GAO

United States General Accounting Office Testimony

Before the Subcommittee on International Security,
Proliferation, and Federal Services, Committee on Governmental
Affairs, U.S. Senate

For Release on Delivery
Expected at
2:00 p.m., EDT
Wednesday,
September 16, 1998

EXPORT CONTROLS

Changes in Controls Applied to the Export of High Performance
Computers

Statement of Harold J. Johnson, Associate Director,
International Relations and Trade Issues, National Security and
International Affairs Division

GAO/T-NSIAD-98-250

================================================================

Mr. Chairman and Members of the Committee:

We are pleased to be here today to discuss export controls on
high performance computers (HPC). Since January 1996, when the
executive branch raised the thresholds of computer performance
for which exporters must obtain a license, several unlicensed
HPCS were exported to Russia and China, including some sent
illegally to a Russian nuclear weapons laboratory. You expressed
concern about these sales, and asked us to

(1) assess the basis for the executive branch's revision of HPC
export controls and

(2) identify changes in licensing activities and export
enforcement requirements resulting from the revision. 

You also asked that we determine the current foreign
availability of HPCS, particularly for countries of national
security concern. Because the unlicensed exports to Russia and
China were under investigation by the Departments of Commerce
and Justice and the Customs Service, we did not specifically
address this matter during our assessment. Also, it is important
to note that we did not determine the appropriate thresholds for
controlling HPC exports, but instead, as you requested, we
evaluated the process by which the executive branch made its
decisions and the adequacy of the information it had available
for this purpose.

Our report on the decision to revise HPC export controls is
being released today,1 as is our companion report responding to
Section 1214 of the Fiscal Year 1998 National Defense
Authorization Act;2 therefore, my prepared statement will
summarize our principal findings. However, to facilitate an
understanding of the issues, I believe that a brief background
may be useful.

----------------------------------------------------------------
Background

As we have stated in previous testimony,3 the U.S. export
control system is about managing risk; exports to some countries
involve less risk than to other countries and exports of some
items involve less risk than others.  The President has the
responsibility and authority to control and require licenses for
the export of items that may pose a national security or foreign
policy concern, and he may remove or revise export controls as

----------------------------------------------------------------
1 Export Controls: Information on the Decision to Revise High
Performance Computer Controls (GAO/NSIAD-98-196, Sept. 16,
1998).

2 Export Controls: National Security Issues and Foreign
Availability for High Performance Computer Exports
(GAO/NSIAD-98-200, Sept. 16, 1998).

3 Export Controls: Issues Related to Commercial Communications
Satellites (GA0/T-NSIAD-98-208, June 10, 1998).

Page 1
================================================================

U.S. concerns and interests change.4  It should be noted that
the law does not require that a foreign availability 5 analysis
be performed when deciding to remove or relax export controls.

In 1995, the executive branch conducted a review of export
controls on computer exports to determine how changes in
computer technology and its military applications should affect
U.S. export control regulations. This review was the
continuation of a process begun in the 1980s to take into
account the technological advancements in the computer industry.
It may be useful to note that as recently as 1993, the export of
computers with a composite theoretical performance of 195
millions of theoretical operations per second (MTOPS)6 were
controlled. This was raised to 1,500 MTOPS in February 1994.

A key element of the executive branch review was a Stanford
University study, jointly commissioned by the Departments of
Commerce and Defense (DOD).7  Among other things, the study
concluded that (1) U.S.-manufactured computer technology with a
composite theoretical performance of up to 4,000 to 5,000 MTOPS
were currently widely available and uncontrollable worldwide,
(2) computers with a performance level of up to 7,000 MTOPS
would become widely available and uncontrollable worldwide by
1997, and (3) many HPC applications used in U.S. national
security programs occur at about 7,000 MTOPS and at or above
10,000 MTOPS.  The study also concluded that it would be too
expensive for government and industry to effectively control
exports of computing systems with performance below 7,000 MTOPS,
and that attempts to control HPC exports below this level would
become increasingly ineffectual, and would unreasonably burden a
vital sector of the computer industry.

