GAO United States General Accounting Office Testimony Before the Subcommittee on International Security, Proliferation, and Federal Services, Committee on Governmental Affairs, U.S. Senate For Release on Delivery Expected at 2:00 p.m., EDT Wednesday, September 16, 1998 EXPORT CONTROLS Changes in Controls Applied to the Export of High Performance Computers Statement of Harold J. Johnson, Associate Director, International Relations and Trade Issues, National Security and International Affairs Division GAO/T-NSIAD-98-250 ================================================================ Mr. Chairman and Members of the Committee: We are pleased to be here today to discuss export controls on high performance computers (HPC). Since January 1996, when the executive branch raised the thresholds of computer performance for which exporters must obtain a license, several unlicensed HPCS were exported to Russia and China, including some sent illegally to a Russian nuclear weapons laboratory. You expressed concern about these sales, and asked us to (1) assess the basis for the executive branch's revision of HPC export controls and (2) identify changes in licensing activities and export enforcement requirements resulting from the revision. You also asked that we determine the current foreign availability of HPCS, particularly for countries of national security concern. Because the unlicensed exports to Russia and China were under investigation by the Departments of Commerce and Justice and the Customs Service, we did not specifically address this matter during our assessment. Also, it is important to note that we did not determine the appropriate thresholds for controlling HPC exports, but instead, as you requested, we evaluated the process by which the executive branch made its decisions and the adequacy of the information it had available for this purpose. Our report on the decision to revise HPC export controls is being released today,1 as is our companion report responding to Section 1214 of the Fiscal Year 1998 National Defense Authorization Act;2 therefore, my prepared statement will summarize our principal findings. However, to facilitate an understanding of the issues, I believe that a brief background may be useful. ---------------------------------------------------------------- Background As we have stated in previous testimony,3 the U.S. export control system is about managing risk; exports to some countries involve less risk than to other countries and exports of some items involve less risk than others. The President has the responsibility and authority to control and require licenses for the export of items that may pose a national security or foreign policy concern, and he may remove or revise export controls as ---------------------------------------------------------------- 1 Export Controls: Information on the Decision to Revise High Performance Computer Controls (GAO/NSIAD-98-196, Sept. 16, 1998). 2 Export Controls: National Security Issues and Foreign Availability for High Performance Computer Exports (GAO/NSIAD-98-200, Sept. 16, 1998). 3 Export Controls: Issues Related to Commercial Communications Satellites (GA0/T-NSIAD-98-208, June 10, 1998). Page 1 ================================================================ U.S. concerns and interests change.4 It should be noted that the law does not require that a foreign availability 5 analysis be performed when deciding to remove or relax export controls. In 1995, the executive branch conducted a review of export controls on computer exports to determine how changes in computer technology and its military applications should affect U.S. export control regulations. This review was the continuation of a process begun in the 1980s to take into account the technological advancements in the computer industry. It may be useful to note that as recently as 1993, the export of computers with a composite theoretical performance of 195 millions of theoretical operations per second (MTOPS)6 were controlled. This was raised to 1,500 MTOPS in February 1994. A key element of the executive branch review was a Stanford University study, jointly commissioned by the Departments of Commerce and Defense (DOD).7 Among other things, the study concluded that (1) U.S.-manufactured computer technology with a composite theoretical performance of up to 4,000 to 5,000 MTOPS were currently widely available and uncontrollable worldwide, (2) computers with a performance level of up to 7,000 MTOPS would become widely available and uncontrollable worldwide by 1997, and (3) many HPC applications used in U.S. national security programs occur at about 7,000 MTOPS and at or above 10,000 MTOPS. The study also concluded that it would be too expensive for government and industry to effectively control exports of computing systems with performance below 7,000 MTOPS, and that attempts to control HPC exports below this level would become increasingly ineffectual, and would unreasonably burden a vital sector of the computer industry. In announcing its January 1996 change to HPC controls, the executive branch stated that one goal of the revised export controls was to permit the government to tailor control levels and licensing conditions to the ---------------------------------------------------------------- 4 In this report, revision of export controls refers to removal of licensing requirements for groups of countries based on the performance levels of HPCs. 5 The Export. Administration Act of 1979, as amended, describes foreign availability as goods or technology available without restriction to controlled destinations from sources outside the United States in sufficient quantities and comparable quality to those produced in the United States so as to render the controls ineffective in achieving their purposes. 6 MTOPS is the composite theoretical performance of a computer measured in millions of theoretical operations per second. In principle, higher MTOPS indicates greater raw performance of a computer to solve computations quickly, but not the actual performance of a given machine for a given application. 