LEXIS-NEXIS® Congressional Universe-Document

LEXIS-NEXIS® Congressional

May 26, 2000, Friday

SECTION: PREPARED TESTIMONY

LENGTH: 5433 words

HEADLINE: PREPARED TESTIMONY OF HAROLD J. JOHNSON ASSOCIATE DIRECTOR INTERNATIONAL RELATIONS AND TRADE ISSUES NATIONAL SECURITY AND INTERNATIONAL AFFAIRS DIVISION UNITED STATES GENERAL ACCOUNTING OFFICE

BEFORE THE SENATE GOVERNMENTAL AFFAIRS COMMITTEE

SUBJECT - EXPORT CONTROLS: CHALLENGES AND CHANGES FOR CONTROLS ON COMPUTER EXPORTS

BODY:
Mr. Chairman and Members of the Committee:

I am pleased to be here today to discuss export controls for high performance computers. My testimony is based on work that we have conducted over the past 3 years, particularly the reports we issued in 1998 and 1999.1

U.S. policy with respect to the export of sensitive technology, including computers, is to seek a balance between the U.S. economic interest in promoting exports and its national security interests in both maintaining a military advantage over potential adversaries and denying the spread of technologies used in developing weapons of mass destruction. The United States has long controlled the export of high performance computers/2 to sensitive destinations, such as Russia and China. These computers have both civilian (dual use) and military applications and technological advancements in computing power have been rapid. The Department of Commerce has primary responsibility for managing the licensing of these dual-use items and weighing the promotion of commercial interests in exporting items against the protection of national security interests. For the past several years, there has been continuing congressional concern about and debate over whether our national security is being harmed by relaxing export controls on high performance computers and over the rationale for subsequent revised controls. Today, I will discuss our observations about how the executive branch (1) assesses the national security risks associated with the export of high performance computers going to countries of concern, (2) determines when the exports of computers at existing performance levels can no longer be controlled, and (3) has addressed arrangements for post-shipment verifications of high performance computer exports.

RESULTS lN BRIEF

The executive branch has not clearly articulated the specific national security interests to be protected in controlling the export of computers at various performance levels, nor has it stated how countries of military concern could benefit from using such computers. Without a clear statement of these interests, it is unclear how the executive branch determines what are the militarily critical applications that may affect U.S. national security. In addition, the executive branch has relaxed export controls on computers because it believes that machines at the previously approved levels, had become so widely available in the market that their export is uncontrollable. Commerce defines controllability to include the "volume of sales" for certain types of microprocessors that can be easily assembled and maintained by foreign end users. The executive branch, however, relaxed controls based on what computer manufacturers asserted would be their next mass-produced processors, not on actual sales.

Post-shipment verifications confirm the physical location of high performance computers and, to the extent practical, verify if they are being used as intended. However, while post-shipment verifications are important for detecting and deterring physical diversions of computers, as traditionally conducted, they do not verify computer end use. Although the National Defense Authorization Act requires post- shipment verifications on all high performance computers exported since November 18, 1997, to tier 3 countries--whether licensed or not--Commerce has not visited high performance computers exported to China prior to an end-use arrangement reached in June 1998, and believes that to seek to do so would be futile.

BACKGROUND The U.S. export control system is about managing risk; exports to some countries involve less risk than to other countries and exports of some items involve less risk than do other items.Under U.S. law, the President has the authority to control and require licenses for the export of items that may pose a national security risk or foreign policy concern. The President also has the authority to remove or revise those controls as U.S. concerns and interests change. The U.S. export control system is administered by two agencies. The Commerce Department, through its Bureau of Export Administration, licenses sensitive dual-use items (items with both civil and military uses) under the Export Administration Act of 1979, as amended (P.L. 96-72).3 The State Department, through its Office of Defense Trade Controls, licenses munitions items under the Arms Export Control Act (P.L. 90- 629). Since the end of the Cold War, the number of items subject to export controls has been significantly reduced. For example, while 10 years ago, the Commerce Department reviewed about 100,000 license applications annually, today that figure is down to about 12,000 applications per year.

