The U.S. export control system is about managing risk; exports to some countries involve less risk than to other countries and exports of some items involve less risk than others. Under U.S. law, the President has the authority to control and require licenses for the export of items that may pose a national security or foreign policy concern. The President also has the authority to remove or revise those controls as U.S. concerns and interests change. In doing so, the President is not required under U.S. law to conduct a foreign availability analysis. In 1995, as a continuation of changes begun in the 1980s, the executive branch reviewed export controls on computer exports to determine how changes in computer technology and its military applications should affect U.S. export control regulations. In announcing its January 1996 change to HPC controls, the executive branch stated that one goal of the revised export controls was to permit the government to tailor control levels and licensing conditions to the national security or proliferation risk posed at a specific destination. A key element of the executive branch review of HPC export controls was a Stanford University study, jointly commissioned by the Commerce and Defense Departments. Among other things, the study was tasked to provide an assessment of the availability of HPCs in selected countries and the capabilities of those countries to use HPCs for military and other national security applications. The study concluded that (1) U.S.-manufactured computer technology between 4,000 and 5,000 millions of theoretical operations per second (MTOPS) was widely available and uncontrollable worldwide, (2) U.S.-manufactured computer technology up to 7,000 MTOPS would become widely available and uncontrollable worldwide by 1997, and (3) many HPC applications used in U.S. national security programs occur at about 7,000 MTOPS and at or above 10,000 MTOPS. The study also concluded that it would be too expensive for government and industry to effectively control the international diffusion of computing systems with performance below 7,000 MTOPS, and that attempts to control computer exports below this level would become increasingly ineffectual, would harm the credibility of export controls, and would unreasonably burden a vital sector of the computer industry. The study also raised concerns about the ability to control HPC exports in the future in light of advances in computing technology. The export control policy implemented in January 1996 removed license requirements for most HPC exports with performance levels up to 2,000 MTOPS—an increase from the previous level of 1,500 MTOPS. The policy also organized countries into four “computer tiers,” with each tier after tier 1 representing a successively higher level of concern to U.S. security interests. The policy placed no license requirements on tier 1 countries, primarily those in Western Europe and Japan. Exports of HPCs above 10,000 MTOPS to tier 2 countries in Asia, Africa, Latin America, and Central and Eastern Europe would continue to require licenses. A dual-control system was established for tier 3 countries, such as Russia and China. For these countries, HPCs up to 7,000 MTOPS could be exported to civilian end users without a license, while exports at and above 2,000 MTOPS to end users of concern for military or proliferation of weapons of mass destruction reasons required a license. Exports of HPCs above 7,000 MTOPS to civilian end users also required a license. HPC exports to terrorist countries in tier 4 were essentially prohibited. (See appendix II for details on the four-tier system of export controls.) The January 1996 regulation also made other changes. It specified that exporters would be responsible for (1) determining whether an export license is required, based on the MTOPS level of the computer; (2) screening end users and end uses for military or proliferation concerns; and (3) keeping records and reporting on exports of computers with performance levels of 2,000 MTOPS. In addition to the standard record-keeping requirements, the regulation added requirements for the date of the shipment, the name and address of the end user and of each intermediate consignee, and the end use of each exported computer. The Fiscal Year 1998 National Defense Authorization Act (P.L. 105-85) modified the policy for determining whether an individual license is required and now requires exporters to notify the Commerce Department of any planned sales of computers with performance levels greater than 2,000 MTOPS to tier 3 countries. The government has 10 days to assess and object to a proposed HPC sale. The law also now requires Commerce to perform post-shipment verifications (PSV) on all HPC exports with performance levels over 2,000 MTOPS to tier 3 countries. The Commerce Department promulgated regulations implementing the law on February 3, 1998. The Stanford study, used as a key element by the executive branch in its decision to revise HPC export controls, had significant limitations. It lacked empirical evidence or analysis regarding its conclusion that HPCs were uncontrollable and, although tasked with doing so, it did not assess the capabilities of countries of concern to use HPCs for military and other national security applications. The study itself identified as a major limitation, its inability to assess capabilities of countries of concern to use HPCs for their military programs or national security applications, on the basis that such information was not available, and recommended that such an assessment be done. The study noted that trends in HPC technology development could affect U.S. security and the ability