The damage caused by Hurricane Helene in Spruce Pine will likely cause disruptions at the start of the microchip and integrated circuit (IC) supply chain by preventing the mining and distribution of high purity quartz until the mines and local transportation networks are fully repaired.
BACKGROUND
Hurricane Helene Impacts
In late September 2024, Hurricane Helene impacted the Caribbean, Florida, Georgia, Tennessee, North Carolina and other southeastern states in the United States[1]. Its impacts varied widely depending on location and the associated exposure to the primary effects – wind, rain, and storm surge – of the hurricane. While Florida was primarily affected by wind and storm surge, and Georgia was impacted by wind, Tennessee and western North Carolina faced torrential rainfall from Helene after significant rainfall from another storm system in the prior days.
These rains produced catastrophic flooding in the mountains of Tennessee[2] and North Carolina[3], which caused tremendous damage to road and rail transportation networks in affected areas. In western North Carolina, the state’s Department of Transportation advised, “All roads in Western NC should be considered closed[4].”
Spruce Pine High-quality Quartz Mine
Located in the Blue Ridge Mountains of western North Carolina[5], Spruce Pine is the source of the world’s highest quality (ultra-pure) quartz. Major mine owners and operators in the Spruce Pine area include Sibelco, a Belgium-based corporation[6], and The Quartz Corp, a Norway-based corporation. The quartz from this area is critical in the manufacture of semiconductors, photovoltaic cells, and optical fiber. As Sibelco explains, high purity quartz (HPQ) sands are used to produce “fused quartz[7] (almost pure amorphous silicon dioxide) crucibles used in the Czochralski process[8], and the production of fused quartz tubing and ingots used to create fabricated quartzware for the semiconductor wafer process[9].”
Sibelco has increased production of HPQ by 60% since 2019, and is investing an additional 200-million-USD to increase production by an additional 200-percent in 2024 to meet expected increases in market demand[10]. Unfortunately, operations are currently suspended at the mine due to the hurricane’s disruption of the most basic services, including road and rail links[11]. The CSX Transportation rail line into Spruce Pine is severely damaged, with entire bridges missing[12].
Alternatives for HPQ
There are slower, more expensive processes that make use of lower quality quartz inputs. Brazil, India, and the Russian Federation (Russia) are other sources of HPQ, but not the same in quality or amount[13]. Additional sources of varying quantity and quality exist in Madagascar, Norway, and the People’s Republic of China (PRC).
CONSEQUENCES
Why IOActive Cares
This incident involves key areas of Interest for IOActive – areas in which we have made significant investments to help our clients protect themselves. Specifically, this incident involves impacts to microchips and integrated circuits (ICs)[14], supply chain risks[15], and multimodal transportation and logistics[16].
Potential Supply Chain Impacts
Predictions and forecasts are only ever certain to be wrong, but they provide useful insight into possible future states, which aid decision makers and stakeholders in managing the risks. The key variable for this event is how long operations at the Spruce Pine mines might be suspended due to local impacts (mine-specific operational issues) or regional issues (such as multimodal transportation network disruption) stemming from the effects of Hurricane Helene.
Temporary repairs to bridges can be made in a matter of days, weeks, or months, depending on the level of damage, while more permanent repairs taking many months or years are planned and completed. Unfortunately, these temporary repairs may limit the weight of crossing vehicles until those permanent repairs are completed. The complete loss of several road and rail bridges and the washed-out sections of roads and rail lines will require several years to fully repair and return to full capacity. The extensive damage to the road and rail networks serving the Spruce Pine area will impact the mine operations for some time, but will likely be operating in a reduced, degraded state within a few months, assuming no additional natural disasters.
Cybersecurity Risks
When observing a consequential event such as an accident, storm, or other disaster, it’s helpful to ponder whether those same consequences can be produced from a cyberattack. It can be nearly impossible for anyone to comprehensively understand all the different failure modes of a complex system or system of systems. A convenient shortcut for a cyber threat actor is to look to recreate previous system failure modes rather than search for unique ones. Reviewing the consequences of this incident reveals several vectors that could allow a highly capable, determined threat actor to launch a cyberattack to shut down mining operations in Spruce Pines.
Broadly, attack targets could include locomotives or commercial vehicles operated on the roads, rail line signaling equipment, or mine information technology (IT) and operational technology (IT) systems. This assessment is based on the results of our public research and our confidential commercial work. A successful attack on any of these targets could produce a consequential impact for mining operations, but the duration of the impact is unlikely to be as long as the impacts from Hurricane Helene.
RECOMMENDATIONS
Risk Management
Since the Spruce Pine mines are such an important node in the global supply chain for microchips and ICs, additional all-hazards risk management and mitigation action should be taken at both the state and federal levels to ensure fewer, shorter interruptions and more resilient operations.
Cybersecurity
Strategically important mines such as this should have requirements for strong cybersecurity, including both IT and OT assets, to ensure that there are minimal to no operational disruptions from a cyberattack.
National Security
As the United States confronts the malign activities of the PRC, it should consider restrictions on key inputs to microchips and ICs, including HPQ, in addition to the existing restrictions on high-performance computing resources like GPUs[17] and semiconductor manufacturing equipment like lithography equipment[18].
[1] https://en.wikipedia.org/wiki/Hurricane_Helene
[2] https://www.knoxnews.com/story/weather/2024/09/30/hurricane-helene-deadly-east-tennessee-floods-what-to-know-schools-roads/75447229007/
[3] https://climate.ncsu.edu/blog/2024/09/rapid-reaction-historic-flooding-follows-helene-in-western-nc/
[4] https://x.com/NCDOT/status/1839685402589827554
[5] 7638 South Highway 226, Spruce Pine, NC, 28777, United States
[6] https://www.sibelco.com/en/about-us
[7] https://en.wikipedia.org/wiki/Fused_quartz
[8] https://www.sciencedirect.com/topics/chemistry/czochralski-process
[9] https://www.sibelco.com/en/materials/high-purity-quartz
[10] https://assets-eu-01.kc-usercontent.com/54dbafb3-2008-0172-7e3d-74a0128faac8/64fae543-971f-46f5-9aec-df041f6f50f6/Webcast_H1_2024_Results_final.pdf
[11] https://www.thequartzcorp.com/articles/impact-of-hurricane-helene-on-the-quartz-corp-in-spruce-pine
[12] https://www.freightwaves.com/news/csxs-former-clinchfield-railroad-barely-recognizable-after-historic-flood
[13] http://www.sinosi.com/hotsales/Product/02%20HPQ%20Promotion%20_English%20Version.pdf
[14] https://ioactive.com/service/full-stack-security-assessments/silicon-security/
[15] https://ioactive.com/supply-chain-risks-go-beyond-cyber/
[16] https://ioactive.com/industry/transportation/
[17] https://www.reuters.com/technology/nvidia-may-be-forced-shift-out-some-countries-after-new-us-export-curbs-2023-10-17/
[18] https://www.csis.org/analysis/updated-october-7-semiconductor-export-controls