In announcing its January 1996 change to HPC controls, the
executive branch stated that one goal of the revised export
controls was to permit the government to tailor control levels
and licensing conditions to the

----------------------------------------------------------------

4 In this report, revision of export controls refers to removal
of licensing requirements for groups of countries based on the
performance levels of HPCs.

5 The Export. Administration Act of 1979, as amended, describes
foreign availability as goods or technology available without
restriction to controlled destinations from sources outside the
United States in sufficient quantities and comparable quality to
those produced in the United States so as to render the controls
ineffective in achieving their purposes.

6 MTOPS is the composite theoretical performance of a computer
measured in millions of theoretical operations per second. In
principle, higher MTOPS indicates greater raw performance of a
computer to solve computations quickly, but not the actual
performance of a given machine for a given application.

7 Building on the Basics: An Examination of High-Performance
Computing Export Control Policy in the 1990's, Seymour Goodman,
Peter Wolcott, and Grey Burkhart, (Center for International
Security and Arms Control, Stanford University, November 1995).

Page 2
================================================================

national security or proliferation risk posed at a specific
destination. The revised export control policy removed license
requirements for most HPC exports with performance levels up to
2,000 MTOPS--an increase from the previous level of 1,500 MTOPS.
The policy also organized countries into four "computer tiers,"
with each tier after tier 1 representing a successively higher
level of concern to U.S. security interests. A dual-control
system was established for tier 3 countries, such as Russia and
China. For these countries, HPCS up to 7,000 MTOPS could be
exported to civilian end users without a license, while exports
at and above 2,000 MTOPS to end users of concern for military or
proliferation of weapons of mass destruction reasons required a
license. Exports of HPCs above 7,000 MTOPS to civilian end users
also required a license.

The January 1996 regulation also made other changes. It
specified that exporters would be responsible for (1)
determining whether an export license is required, based on the
MTOPS level of the computer; (2) screening end users and end
uses for military or proliferation concerns, and (3) keeping
records and reporting on exports of computers with performance
levels of 2,000 MTOPS.8 The Fiscal Year 1998 National Defense
Authorization Act (P.L. 105-85) modified the 1996 revisions by
requiring exporters to notify the Department of Commerce of any
planned sales of computers with performance levels greater than
2,000 MTOPS tO tier 3 countries. The government has 10 days to
assess and object to a proposed HPC sale without a license. The
law also now requires Commerce to perform post-shipment
verifications (PSV) on all HPC exports with performance levels
over 2,000 MTOPS to tier 3 countries.9

----------------------------------------------------------------
Summary

As I indicated, one focus of our work was to assess whether the
empirical evidence presented in the Stanford study--a key
element in the decision to revise HPC export controls--supports
its conclusions. Our analysis showed that it had two significant
limitations. First, the study lacked empirical evidence or
analysis to support its conclusion that HPCS were uncontrollable
based on (1) worldwide availability and (2) insufficient
resources to control them. Second, the study did not assess the
capabilities of countries of concern to use HPCS for military
and other national security applications, as required by its
tasking. The study's principal author said that U.S. government
data was insufficient to make

----------------------------------------------------------------
8 in addition to the standard record-keeping requirements, the
regulation added requirements for the date of the shipment, the
name and address of the end user and of each intermediate
consignee, and the end use of each exported computer

9 The Commerce Department promulgated regulations implementing
the law on February 3, 1998.

Page 3
================================================================

such an assessment, and the study recommended that better data
be gathered so that such an analysis could be done in the
future.

Except for nuclear weapons, the executive branch has not
completed an assessment of the national security risks of
exporting HPCs to tier 3 countries, and the nuclear weapons
assessment was completed by the Department of Energy (DOE) in
June 1998, more than 2 years after the export control policies
for HPCS were revised. The executive branch has identified high
performance computing as having applications in such national
defense areas as nuclear weapons programs, cryptology,
conventional weapons, and military operations. However, except
for nuclear weapons, the executive branch has not identified how
and at what performance levels specific countries of concern may
use HPCs for national defense applications--an important factor
in assessing risks of HPC sales.