to control HPC exports in the future and need to be further studied. Despite the study’s limitations, the executive branch decided to relax HPC export controls. The Stanford study accumulated information from computer companies on U.S. HPC market characteristics and concluded—without empirical evidence or analysis—that computers between 4,000 and 5,000 MTOPS were already available worldwide and uncontrollable and that computers at about 7,000 MTOPS would be widely available and uncontrollable by 1997.Using the findings from the Stanford study, executive branch officials set the computer performance control thresholds for each tier. However, these officials could not explain nor provide documentation as to how the executive branch arrived at the decision to set the license requirements for exports of HPCs to tier 3 countries for military or proliferation end users at 2,000 MTOPS, even though the study concluded that computing power below 4,000 or 5,000 MTOPS was already “uncontrollable.” The study identified the following six factors as affecting controllability of HPCs: computer power, ease of upgrading, physical size, numbers of units manufactured and sold, sources of sales (direct sales or through resellers), and the cost of entry level systems. It described uncontrollability as the relationship between the difficulty of controlling computers and the willingness of government and industry to meet the costs of tracking and controlling them. The study asserted that as U.S. HPCs were sold openly for 2 years, their export would become uncontrollable. Part of the study’s rationale was that, as older HPCs are replaced by newer models 2 years after product introduction, original vendors may no longer have information on where replaced HPCs are relocated. The study also presumed a level of “leakage” of computers to countries of concern from U.S. HPC sources and asserted that costs of controlling such leakage were no longer tolerable. However, the study did not attempt to calculate or specify those costs. In addition, the study suggested only vague thresholds for these six factors to determine “uncontrollability.” For example, it noted that the threshold at which it becomes difficult to track numbers of units could vary from 200 to several thousand. The study did not provide analysis or empirical evidence to support its assumptions or conclusions. Although the Stanford study was tasked with assessing the capabilities of countries of concern to use HPCs for military and other national security applications, it did not do so. The study discussed only U.S. applications of HPCs for military purposes. According to the study’s principal author, data on other countries’ use of HPCs for military and other national security purposes was insufficient to make such assessments because the U.S. government does not gather such data in a systematic fashion. The report recommended that such an analysis be done. Despite the study’s limitations and recommendations to gather better data in the future on other countries’ use of HPCs for military and other national security purposes, the executive branch raised the MTOPS thresholds for HPC export controls and established the four-tier export control structure. The former Deputy Assistant Secretary of Defense for Counterproliferation Policy explained that because DOD was not tasked to conduct a threat assessment, it did not do so. Instead, the executive branch assessed countries on the basis of six criteria and assigned them to a particular tier. The six criteria were (1) evidence of on-going programs of national security concern, including proliferation of weapons of mass destruction with associated delivery systems and regional stability and conventional threats; (2) membership in or adherence to non-proliferation and export control regimes; (3) an effective export control system, including enforcement and compliance programs and an associated assessment of diversion risks; (4) overall relations with the United States; (5) whether U.N. sanctions had been imposed; and (6) prior licensing history. Prior to the executive branch’s decision to change computer thresholds, scientists at Department of Energy (DOE) national laboratories and other U.S. government officials had accumulated information to show how countries of concern could use HPCs to facilitate the design of nuclear weapons and to improve advanced nuclear weapons in the absence of tests of nuclear explosives. However, this information was not used as part of the decisionmaking process for revising HPC export controls, according to the Commerce Department. In December 1997 the House Committee on National Security directed the DOE and DOD to assess the national security impacts of exporting HPCs with performance levels between 2,000 and 7,000 MTOPS to tier 3 countries. In June 1998, 2 and 1/2 years after the executive branch revised HPC export controls, DOE concluded its study on how countries like China, India, and Pakistan can use HPCs to improve their nuclear programs. According to the DOE study, the impact of HPC acquisition depends on the complexity of the weapon being developed and, even more importantly, on the availability of high-quality, relevant test data. The study concluded that “the acquisition and application of HPCs to nuclear weapons development would have the greatest potential impact on the Chinese nuclear program—particularly in the event of a ban on all nuclear weapons testing.” Also, the study indicated that India and Pakistan may now be able to make better use of HPCs in the 1,000 to 4,000 MTOPS range for their nuclear weapons programs because of the testing data they acquired in May 1998 from underground