The U.S. government controls the export of high performance computers to certain countries based on foreign policy and/or national security concerns. High performance computers and related components (such as, processors) are controlled under the Export Administration Act, as continued by executive order, and the Export Administration Regulations. Executive Order 12981 authorizes the Departments of State, Energy, and Defense to review export applications and to consider export control policy.

Since 1993, the President has revised U.S. export control requirements for high performance computers four times, including a revision announced in February 2000. A revised export control policy implemented in January 1996 removed license requirements for most exports of computers with performance levels up to 2,000 millions of theoretical operations per second (MTOPS)4 (an increase from 1,500 MTOPS). The policy also organized countries into four computer "tiers," with each tier after tier 1 representing a successively higher level of concern related to U.S. national security interests.5 A dual control system was established for the 50 tier 3 countries, including China, Russia, India, and Israel: a license for potential military end-users is required at a lower MTOPS threshold than the threshold for civilian end-users. High performance computer exports to countries in tier 4 (for example, Iran, Iraq, and Libya) were essentially prohibited because of national security and foreign policy concerns about these countries.

The Fiscal Year 1998 National Defense Authorization Act (P.L. 105-85) modified the policy for determining whether an individual export license is needed and required exporters to notify the Commerce Department of any planned sales of computers with performance levels greater than 2,000 MTOPS to tier 3 countries. This level subsequently was increased to 6,500 MTOPS effective January 2000 and is scheduled to be increased to 12,500 MTOPS effective August 2000. If the Department of Commerce, Defense, State, or Energy, each of which reviews these notifications, objects to the export within 10 days, the exporter must then submit a license application.6

In addition, the act required the President to submit a report to Congress justifying any changes to the control levels for the notification process for the export of high performance computers to tier 3 countries.

The act requires the report, at a minimum, to (1) address the extent to which high performance computers with capabilities between the established level and the new proposed level of performance are available from other countries, (2) address all potential uses of military significance to which high performance computers at the new levels could be applied, and (3) assess the impact of potential military uses on U.S. national security interests. We reviewed the report submitted by the President on July 27, 1999, proposing changes to the current export control levels for high performance computers. We reported in November 1999 that the report did not fully satisfy the reporting requirements of the act.7 In particular, it did not assess the impact of the military uses of high performance computers on U.S. national security concerns.

On February 1, 2000, the President announced changes to the current export control levels for high performance computers. These changes included raising the performance threshold for computer exports that require a license for (1) tier 2 countries from 20,000 MTOPS to 33,000 MTOPS and (2) tier 3 countries from 6,500 MTOPS to 12,500 MTOPS for military end-users and from 12,300 MTOPS to 20,000 MTOPS for civilian end-users. The announcement indicated that the changes for tier 3 military end-users are to become effective in 6 months, while the changes for tier 3 civilian end-users became effectively immediately. The changes also raised the performance threshold for computer exports that require a notification to Commerce for tier 3 countries from 6,500 MTOPS to 12,500 MTOPS. By law, Congress has 6 months to review this decision, after which the change in notification levels will go into effect. We are currently assessing the justification for the February 1, 2000, changes to computer export control levels at the request of the Senate Armed Services Committee.

ASSESSING NATIONAL SECURITY RISKS FOR COMPUTER EXPORTS

Under U.S. export control policy, an analysis of establishing or revising controls on computers and other sensitive commodities generally is made in the context of the U.S. desire to limit the spread of technologies useful in both developing weapons of mass destruction and protecting the military capabilities of the United States and its allies. In many ways, the threat posed by an export is a relative one; that is, the threat depends on the U.S. capability to respond to enhancements the export would bring to the potential adversary's military capabilities. In order to maintain military superiority, the United States needs not only to control the spread of militarily sensitive technologies, but also to invest in leading edge technologies. However, this investment leads to the leading technologies of today becoming the "mass market" items in the future. Therefore, the United States must also quickly incorporate existing technologies into current and next generation weapon systems and manage the release of technology into the world market to "stay ahead of the curve."