In December 1997, the House Committee on National Security
directed DOE and DOD to assess the national security impacts of
HPC sales to tier 3 COUntries. DOE'S study on nuclear weapons
shows that nuclear weapons programs in tier 3 countries,
especially those of China, India, and Pakistan, could benefit
from the acquisition of HPC capabilities. The executive branch
has not yet finished identifying how specific countries of
concern would use HPCS for nonnuclear national defense
applications.

Nonetheless, based on its view of the worldwide availability of
computing power and the technological advancements in this area,
the executive branch raised the MTOPS thresholds for HPC export
controls. The 1996 revision to HPC export controls had three key
consequences.

First, by increasing the performance thresholds for computers
that require a license, the 1996 revisions decreased the number
of license applications from 459 in fiscal year 1995 to 125 in
1997 and of approved export license applications for HPCS from
395 in fiscal year 1995 to 42 in 1997.  

Second, the revision shifted some of the government's end use
screening responsibilities from the government to the computer
industry.  In essence, the exporters had to decide whether a
license was required since the decision is made on the basis of
the end use, the end user, and the computer performance
capability. This decision could be particularly difficult for
exports to a tier 3 country, like China, where identifying the
distinction between a civilian and military end user can be very
difficult. In response to several allegations of improper sales
to Russia and China, Congress partly reversed this situation by
passing the Fiscal Year 1998 National Defense Authorization Act,
which requires exporters to notify the

Page 4
================================================================

Commerce Department of all HPC sales over 2,000 MTOPS to tier 3
countries prior to their export.

Third, the regulation required HPC manufacturers to keep records
of the end users of all their HPC exports over 2,000 MTOPS.
Based on our review of records provided by the manufacturers to
the Commerce Department from January 1996 through September
1997, we noted that China ranked first in the number of HPCS
acquired by tier 3 countries, having purchased a total of 77
HPCS during this period.  These exports were all made without an
individual license being required. Examining how these machines
are being used was beyond the scope of this review.

Responsibility for PSV checks on exports remained with the
government, but information on these exports reported to the
government has been incomplete.  PSVS for computers generally
have been of reduced value because of how this process is
implemented. First, Psvs verify the physical location of an HPC,
but not how it is used. Also, some governments, such as China,
have not allowed the United States to conduct PSVS.

With regard to foreign availability of HPCS 10 we found that
subsidiaries of U.S. computer manufacturers dominate the
overseas HPC market and they must comply with U.S. controls.
Russia, China, and India have developed HPCS, but their
capabilities are believed to be limited. Thus, our analysis
suggests that HPCS over 2,000 MTOPS are not readily available to
tier 3 countries from foreign sources without restriction.

The report contains two recommendations: one that requires
action by the Secretary of Defense, and one that requires action
by the Secretary of Commerce with support from DOD, DOE, the
Department of State, and the Arms Control and Disarmament Agency
(ACDA).

First, we recommended that to complement the studies undertaken
by POD and DOE for the House Committee on National Security, the
Secretary of Defense assess and report on the national security
threat and proliferation impact of U.S. exports of HPCS to
countries of national security and proliferation concern. This
assessment, at a minimum, should address (1) how and at what
performance levels countries of concern use HPCS for military
modernization and proliferation activities, (2) whether such
uses are a threat to U.S. national security interests, and (3)
the extent to which such HPCS are controllable.

----------------------------------------------------------------
10 We used the description of foreign availability described in
footnote 5 as our criteria.

Page 5
================================================================


Second, upon completion of the analysis suggested in our first
recommendation, we also recommended that the Secretary of
Commerce, in conjunction with the other agencies I mentioned,
jointly evaluate and report on options to safeguard U.S.
national security interests regarding HPCS. Such options should
include, but not be limited to, (1) requiring government review
and control of the export of computers at their highest scalable
MTOPS performance levels and (2) requiring that HPCS destined
for tier 3 countries be physically modified to prevent upgrades
beyond the allowed levels.