detonations of nuclear devices. The potential contribution to the Russian nuclear program is less significant because of its robust nuclear testing experience, but HPCs can make a contribution to Russia’s confidence in the reliability of its nuclear stockpile. An emerging nuclear state is likely to be able to produce only rudimentary nuclear weapons of comparatively simple designs, for which personal computers are adequate. We were told that DOD’s study of national security impacts had not been completed as of September 1, 1998, in part because the Department had not received requested information from the Commerce Department until after July 1. The Stanford study noted that trends in HPC technology development may pose security and export control challenges and recommended further study to determine their implications for national security and export controls. The technology trends of concern include other countries’ ability (1) to upgrade the performance of individual computers and (2) to link individual computers to achieve higher performance levels. The Stanford study team reviewed the computer industry’s technological advances in parallel processing and concluded that such advances as “scalability” and “clustering” contributed to the uncontrollability of high performance computing worldwide and are inevitably reducing the effectiveness of U.S. export controls. “Scalability” refers to the capability to increase computer performance levels of a system by adding processor boards or by acquiring increasingly powerful microprocessors. “Clustering” refers to connecting many personal computers or workstations to achieve higher computing performance in a network of interconnected systems, working cooperatively and concurrently on one or several tasks. Scalability and clustering offer opportunities to increase computer power without the need to develop custom-built single processors traditionally used in HPCs. Some types of HPCs are designed today to allow scalability without the need for vendor support or even knowledge. As a result, some HPCs could be exported below MTOPS thresholds without an individual license, and, in theory, later covertly scaled up to levels that exceed the threshold. We asked government agencies for information about diversions and violations of U.S. HPC export controls, but they provided no evidence that countries of concern have increased the computing power of U.S. exported machines in violation of export restrictions. We found no U.S. government reviews of alternatives to address these security concerns, although authors of the Stanford study and others with whom we spoke identified various options that could be assessed. These include (1) requiring government review and consideration of machines at their highest scalable MTOPS performance levels and (2) requiring that HPCs exported to tier 3 countries be physically modified to prevent upgrades beyond the allowed levels. The executive branch’s January 1996 export control revision (1) increased thresholds for requiring licenses, which resulted in a reduction in the numbers of licensed HPCs; (2) shifted some of the government’s end-use screening responsibility from the government to the computer industry, until this policy was revised in 1998; and (3) required HPC manufacturers to keep records of the end users of their HPC exports. The government continued to have responsibility for post-shipment verifications for HPCs, which have reduced value as traditionally conducted. Since the export controls for computers were revised in 1996, HPC export license applications have declined from 459 applications in fiscal year 1995 to 125 applications in fiscal year 1997. In fiscal year 1995, the Commerce Department approved 395 license applications for HPC exports, and denied 1. In fiscal year 1997, Commerce approved 42 license applications for HPC exports, and denied 6. The remainder of the applications in each year were withdrawn without action. Changes in the numbers of both licensed and unlicensed exports might not be attributed entirely to the change in export controls. However, we did note some characteristics of U.S. HPC exports since the revision. For example, while HPC exports increased to each tier from January 1996 through September 1997, 72 percent of machines were sold to tier 1 countries. Also during this period, 77 HPCs were exported to China and 19 were exported to India, all without individual licenses. Most U.S. HPCs exported in this period (about 85 percent) had performance levels between 2,000 and 5,000 MTOPS. (See appendix III for details on HPC exports.) The executive branch shifted some government oversight responsibility to the computer industry, especially for tier 3 countries. Exporters became responsible for determining whether exports required a license by screening end users and end uses for military or proliferation concerns (end-use screening). However, some industry and government officials concluded that the computer industry lacked the necessary information to distinguish between military and civilian end users in some tier 3 countries—particularly China. Because of concerns about U.S. HPCs being obtained by countries of proliferation concern for possible use in weapons-related activities, the Congress enacted a provision in Public Law 105-85 that required exporters to notify the Commerce Department of all proposed HPC sales over 2,000 MTOPS to tier 3 countries. The law gives the government an opportunity to assess these exports within 10 days to determine the need for a license and it can use information that may not be available to the exporter. Pursuant to the Export Administration Regulations, exporters are required