While there appears to be general consensus that controlling high performance computers at some level is important to maintaining U.S. national security, DOD and the executive branch have not clearly articulated the specific national security interests to be protected in controlling the export of computers at various performance levels. In addition, they have not stated how countries of concern could benefit from using such computers. Without a clear analysis and explanation of the national security interest in controlling the export of high performance computers, the U.S. government cannot determine (1) what militarily critical computer applications need to be controlled or (2) the most effective way of implementing computer export controls. If such an analysis were made, it might also lead to a conclusion that the current reliance on MTOPS as the sole measure of a computer's sensitivity would no longer be appropriate. Indeed, with the rapid changes in computer architectures and the growth of what is called "distributed" computing,8 new approaches may be necessary to protect the national security interests in limiting potential adversaries' use of such machines in their research and development programs and their deployed weapon systems.

To illustrate the importance of identifying potential national security risks of computer exports, let me briefly highlight for you some of the military applications of high performance computers that have been identified in some Commerce and Defense Department-sponsored studies. These studies were conducted in 1995 and 1998 to support decisions on revising export controls over these computers.9 The Joint Strike Fighter has been designed using computers with 4,000 to 6,000 MTOPS of capability. Computers in this range now can be exported to military endusers in Russia or China without a license. Licenses for military end-users in these countries are required only for computers with performance levels above 6,500 MTOPs. Computers at 8,000 to 9,000 MTOPs are used for algorithm development for shipboard infrared search and track systems and modeling of submarine bottom designs for shallow water operations. While these computers currently require a license for export to military end-users in tier 3 countries, they would not be controlled under newly revised controls announced by the President on February 1 of this year. Under these new controls, only computers with more than 12,500 MTOPs that are to be exported to military end-users in countries like Russia and China would require a license.

- Designing submarines involves simulations of transmitting sounds through structures and in water, which are conducted at computer performance levels that are only slightly greater than the thresholds for which tier 3 countries may receive computer exports without a license. A Commerce- and Defense Department-sponsored study identified the use of a 21,000 MTOPS machine for this purpose. Some other related applications, such as acoustic sensor development and associated acoustic modeling, are executed on computers with performance only slightly greater than 20,000 MTOPS.

More generally, the 1995 Commerce- and Defense-sponsored study stated that there are research, development, test and evaluation applications at or above the 20,000 MTOPS level of great national security significance, the proliferation of which should be strictly controlled. With the executive branch's February export control change, high performance computers up to 20,000 MTOPS will be available to countries like Russia and China without a license. The appendix to this statement provides additional information on selected military applications for high performance computers.

DETERMINING WHEN COMPUTER EXPORTS CAN NO LONGER BE CONTROLLED

The previous examples illustrate the basis for our 1998 report's conclusion that the executive branch should clearly articulate the specific national security interests in limiting computer exports to potential adversaries when revising controls on high performance computers. In this regard, our September 1998 report/10 recommended that the Secretary of Defense assess and report on the national security threat and proliferation impact of U.S. exports of high performance computers to countries of national security and proliferation concern. We specified that, at a minimum, the assessment should address (1) how and at what performance levels countries of concern use these computers for military modernization and proliferation activities, (2) the threat of such uses to U.S. national security interests, and (3) the extent to which the export of such machines is controllable. The President's July 1999 report justifying changes to the control levels for computers did report that computers at all computing levels are important from the lowest performance levels to the highest. This conclusion, however, is general and was not supported by the level of analysis we recommended in our report, and does not address the serious concerns about the growing availability of high performance computers raised in the Commerce- and Defense Department-sponsored study issued in November 1995.

Although the examples just provided use MTOPS, this should not be construed to mean that MTOPS is the benchmark that should be used. Such a measure does not take into account advances in computer architectures that now allow the development of a large-scale, massively parallel computing resource from a cluster of commodity computing and networking components. In essence, by combining a number of readily available computers and networking components that would not require an export license, an organization can produce a very high powered computing resource. The operating system software that is necessary to utilize this resource is readily available from the Internet. However, a high performance computer by itself does not convey the ability to solve complex problems because application software is also necessary to conduct the proper analyses.