I would also like to comment just briefly on the agencies'
response to our report. In addition to Commerce and DOD, DOE,
the Department of State, and ACDA offered their views.

Commerce said that the President's decision was intended to
change the computer export policy from what it referred to as "a
relic of the Cold War to one more in tune with today's
technology and international security environment," and was
based on (1) rapid technological changes in the computer
industry, (2) wide availability, (3) limited controllability,
and (4) limited national security applications for HPCS.
Commerce further stated that our report focused too much on how
countries might use HPCS for proliferation or military purposes
and on what it called an outdated Cold War concept of "foreign
availability". The Commerce said that our analysis of foreign
availability was too narrow and that foreign availability is not
an adequate measure of the problem.

We agree that rapid technological advancements in the computer
industry have made the controllability of HPC exports a more
difficult problem; however, we disagree that foreign
availability is an outdated Cold War concept that has no
relevance in today's environment. While threats to U.S. security
may have changed, they have not been eliminated. Commerce itself
recognized this in its March 1998 annual report to Congress
which stated that "the key to effective export controls is
setting control levels above foreign availability." Moreover,
the concept of foreign availability, as opposed to Commerce's
notion of "worldwide" availability, is still described in the
Export Administration Act and Export Administration Regulations
as a factor to be considered in export control policy.

Commerce also commented that the need to control the export of
HPCS because of their importance for national security
applications is limited. It stated that many national security
applications can be performed satisfactorily on uncontrollable
low-level technology, and that computers

Page 6
================================================================
are not a "choke point" for military production.  Commerce said
that having access to HPCS alone will not improve a country's
military-industrial capabilities.

Commerce offered no specific evidence to support this point of
view; moreover, its view seems to be inconsistent with the
requirement for DOD to identify militarily critical
technologies.  In assessing these militarily critical
technologies, DOD has determined that high performance computing
is an enabling technology for modern tactical and strategic
warfare and is also important in the development, deployment,
and use of weapons of mass destruction. High performance
computing has also played a major role in the ability of the
United States to maintain and increase the technological
superiority of its war-fighting support systems.  DOD has noted
in its High Performance Computing Modernization Program annual
plan that the use of HPC technology has led to lower costs for
system deployment and improved the effectiveness of complex
weapons systems.  DOD further stated that as it transitions its
weapons system design and test process to rely more heavily on
modeling and simulation, the nation can expect many more
examples of the profound effects that the HPC capability has on
both military and civilian applications.

In its comments on our report, DOD said that it had considered
the threats associated with HPC exports to countries of national
security and proliferation concern. In this context, DOD
referred to its identification of how HPCS in the United States
are used for national security applications.  While our report
recognized that such an assessment of domestic uses had been
done, this did not address our concern. We reported that (1) the
Stanford study did not assess the capabilities of countries of
concern, such as China, Russia, India, or Pakistan, to use HPCS
for military and other national security applications, as
required by its tasking and (2) the executive branch did not
undertake a threat analysis of providing HPCS to such countries
of concern.  As we reported, the principal author of the Stanford
study noted that no assessment had been done of the national
security impact of allowing HPCS to go to particular countries
of concern and of what military advantages such countries could
achieve.  In fact, the April 1998 Stanford study on HPC export
controls by the same principal author also noted that
identifying which countries could use HPCS to pursue which
military applications remained a critical issue on which the
executive branch provided little information.

The Department of State, DOE, and ACDA generally agreed with our
report.

Page 7
================================================================

Mr. Chairman, that concludes our prepared testimony.  My
colleagues and I would be happy to respond to any questions you
or other members may have.

All content COPYRIGHT SOFTWAR (C) 2000. Any reproduction or use of content herein must be approved by SOFTWAR.