7 Building on the Basics: An Examination of High-Performance Computing Export Control Policy in the 1990's, Seymour Goodman, Peter Wolcott, and Grey Burkhart, (Center for International Security and Arms Control, Stanford University, November 1995). Page 2 ================================================================ national security or proliferation risk posed at a specific destination. The revised export control policy removed license requirements for most HPC exports with performance levels up to 2,000 MTOPS--an increase from the previous level of 1,500 MTOPS. The policy also organized countries into four "computer tiers," with each tier after tier 1 representing a successively higher level of concern to U.S. security interests. A dual-control system was established for tier 3 countries, such as Russia and China. For these countries, HPCS up to 7,000 MTOPS could be exported to civilian end users without a license, while exports at and above 2,000 MTOPS to end users of concern for military or proliferation of weapons of mass destruction reasons required a license. Exports of HPCs above 7,000 MTOPS to civilian end users also required a license. The January 1996 regulation also made other changes. It specified that exporters would be responsible for (1) determining whether an export license is required, based on the MTOPS level of the computer; (2) screening end users and end uses for military or proliferation concerns, and (3) keeping records and reporting on exports of computers with performance levels of 2,000 MTOPS.8 The Fiscal Year 1998 National Defense Authorization Act (P.L. 105-85) modified the 1996 revisions by requiring exporters to notify the Department of Commerce of any planned sales of computers with performance levels greater than 2,000 MTOPS tO tier 3 countries. The government has 10 days to assess and object to a proposed HPC sale without a license. The law also now requires Commerce to perform post-shipment verifications (PSV) on all HPC exports with performance levels over 2,000 MTOPS to tier 3 countries.9 ---------------------------------------------------------------- Summary As I indicated, one focus of our work was to assess whether the empirical evidence presented in the Stanford study--a key element in the decision to revise HPC export controls--supports its conclusions. Our analysis showed that it had two significant limitations. First, the study lacked empirical evidence or analysis to support its conclusion that HPCS were uncontrollable based on (1) worldwide availability and (2) insufficient resources to control them. Second, the study did not assess the capabilities of countries of concern to use HPCS for military and other national security applications, as required by its tasking. The study's principal author said that U.S. government data was insufficient to make ---------------------------------------------------------------- 8 in addition to the standard record-keeping requirements, the regulation added requirements for the date of the shipment, the name and address of the end user and of each intermediate consignee, and the end use of each exported computer 9 The Commerce Department promulgated regulations implementing the law on February 3, 1998. Page 3 ================================================================ such an assessment, and the study recommended that better data be gathered so that such an analysis could be done in the future. Except for nuclear weapons, the executive branch has not completed an assessment of the national security risks of exporting HPCs to tier 3 countries, and the nuclear weapons assessment was completed by the Department of Energy (DOE) in June 1998, more than 2 years after the export control policies for HPCS were revised. The executive branch has identified high performance computing as having applications in such national defense areas as nuclear weapons programs, cryptology, conventional weapons, and military operations. However, except for nuclear weapons, the executive branch has not identified how and at what performance levels specific countries of concern may use HPCs for national defense applications--an important factor in assessing risks of HPC sales. In December 1997, the House Committee on National Security directed DOE and DOD to assess the national security impacts of HPC sales to tier 3 COUntries. DOE'S study on nuclear weapons shows that nuclear weapons programs in tier 3 countries, especially those of China, India, and Pakistan, could benefit from the acquisition of HPC capabilities. The executive branch has not yet finished identifying how specific countries of concern would use HPCS for nonnuclear national defense applications. Nonetheless, based on its view of the worldwide availability of computing power and the technological advancements in this area, the executive branch raised the MTOPS thresholds for HPC export controls. The 1996 revision to HPC export controls had three key consequences. First, by increasing the performance thresholds for computers that require a license, the 1996 revisions decreased the number of license applications from 459 in fiscal year 1995 to 125 in 1997 and of approved export license applications for HPCS from 395 in fiscal year 1995 to 42 in 1997. Second, the revision shifted some of the government's end use screening responsibilities from the government to the computer industry. In essence, the exporters had to decide whether a license was required since the decision is made on the basis of the end use, the end user, and the computer performance capability. This decision could be particularly difficult for exports to a tier 3 country, like China, where identifying the distinction between a civilian and military end user can be very difficult. In response to several allegations of improper sales to Russia and China, Congress partly reversed this situation by passing the Fiscal Year 1998 National Defense Authorization Act, which requires exporters to notify the Page 4 ================================================================ Commerce Department of all HPC sales over 2,000 MTOPS to tier 3 countries prior to their export. Third, the regulation required HPC manufacturers to keep records of the end users of all their HPC exports over 2,000 MTOPS. Based on our review of records provided by the manufacturers to the Commerce Department from January 1996 through September 1997, we noted that China ranked first in the number of HPCS acquired by tier 3 countries, having purchased a total of 77 HPCS during this period. These exports were all made without an individual license being required. Examining how these machines are being used was beyond the scope of this review. Responsibility for PSV checks on exports remained with the government, but information on these exports reported to the government has been incomplete. PSVS for computers generally have been of reduced value because of how this process is implemented. First, Psvs verify the physical location of an HPC, but not how it is used. Also, some governments, such as China, have not allowed the United States to conduct PSVS. With regard to foreign availability of HPCS 10 we found that subsidiaries of U.S. computer manufacturers dominate the overseas HPC market and they must comply with U.S. controls. Russia, China, and India have developed HPCS, but their capabilities are believed to be limited. Thus, our analysis suggests that HPCS over 2,000 MTOPS are not readily