The task I have just described for the executive branch is not an easy one. It involves addressing difficult issues in an area of rapid technological change. Questions about the use of technology, the computer market, and DOD's own acquisition programs must be answered.

Some key questions include the following: Does U.S. national security interest include maintaining a relative computing power advantage in deployed weapon systems (for example, air defense radar or command and control systems)? Are different strategies necessary to respond to the threats posed by the use of high performance computers in research and development and in deployed weapon systems? Will the availability of high performance computers help other countries develop and deploy new weapons or allow them to counter U.S. superiority in certain military applications? Does the growth of distributed computing make the use of MTOPS obsolete as an export control measure by which to restrict computer exports?

Before leaving this topic, I want to point out that a critical analysis of national security applications of concern may lead to conclusions that are very different regarding export control levels than are currently in place or being proposed by the executive branch. Indeed, DOD may conclude that significant national security concerns involve computer performance levels that are higher than current control levels.

While the executive branch has not clearly articulated the national security interests in controlling high performance computers, it has developed a general explanation for its export decontrol decisions. In short, these decisions are based on conclusions that these computers are becoming widely available and, therefore, are uncontrollable.

It is important to note that the President's 1999 report to Congress concluded that there are militarily significant applications in the new control range, and, if not for their widespread availability, these applications would need to be controlled. These applications include advanced aircraft design, antisubmarine warfare sensor development, and radar applications. Consequently, the new control levels were not based on an assessment that these higher computing performance levels do not involve national security applications but rather that computers in this performance range are so widely available that they are uncontrollable.

Our November 1999 review of the changes in export control levels indicated that the administration's conclusions that the capabilities of high performance computers and related components, from both domestic and foreign sources, are generally increasing were supported because the United States does not generally control the export of computer processors and components. However, most sources of this supply are U.S. companies. Our earlier 1998 review reported that subsidiaries of U.S. computer manufacturers dominate the overseas high performance computer market and they must comply with U.S. controls. The 1998 study sponsored by DOD and Commerce/11 similarly found that the United States dominates the international computer market, at least in the mid- and high-range performance categories. Under current regulations, computer processors that perform up to 3,500 MTOPS can be directly exported to civilian end-users in many tier 3 countries including China and Russia. Exports of processors to such users in many other tier 3 countries, such as Israel and Saudi Arabia, are not subject to any MTOPS limit that requires a license. Exports of other key components for computer systems with four and eight processors are also not generally controlled; these parts can be shipped to tier 3 countries for civilian end-users, which could then use them to support the assembly of computers.

The administration's latest changes in the control levels for high performance computers were based on a determination that high performance computing capability is becoming increasingly available. For example, the 1999 changes in control levels were based on the conclusion that these capabilities are widely available and are therefore uncontrollable. The President's July 1999 report to Congress explaining these changes stated that due to the rapid advances in processor speeds and related technologies, foreign countries can obtain high performance computers directly or indirectly from a vendor, a reseller, or another third party or assemble such a computer using U.S. processors and components. According to administration officials, the specific export control levels announced in July 1999, and that went into effect in January 2000 for tier 3 military endusers, were based on the expected performance levels of computers using four and eight Intel Pentium processors that are projected to be on the market in July 2000.

