DEV Community: Pat Johansen

Your Offboarding Script Is a National Security Control

Pat Johansen — Fri, 06 Nov 2026 20:53:34 +0000

Most security conversations about geopolitics focus on nation-state hackers breaking in from the outside. But some of the most consequential risks come from people who already have a badge, a laptop, and a Slack account.

As AI model weights, training data, and chip-level designs become strategic assets, the engineers who touch them become strategic targets. That doesn’t mean anyone is a spy. It means your access model should assume that pressure, coercion, recruitment, and deception are all realistic threats, and that none of them require a villain on your team.

The Threat Isn’t Always a “Bad Employee”

Insider risk is usually discussed as malice, but in practice it falls into three buckets:

Malicious insiders, who knowingly exfiltrate data.
Coerced or compromised insiders, who are pressured through family ties, financial stress, or blackmail.
Deceptive hires, who aren’t who they claim to be. Publicly documented schemes involving fraudulent remote IT workers using falsified identities show this isn’t hypothetical.

Remote-first hiring widened your talent pool, and it also widened the attack surface for identity fraud. Your threat model has to account for all three buckets, not just the first.

Treat Model Weights Like Production Secrets

If your organization trains or fine-tunes models, the weights are a crown-jewel asset, probably more valuable than your source code. Yet many teams store them in shared storage with broad read access “for convenience.”

A few baseline controls:

No standing access. Engineers request time-boxed access with a reason attached, and it expires on its own.
Fresh authentication. Access to sensitive artifacts should require a recent multi-factor check, not a login from three days ago.
Trusted networks only. Reads should come from known, managed environments rather than any laptop on any Wi-Fi.
Two-person rules for bulk export or cross-region replication.
Egress monitoring tuned to large, unusual transfers, not just known-bad destinations.
Immutable audit logs stored outside the blast radius of the people being audited.

None of these is a complete solution on its own, but together they remove a lot of silent, long-lived access.

Offboarding Is Where Good Intentions Go to Die

Teams invest heavily in onboarding and almost nothing in exit. Yet departures, especially to competitors or across borders, are a classic window for data loss.

A solid offboarding process should be automated and consistent, not a checklist someone forgets:

End all active sessions and rotate any shared secrets the person touched.
Remove repository, registry, and deployment permissions.
Revoke personal access tokens and SSH keys, then check for keys they created for automated systems.
Review the last 30 to 90 days of access logs for unusual bulk downloads or clones.
Retrieve and wipe devices, and revoke device certificates.

If this takes a ticket and three chat pings, it will fail under pressure, so tie it directly to your HR system’s termination event.

Make Security Culture Human, Not Paranoid

There’s a real risk of overcorrecting into a culture of suspicion. Surveillance-heavy environments burn out good engineers and push people to hide mistakes. The goal isn’t to distrust your colleagues, it’s to design systems where no single person’s compromise is catastrophic.

That means:

Normalizing “I got a weird LinkedIn message” as a reportable event, not an embarrassing one.
Giving employees a safe channel to say they’re being pressured, without career consequences.
Training on social engineering with realistic scenarios, like fake recruiters, conference contacts, or “research collaborators” asking for just a little detail.

The Open Source Angle

Many of the same dynamics apply to open source, where trust is built over years and can be exploited in a single release. Maintainers are often unpaid, overloaded, and isolated, which is exactly the profile that social engineering preys on. If your product depends on a critical library, consider funding it, contributing review capacity, or at least pinning and verifying what you consume.

Final Thoughts

Geopolitics shows up in the dev stack in unglamorous ways: an over-permissive access role, an unrotated token, an offboarding step that never ran. The engineers who treat these as security fundamentals rather than compliance chores are the ones who make their organizations resilient.

You don’t need to follow every headline to act on this. You just need to ask, for every sensitive asset you touch: If one person with access were compromised tomorrow, what’s the worst that could happen, and how quickly would we know?

Geopolitics Meets the Dev Stack: Why Every Engineer is Now a Target

Pat Johansen — Thu, 29 Oct 2026 19:51:47 +0000

When reading headlines about high-stakes intelligence operations involving AI tech giants, hardware export restrictions, and state-level surveillance, it is easy to view these events as distant geopolitical drama reserved for C-suite executives, intelligence agencies, and defense policy strategists.

However, for developers, systems architects, and DevOps engineers, treating these incidents as isolated executive-level news is a mistake.