to keep accurate records of each licensed and unlicensed export of a computer over 2,000 MTOPS to any destination. These records are to include names and addresses of each end user and each “intermediate consignee” (resellers or distributors). Exporters must also provide quarterly reports to Commerce on license-exempt exports—almost 96 percent of the total HPC exports in the past 2 years. The government relies on the exporters’ data for end-use information, but we found that companies had reported inconsistent and incomplete data for intermediate consignees (resellers or distributors) as end users. For example, one company reported data for only one intermediate consignee, even though company officials told us that the company uses multiple resellers. Company officials noted that the company sells computers to companies in other countries, which then sell the computers to other, unknown end users. A second company provided “end-use statements” from its resellers, rather than the actual end users, and identified computers’ end use for several overseas sales as “resale.” In contrast, a third company shows its resellers as resellers, rather than as end users. Company officials said that the company contractually requires its resellers to identify and provide end-use statements from the ultimate end-users. The revision of HPC export controls did not reduce the government’s responsibility for certain safeguards procedures, notably conducting PSVs. Under current law, Commerce is required to conduct PSVs for all HPC exports over 2,000 MTOPS to tier 3 countries. While PSVs are important for detecting and deterring physical diversions of HPCs, PSVs, as traditionally conducted, do not verify computer end use. Also, some countries do not allow the United States to conduct them. China, for example, had not allowed PSVs, but in June 1998, it reportedly agreed to do so. U.S. government officials agreed that the way PSVs of computers have been traditionally conducted have reduced their value because such PSVs establish only the physical presence of an HPC. However, this step assures the U.S. government that the computer has not been physically diverted. According to DOE laboratory officials, it is easy to conceal how a computer is being used. They believed that the U.S. government officials performing the verifications cannot make such a determination, partly because they have received no computer-specific training. Although it is possible to verify how an HPC is being used through such actions as reviewing internal computer data, this would be costly and intrusive, and require experts’ sophisticated computer analysis. Another limitation of PSVs concerns sovereignty issues. Host governments in some countries of greatest concern, notably China, have precluded or restricted the U.S. government’s ability to conduct PSVs. Three European countries that we visited—United Kingdom, Germany, and France—also do not allow U.S. government officials to do PSVs. However, they perform the checks themselves and provide the results to the U.S. government. The government makes limited efforts to monitor exporters’ and end users’ compliance with explicit conditions attached to export licenses. It relies largely on HPC exporters for end use monitoring and may require them or the end users to safeguard the exports by limiting access to the computers or inspecting computer logs and outputs. The end user may also be required to agree to on-site inspections, even on short notice, by U.S. government or exporting company officials, who would review programs and software used on the computer, or to remote electronic monitoring of the computer. Commerce officials stated that they may have reviewed computer logs in the past, but do not do so anymore, and said that they have not conducted any short notice visits, and that they do not do remote monitoring. They said that, ultimately, monitoring safeguards plans is the exporter’s responsibility. As requested, we evaluated the current foreign availability of HPCs. Using the EAA’s general description of foreign availability as our criteria, our analysis showed that subsidiaries of U.S. companies dominate the overseas sales of HPCs. These companies primarily compete against one another with limited competition from foreign suppliers in Japan and Germany. We also obtained information on the capability of certain tier 3 countries to build their own HPCs and found it to be limited in the capability to produce machines in comparable quantity, quality, and power as the major HPC-supplier countries. The EAA describes foreign availability as goods or technology available without restriction to controlled destinations from sources outside the United States in sufficient quantities and comparable quality to those produced in the United States so as to render the controls ineffective in achieving their purposes. We found that the only global competitors for general computer technology are three Japanese companies, two of which compete primarily for sales of high-end computers—systems sold in small volumes and performing at advanced levels. Two of the companies reported no HPC exports to tier 3 countries, while the third company reported some exports on a regional, rather than country, basis. One German company sells HPCs primarily in Europe and has reported several sales of its HPCs over 2,000 MTOPS to tier 3 countries. One British company said it is capable of producing HPCs above 2,000 MTOPS, but company officials said it has never sold a system outside the European Union. A 1995 Commerce Department study of the HPC global market showed that American dominance had prevailed at that time, as well. The study observed that American HPC manufacturers controlled the market worldwide, followed by Japanese companies. It also found that European companies controlled about 30 percent of the European market and were not competitive outside Europe. The other countries that are HPC suppliers to countries outside Europe also restrict their exports. The United States and Japan since 1984 have been parties to a bilateral arrangement, referred to as the “Supercomputer Regime,” to coordinate their export controls on HPCs. Also, both Japanand Germany, like the United States, are signatories to the Wassenaar Arrangement, which has membership criteria of adherence to non-proliferation regimes and effective export controls. Each country also has national regulations that generally appear to afford levels of protection similar to U.S. regulations for their own and for U.S.