While we found evidence to support the report's conclusion that computers with greater capabilities and related components are becoming increasingly available, we could not assess the administration's determination that computers rated below the new control levels are so widely available that they are effectively uncontrollable. An assessment of controllability involves critical evaluations of when and in what quantities an item should be considered so widely available as to be uncontrollable, and is dependent upon the resources applied by government and industry to control such exports. However, "widely available" and "uncontrollable" are terms not defined in current export control laws or regulations. Defense and Commerce Department officials stated that the analysis they prepared in support of the President's report relied on definitions that were developed in 1995 and 1998 studies they jointly sponsored. However, the discussion of the terms in these studies is general and without measurable criteria. Further, there is no mention in the President's 1999 report to Congress justifying the announced computer control revisions that defines how these concepts have been applied in setting the new export control levels. Thus, except to agree with the general conclusion in the President's report that the availability of computing power in the commercial marketplace is increasing, we could not determine if the executive branch is correct in concluding that export controls had to be relaxed for high performance computers. Consequently, our 1999 report recommended that the administration develop specific criteria defining both "widely available" and "controllability." In response to this recommendation, Commerce defined "controllability"--but not "widely available"--"as a function of (1) the volume of sales, particularly through mass market distribution channels, (2) the types of microprocessors used in HPC configurations (and in particular whether these are general purpose microprocessors suitable for mass market applications), and (3) the extent to which multi-processor configurations using such microprocessors and other widely available components (such as boards, chipsets and operating systems) could easily be assembled into finished computers and maintained by foreign end users.12

This discussion brings me to one final point. The Senate bill (S. 1712) to establish a new Export Administration Act uses the terms "mass market status" and "foreign availability status" as determinants for relaxing export controls. The first term is defined very similarly to how the administration appears to use the term "widely available" as it relates to high performance computers. Both terms imply that an item is so commercially available that it cannot be controlled, but without providing the quantifiable measures necessary to make such an analysis. S. 1712 does provide a number of general criteria that might be helpful in making decisions about controlling the export of high performance computers. However, in developing the implementing regulations, Commerce may wish to provide more objective and empirical criteria to use in making these decisions. If it does not, then when this rather subjective standard is applied in the future to items controlled under the act, it will be difficult to assess whether this standard was applied appropriately.The concept of "foreign availability," while part of the current Export Administration Regulations, would be changed to some extent by S. 1712. S. 1712 would authorize the Secretary of Commerce to determine that an item has foreign availability status -- and thus be excluded from export controls--if three conditions were met: (1) if the item is available to controlled countries from sources outside the United States, including countries that participate with the United States in multilateral export controls; (2) can be acquired at a price that is not excessive when compared to the price at which a controlled country could acquire such item from sources within the United States in the absence of export controls; and (3) is available in sufficient quantity so that the requirement of a license or other authorization with respect to the export of such an item is or would be ineffective. A proposed revision to S. 1712 would authorize the President to designate certain items on the national security control list to require enhanced security and, thus, to have them excluded from the mass market and foreign availability provisions.

Although the Export Administration Act does not mention price of an item as a criterion for determining foreign availability, it does set forth two additional factors that are not covered by S. 1712.13 Thus, S. 1712 does not include the two factors of "availability without restriction" and "comparable in quality to (items) produced in the United States" for determining foreign availability of an item.

POST-SHIPMENT VERIFICATIONS

Post-shipment verifications confirm the physical location of high performance computers and, to the extent practical, verify if they are being used as intended. However, there are limitations to determining end-use.

Although the National Defense Authorization Act requires post- shipment verifications on all high performance computers, whether licensed or not, exported since November 18, 1997, the date of the statute's enactment, to tier 3 countries, Commerce has not visited high performance computers exported to China prior to an end-use arrangement reached in June 199814 and believes that it would be futile to seek such visits. Also, Commerce stated that doing such post-shipment verifications would not be a good use of the Department's limited resources. As of September 1999, Commerce had completed verifications on 104 computer exports, or about 27 percent of those verifications required for the computers exported during fiscal year 1998, and 73 percent had not been completed. Two-thirds of the computers that had not then been verified involved exports to China. Chinese authorities would not allow post-shipment verifications to be conducted on computers shipped before the June 1998 arrangement because of sovereignty concerns. Also, verifications could not be conducted on 82 computers shipped after the June 1998 arrangement because the exports did not conform to the arrangement. Commerce regulations published in January 1999 established a mechanism for all future computer exports to comply with the arrangement so as to be eligible for a post-shipment verification.