The reality of modern software development is that the physical infrastructure of computing and the human relationships surrounding tech leadership are now core vectors of global geopolitics. Whether you write cloud-native microservices, fine-tune open-weight models, or build data center deployment pipelines, global tech espionage and supply chain security impact your day-to-day workflow.

1. The Compute Layer is the New Physical Border

For decades, software development operated under an implicit assumption of seamless international infrastructure: spin up nodes in any region, route traffic through global CDNs, and pull packages from decentralized mirrors.

That era is over. Compute has become a tightly regulated strategic resource.

Cloud Arbitrage & Geo-Fencing: Advanced chip designs and hardware acceleration (such as enterprise-grade AI clusters) are no longer just commodities—they are restricted assets. Cloud providers operating in neutral or intermediary regions face increasing regulatory scrutiny to prevent supply chain leaks and unauthorized remote access.

Hardware-Level Auditing: As export controls tighten globally, engineers working on cloud infrastructure are increasingly tasked with implementing rigorous identity, access management (IAM), and telemetry systems capable of verifying node geography and hardware provenance down to individual accelerators.

2. Social Engineering & Asset Targeting Have Shifted Downward

When foreign intelligence assets or threat actors target tech organizations, they do not only target CEOs at industry events. Cyber intelligence operations frequently leverage human network analysis to identify vulnerabilities lower down the technical hierarchy:

Targeting System Administrators & Core Contributors: Engineering leads, DevOps specialists, and core maintainers with elevated production access or internal repo privileges are high-value targets.

Supply Chain Contamination: Open-source maintainers are routinely targeted via social engineering, phishing, or malicious pull requests (such as the infamous xz backdoor incident). When geopolitical pressure escalates, open-source infrastructure becomes a battleground.

3. What Developers Must Implement Today

As software practitioners, how do we translate high-level security awareness into developer practices?

A. Zero Trust for Hardware & Cloud Provisioning

Never assume a remote compute node is secure simply because it sits inside a private VPC. Implement end-to-end cryptographic verification:

Attestation of remote execution environments (e.g., Confidential Computing/TEEs).

Strict egress/ingress network policies for all training and inference workloads.

B. Defense-in-Depth for Internal Access

Executive interactions and high-level corporate relationships should never bypass technical security controls:

Principle of Least Privilege (PoLP): No individual—regardless of role or executive status—should have direct, unmonitored access to raw IP, proprietary model weights, or sensitive customer telemetry without explicit, short-lived tokens and multi-party authorization.

Hardware Token Multi-Factor Authentication (MFA): Enforce FIDO2/WebAuthn security keys across all organizational tooling to neutralize credential harvesting.

C. Rigorous Open Source Dependency Auditing

Enforce Software Bill of Materials (SBOM) generation across your build pipelines.

Lock down package registries and utilize automated tools (e.g., sigstore, SLSA frameworks) to verify build provenance.

Final Thoughts

The intersection of hardware supremacy, AI capabilities, and international security means that software engineering is no longer politically neutral. As engineers building the software and systems of tomorrow, maintaining high standards of supply chain security, identity verification, and operational security (OpSec) is not just a corporate requirement—it is a baseline necessity in a hyper-connected world.

Further Reading & Sources

CNBC

"Nvidia responds to report Jensen Huang was target of Chinese asset, says diversion allegations were 'investigated and debunked'" (October 29, 2026)

https://www.cnbc.com/2026/10/29/nvidia-jensen-huang-chinese-intelligence-asset.html

The New York Times

Investigative Report on U.S. Intelligence Findings Regarding Megaspeed Executive Alice Huang and Chip Export Regulations (October 29, 2026)

Tom's Hardware

"Nvidia CEO Jensen Huang may have been the target of a spy plot through 'Chinese intelligence asset,' report claims" (October 29, 2026)

https://www.tomshardware.com/tech-industry/policy/nvidia-ceo-jensen-huang-may-have-been-the-target-of-a-spy-plot-through-chinese-intelligence-asset-report-claims

Livemint

"Nvidia responds to report on CEO Jensen Huang-alleged Chinese spy interactions: 'No trade secrets shared'" (October 29, 2026)

https://www.livemint.com/news/us-news/nvidia-responds-to-report-on-ceo-jensen-huang-alleged-chinese-spy-interactions-no-trade-secrets-shared-11793292256420.html

A.A. (Anadolu Agency)

"US intelligence identified Chinese executive with ties to Nvidia CEO as Beijing asset: Report" (October 29, 2026)

https://www.aa.com.tr/en/americas/us-intelligence-identified-chinese-executive-with-ties-to-nvidia-ceo-as-beijing-asset-report/4105343