-licensed HPCs. For example, both countries place export controls on sales of computers over 2,000 MTOPS to specified destinations, according to German and Japanese government officials. However, foreign government officials said that they do not enforce U.S. reexport controls on unlicensed U.S. HPCs. In fact, a study of German export controls noted that regulatory provisions specify that Germany has no special provisions on reexport of U.S.-origin goods. According to German government officials, the exporter is responsible for knowing the reexport requirements of the HPC’s country of origin. We could not ascertain whether improper reexports of HPCs occurred from tier 1 countries. Because some U.S. government and HPC industry officials consider indigenous capability to build HPCs a form of foreign availability, we examined such capabilities for tier 3 countries. Available information indicates that the capabilities of China, India, and Russia to build their own HPCs still lag well behind that of the United States, Japan, and European countries. Although details are not well-known about HPC developments in each of these tier 3 countries, most officials and studies showed that each country still produces machines in small quantities and of lower quality and power compared to U.S., Japanese, and European computers. For example, China has produced at least two different types of HPCs, called the Galaxy and Dawning series, based on U.S. technology and they are believed to have a performance level of about 2,500 MTOPS. Although China has announced its latest Galaxy at 13,000 MTOPS, U.S. government officials have no confirmation of this report. India has produced a series of computers called Param, which are based on U.S. microprocessors and are believed by U.S. DOE officials to be rated at about 2,000 MTOPS. These officials were denied access to test the computer’s performance. Russia’s efforts over the past three decades to develop commercially viable HPCs have used both indigenously-developed and U.S. microprocessors, but have suffered from economic problems and a lack of customers. According to one DOE official, Russia has never built a computer running better than 2,000 MTOPS, and various observers believe Russia to be 3 to 10 years behind the West in developing computers. A key element in the 1996 decision to revise HPC export controls was the findings of the Stanford study which did not have adequate analyses of critical issues. In particular, the study used to justify the decision did not assemble empirical data or analysis to support the conclusion that HPCs below specific performance levels were uncontrollable and widely available worldwide. Moreover, the study did not analyze the capabilities of countries of concern to use HPCs to further their military programs or engage in nuclear proliferation, but rather recommended that such data be gathered and such analysis be made. Despite the limitations of the study, the executive branch revised the HPC export controls. Since the executive branch’s stated goals for the revised HPC export controls included tailoring control levels to security and proliferation risks of specific destinations, it becomes a vital factor to determine how and at what performance levels specific countries would use HPCs for military and other national security applications and how such uses would threaten U.S. national security interests in specific areas. In addition, the Stanford study identified trends in HPC technology development which may pose security and export control challenges for national security and export controls. Some alternatives to address these security challenges have been identified by authors of the Stanford study and others with whom we spoke, and could be assessed. To complement the studies undertaken by DOD and DOE for the House Committee on National Security, we recommend that the Secretary of Defense assess and report on the national security threat and proliferation impact of U.S. exports of HPCs to countries of national security and proliferation concern. This assessment, at a minimum, should address (1) how and at what performance levels countries of concern use HPCs for military modernization and proliferation activities; (2) the threat of such uses to U.S. national security interests; and (3) the extent to which such HPCs are controllable. We also recommend that the Secretary of Commerce, with the support of the Secretaries of Defense, Energy, and State, and the Director of the U.S. Arms Control and Disarmament Agency, jointly evaluate and report on options to safeguard U.S. national security interests regarding HPCs. Such options should include, but not be limited to, (1) requiring government review and control of the export of computers at their highest scalable MTOPS performance levels and (2) requiring that HPCs destined