While post-shipment verifications are important for detecting and deterring physical diversions of computers, verifications, as traditionally conducted, do not verify computer end use. According to Department of Energy officials, it is easy to conceal how a computer is being used. Although it is possible to verify how a computer is being used through such actions as reviewing internal computer data, this would be costly and intrusive, and require experts' sophisticated computer analysis. Furthermore, the U.S. government makes only limited efforts to monitor exporters' and end users' compliance with explicit conditions attached to export licenses for computers. It relies largely on computer exporters for end use monitoring. Commerce Department officials said that, ultimately, monitoring safeguards plans is the exporters' responsibility.

Mr. Chairman, this concludes my prepared testimony. I would be happy to respond to any questions you or other members may have.

FOOTNOTES:

1 Export Controls: Information on the Decision to Revise High Performance Computer Controls (GAO/NSIAD-98-196, Sept. 16, 1998) and Export Controls: Statutory Reporting Requirements for Computers Not Fully Addressed (GAO/NSIAD-00-45, Nov. 5, 1999)

2 The Commerce Department considers a high performance computer to be one that exceeds a defined performance threshold, thus requiring an export license.

3 The Export Administration Act terminated on August 20, 1994. Pursuant to Executive Order 12924, issued on August 19, 1994 (59 Fed. Reg. 43437) the President, to the extent permitted by law, extended the application of the act indefinitely. In addition, the Nuclear Regulatory Commission licenses exports of nuclear reactors. Dual-use nuclear exports are licensed by Commerce in consultation with a number of other agencies.

4 High performance computers are regulated based on their composite theoretical performance as measured by MTOPS.

5 The policy placed no license requirements on tier 1 countries, primarily those in Western Europe and Japan. Exports of high performance computers above 10,000 MTOPS to tier 2 countries in Asia, Africa, Latin America, and Central and Eastern Europe continued to require licenses.

6 In addition to reviewing notifications, State, Defense, and Energy also review export license applications that are submitted directly to Commerce.

7 Export Controls: Statutory Reporting Requirements for Computers Not Fully Addressed (GAO/NSIAD00-45, Nov. 5, 1999)

8 "Distributed" or "parallel processing" means breaking computational problems into many separate parts and having a large number of processors tackle those parts simultaneously. Greatly increased processing speed is achieved largely through the sheer number of processors operating simultaneously, rather than through any exceptional power in each processor.

9 Building on the Basics: An Examination of High-Performance Computing Export Control Policy in the 1990s (1995) and High-Performance Computing, National Security Applications, and Export Control

10 Export Controls: Information on the Decision to Revise High Performance Computer Controls (GAO/NSIAD-98-196, Sept. 16, 1998).

11 High-Performance Computing, National Security Applications, and Export Control Policy at the Close of the 20th Century (1998).

12 The Under Secretary for Export Administration in a February 16, 2000, letter to the General Accounting Office stated that, in consultation with the Department of Defense, the Commerce Department had defined "controllability."

13 The Act prohibits export controls for foreign policy or national security purposes on the U.S. exports of goods or technology which the President determines are (1) available without restriction (emphasis added) from sources outside the United States (2) in sufficient quantifies and (3) comparable in quality to those produced in the United States so as to render the controls ineffective in achieving their purposes. Even when these conditions are met, the President may determine that adequate evidence has been presented to him demonstrating that the absence of such controls would prove detrimental to the foreign policy or national security of the United States.

14 The arrangement provides that China (1) considers requests from the U.S. Commerce Department to verify the actual end use of a U.S. high performance computer to be non-binding; (2) insists that any enduse verification, if it agrees to one, be conducted by one of its own ministries, not by U.S. representatives; (3) takes the view that U.S. Embassy and Consulate commercial service personnel may not attend an enduse verification, unless they are invited by the Chinese government; (4) argues that scheduling of any enduser verification-- whether to permit it at all--is at the discretion of the government; and (5) will not permit any end-use verification of a U.S. high performance computer at any time after the first six months of the computer's arrival in China.

END

LOAD-DATE: May 27, 2000