, anonymously, moments before it was yours.

Now run the interdiction playbook against that. There is no shipment to intercept, because nothing was ever routed to you. There is no record to pull, because no record was ever created. There is no way to identify your device among millions of identical ones, because nothing distinguishes it and nothing connects it to your name. The adversary can want to tamper with your phone all day. They cannot find it. You cannot tamper with a phone you cannot find.

Put the two choices together and the entire interdiction model has nothing to grab: no targetable channel, no identifiable shipment, no distinguishable device. You broke the chain at the source, before there was a chain at all.

Why a “secure phone” you order can work against you

This is also the uncomfortable reason that buying a phone from a well-known secure-phone company can quietly undermine the very thing you bought it for. It recreates the Lebanon setup in miniature: a known vendor, an order in your name, a shipment addressed to you, and a procurement channel a determined adversary could watch or infiltrate, plus the plain fact that you bought that particular device becomes a signal all by itself.

We deliberately invert that model. We do not want to be a special vendor shipping special hardware to identifiable customers, because that is precisely the pattern interdiction feeds on. We would rather harden ordinary hardware that you sourced anonymously, so that nothing about the supply chain ever pointed in your direction.

The other half of the chain: the software

Sourcing the hardware anonymously defeats interdiction of the metal. The other half of any device’s supply chain is the software, and we cover that a different way. Because the build is signed with keys you control and protected by verified boot, you can confirm that the operating system on the device is exactly what it is supposed to be and has not been altered. Anonymity handles the hardware; your keys and verified boot handle the code. Both halves of the supply chain, accounted for, rather than the usual one.

Two ways to do it with us, honestly stated

There are two paths, and we will be straight about the trade in each.

Self-Provision is the purest form of supply-chain control there is. You buy your own commercial Pixel, with cash, wherever and whenever you like, and we never touch the hardware at all. We only provide the software you flash onto it yourself. The chain of custody for the physical device is entirely yours, and it never had your name on it.

White Glove, where we source and provision the device for you, necessarily puts us back into the chain, so we run it with the same discipline we just described: commercial off-the-shelf units, sourced without a bright line pointing at the end customer, handled in a controlled way, with no unique markers added. And in either case, you can verify the software yourself rather than taking our word for it. We would rather be a vendor you can check than one you have to trust blindly, because the whole point of this post is that blind trust in a supply chain is exactly what gets exploited.

Who this is for

Anyone with an adversary capable and motivated enough to reach a supply chain, which is a longer list than most people think: journalists and their sources, executives, attorneys, activists, people in or adjacent to conflict, and anyone who watched the events in Lebanon and understood them not just as a tragedy but as a lesson about where device compromise actually begins.

If your threat model includes someone who might get to your device before you do, the defense starts at the point of purchase, not the point of setup. Email hello@spicycorp.com, or book a call, and we will help you build a device with a supply chain that never pointed at you.