for tier 3 countries be physically modified to prevent upgrades beyond the allowed levels. Commerce and DOD each provided one set of general written comments on a draft of this and a companion report and the Departments of State and Energy and the Arms Control and Disarmament Agency provided oral comments. Commerce, Defense, and State raised issues about various matters discussed in the report. The Department of Energy had no comments on the report but said it deferred to Commerce and Defense to comment on the Stanford study. The Arms Control and Disarmament Agency agreed with the substance of the report. Commerce, State, Energy, and the Arms Control and Disarmament Agency did not comment on our recommendations, but Defense did. Defense said that our recommendation concerning the assessment of national security threats and proliferation impact of U.S. exports to countries of concern was done in connection with the 1995 decision to revise HPC export controls, and that it would consider additional options to safeguard exports of HPCs as part of its ongoing review of export controls. As noted below, we believe the question of how countries of concern could use HPCs to further their military and nuclear programs was not addressed as part of the executive branch’s 1995 decision. Commerce commented that the President’s decision was intended to change the computer export policy from what it referred to as “a relic of the Cold War to one more in tune with today’s technology and international security environment.” Commerce said the decision was based on (1) rapid technological changes in the computer industry, (2) wide availability, (3) limited controllability, and (4) limited national security applications for HPCs. Commerce provided additional views about each of these factors. Commerce commented that our report focused on how countries might use HPCs for proliferation or military purposes and on what it called an outdated Cold War concept of “foreign availability,” rather than these factors. Our report specifically addresses the four factors Commerce said it considered in 1995. These four factors are considered in the Stanford University study upon which the executive branch heavily relied in making its decision to revise HPC export controls. Our report agreed with the study’s treatment of technological changes in the computing industry and that advances in computing technology may pose long-term security and controllability challenges. Commerce commented that our analysis of foreign availability as an element of the controllability of HPCs was too narrow, stating that foreign availability is not an adequate measure of the problem. Commerce stated that this “Cold War concept” makes little sense today, given the permeability and increased globalization of markets. We agree that rapid technological advancements in the computer industry have made the controllability of HPC exports a more difficult problem; however, we disagree that foreign availability is an outdated Cold War concept that has no relevance in today’s environment. While threats to U.S. security may have changed, they have not been eliminated. Commerce itself recognized this in its March 1998 annual report to the Congress which stated that “the key to effective export controls is setting control levels above foreign availability.” Moreover, the concept of foreign availability, as opposed to Commerce’s notion of “worldwide” availability, is still described in EAA and the Export Administration Regulations as a factor to be considered in export control policy. Commerce also commented that the need to control the export of HPCs because of their importance for national security applications is limited. It stated that many national security applications can be performed satisfactorily on uncontrollable low-level technology, and that computers are not a “choke point” for military production. Commerce said that having access to HPCs alone will not improve a country’s military-industrial capabilities. Commerce asserted that the 1995 decision was based on research leading to the conclusion that computing power is a secondary consideration for many applications of national security concern. We asked Commerce for its research evidence, but none was forthcoming. The only evidence that Commerce cited was contained in the Stanford study. Moreover, Commerce’s position on this matter is not consistent with that of DOD. DOD, in its Militarily Critical Technologies List, has determined that high performance computing is an enabling technology for modern tactical and strategic warfare and is also important in the development, deployment, and use of weapons of mass destruction. High performance computing has also played a major role in the ability of the United States to maintain and increase the technological superiority of its war-fighting support systems. DOD has noted in its High Performance Computing Modernization Program annual plan that the use of HPC technology has led to lower costs for system deployment and improved the effectiveness of complex weapons systems. DOD further stated that as it transitions its weapons system design and test process to rely more heavily on modeling and simulation, the nation can expect many more examples of the profound effects that the HPC capability has on both military and civilian applications. Furthermore, we note that the concept of “choke point” is not a standard established in U.S. law or regulation for reviewing dual-use exports to sensitive end users for proliferation reasons. In its comments, DOD said that the Stanford study was just one of many sources of information and analysis used in the 1996 executive branch decision. We