From Containers to Code: Applying Post-9/11 Trade Security Lessons to the Software Supply Chain

This working paper examines how lessons from post-9/11 global trade security initiatives can inform current open source software supply chain security challenges. The authors argue that despite dealing with different domains—physical goods versus digital code—both face similar fundamental questions about managing risk in complex, multi-actor systems where trust is essential but vulnerable to exploitation. The ongoing research, funded by the Digital Infrastructure Insights Fund, analyzes successful trade security programs like C-TPAT and CSI, focusing on their incentive-based structures, public-private partnerships, and harmonized international standards, to develop actionable recommendations for software security policy. Rather than punitive regulatory approaches, the authors advocate for a framework that emphasizes positive incentives, investment in critical infrastructure, collaborative risk assessment tools, and international standards—moving beyond simple analogies like Software Bill of Materials to create trusted actor programs similar to those that succeeded in trade security