available to tier 3 countries from foreign sources without restriction. The report contains two recommendations: one that requires action by the Secretary of Defense, and one that requires action by the Secretary of Commerce with support from DOD, DOE, the Department of State, and the Arms Control and Disarmament Agency (ACDA). First, we recommended that to complement the studies undertaken by POD and DOE for the House Committee on National Security, the Secretary of Defense assess and report on the national security threat and proliferation impact of U.S. exports of HPCS to countries of national security and proliferation concern. This assessment, at a minimum, should address (1) how and at what performance levels countries of concern use HPCS for military modernization and proliferation activities, (2) whether such uses are a threat to U.S. national security interests, and (3) the extent to which such HPCS are controllable. ---------------------------------------------------------------- 10 We used the description of foreign availability described in footnote 5 as our criteria. Page 5 ================================================================ Second, upon completion of the analysis suggested in our first recommendation, we also recommended that the Secretary of Commerce, in conjunction with the other agencies I mentioned, jointly evaluate and report on options to safeguard U.S. national security interests regarding HPCS. Such options should include, but not be limited to, (1) requiring government review and control of the export of computers at their highest scalable MTOPS performance levels and (2) requiring that HPCS destined for tier 3 countries be physically modified to prevent upgrades beyond the allowed levels. I would also like to comment just briefly on the agencies' response to our report. In addition to Commerce and DOD, DOE, the Department of State, and ACDA offered their views. Commerce said that the President's decision was intended to change the computer export policy from what it referred to as "a relic of the Cold War to one more in tune with today's technology and international security environment," and was based on (1) rapid technological changes in the computer industry, (2) wide availability, (3) limited controllability, and (4) limited national security applications for HPCS. Commerce further stated that our report focused too much on how countries might use HPCS for proliferation or military purposes and on what it called an outdated Cold War concept of "foreign availability". The Commerce said that our analysis of foreign availability was too narrow and that foreign availability is not an adequate measure of the problem. We agree that rapid technological advancements in the computer industry have made the controllability of HPC exports a more difficult problem; however, we disagree that foreign availability is an outdated Cold War concept that has no relevance in today's environment. While threats to U.S. security may have changed, they have not been eliminated. Commerce itself recognized this in its March 1998 annual report to Congress which stated that "the key to effective export controls is setting control levels above foreign availability." Moreover, the concept of foreign availability, as opposed to Commerce's notion of "worldwide" availability, is still described in the Export Administration Act and Export Administration Regulations as a factor to be considered in export control policy. Commerce also commented that the need to control the export of HPCS because of their importance for national security applications is limited. It stated that many national security applications can be performed satisfactorily on uncontrollable low-level technology, and that computers Page 6 ================================================================ are not a "choke point" for military production. Commerce said that having access to HPCS alone will not improve a country's military-industrial capabilities. Commerce offered no specific evidence to support this point of view; moreover, its view seems to be inconsistent with the requirement for DOD to identify militarily critical technologies. In assessing these militarily critical technologies, DOD has determined that high performance computing is an enabling technology for modern tactical and strategic warfare and is also important in the development, deployment, and use of weapons of mass destruction. High performance computing has also played a major role in the ability of the United States to maintain and increase the technological superiority of its war-fighting support systems. DOD has noted in its High Performance Computing Modernization Program annual plan that the use of HPC technology has led to lower costs for system deployment and improved the effectiveness of complex weapons systems. DOD further stated that as it transitions its weapons system design and test process to rely more heavily on modeling and simulation, the nation can expect many more examples of the profound effects that the HPC capability has on both military and civilian applications. In its comments on our report, DOD said that it had considered the threats associated with HPC exports to countries of national security and proliferation concern. In this context, DOD referred to its identification of how HPCS in the United States are used for national security applications. While our report recognized that such an assessment of domestic uses had been done, this did not address our concern. We reported that (1) the Stanford study did not assess the capabilities of countries of concern, such as China, Russia, India, or Pakistan, to use HPCS for military and other national security applications, as required by its tasking and (2) the executive branch did not undertake a threat analysis of providing HPCS to such countries of concern. As we reported, the principal author of the Stanford study noted that no assessment had been done of the national security impact of allowing HPCS to go to particular countries of concern and of what military advantages such countries could achieve. In fact, the April 1998 Stanford study on HPC export controls by the same principal author also noted that identifying which countries could use HPCS to pursue which military applications remained a critical issue on which the executive branch provided little information. The Department of State, DOE, and ACDA generally agreed with our report. Page 7 ================================================================ Mr. Chairman, that concludes our prepared testimony. My colleagues and I would be happy to respond to any questions you or other members may have.
All content COPYRIGHT SOFTWAR (C) 2000. Any reproduction or use of content herein must be approved by SOFTWAR.