reviewed all of the four sources of information identified to us by DOD, DOE, State, Commerce, and Arms Control and Disarmament Agency (ACDA) officials as contributing to their assessment of computer export controls. However, the Stanford study was a key analytical study used in the decision-making process and the only source whose findings were consistently and repeatedly cited by the executive branch in official announcements, briefings, congressional testimony, and discussions with us in support of the HPC export control revision. In its comments, DOD stated that our report inaccurately characterized DOD as not considering the threats associated with HPC exports. DOD said that in 1995 it “considered” the security risks associated with the export of HPCs to countries of national security and proliferation concern. What our report actually states is that (1) the Stanford study did not assess the capabilities of countries of concern to use HPCs for military and other national security applications, as required by its tasking and (2) the executive branch did not undertake a threat analysis of providing HPCs to countries of concern. DOD provided no new documentation to demonstrate how it “considered” these risks. As the principal author of the Stanford study and DOD officials stated during our review, no threat assessment or assessment of the national security impact of allowing HPCs to go to particular countries of concern and of what military advantages such countries could achieve had been done in 1995. In fact, the April 1998 Stanford study on HPC export controls by the same principal author also noted that identifying which countries could use HPCs to pursue which military applications remained a critical issue on which the executive branch provided little information. In its comments, the Department of State disagreed with our presenting combined data on HPC exports to China and Hong Kong in appendix III because the U.S.-Hong Kong Policy Act of 1992 calls for the U.S. government to treat Hong Kong as a separate territory regarding economic and trade matters. While, in principle, we do not disagree with State, it should be noted that we reported in May 1997 that given the decision to continue current U.S. policy toward Hong Kong, monitoring various indicators of Hong Kong’s continued autonomy in export controls becomes critical to assessing the risk to U.S. nonproliferation interests.Our presentation of the combined HPC export data for China and Hong Kong is intended to help illustrate a potential risk to U.S. nonproliferation interests regarding HPCs should Hong Kong’s continued autonomy in export controls be weakened. We believe that monitoring data on HPC exports to Hong Kong becomes all the more important since Hong Kong is treated as a tier 2 country, whereas China is a tier 3 country. Commerce also provided technical comments which we have incorporated as appropriate. Commerce and DOD written comments are reprinted in appendixes IV and V, respectively, along with our evaluation of them. ACDA provided oral comments on this report and generally agreed with it. However, it disagreed with the statement that “according to the Commerce Department, the key to effective export controls is setting control levels above the level of foreign availability of materials of concern.” ACDA stressed that this is Commerce’s position only and not the view of the entire executive branch. ACDA said that in its view (1) it is difficult to determine the foreign availability of HPCs and (2) the United States helps create foreign availability through the transfer of computers and computer parts. Our scope and methodology are in appendix I. Appendix II contains details on the four-tier system of export controls and appendix III shows characteristics of HPC exports since the revision. We conducted our review between August 1997 and June 1998 in accordance with generally accepted government auditing standards. We will provide copies of this report to other congressional committees; the Secretaries of Commerce, Defense, Energy, and State; the Director, U.S. Arms Control and Disarmament Agency; and the Director, Office of Management and Budget. Copies will be provided to others upon request. Please contact me on (202) 512-4128 if you or your staff have any questions concerning this report. Major contributors to this report are listed in appendix IV. To assess the basis for the U.S. government’s 1996 decision to change HPC controls, we reviewed a 1995 Stanford University study on high performance computing and export control policy commissioned by the Commerce and Defense Departments and evaluated the executive branch’s assessment of national security risks of HPCs. We reviewed several classified charts and briefing slides prepared by the intelligence community and DOD that were identified as important support for the revision of controls. We also talked with the Stanford study’s principal authors to discuss their methodology, evidence, conclusions, and recommendations. In addition, we met with the Department of Defense (DOD), the Department of Energy (DOE), State and Commerce Department officials to discuss the interagency process used leading up to the decision to revise controls on HPCs. We also requested, but were denied access to, information from the National Security Council on data and analyses that were used in the interagency forum to reach the final decision to revise controls. To determine how the government assessed the national security risks of allowing the high performance computers (HPC) to be provided to countries of proliferation and military concern as part of the basis for the decision to revise the controls, we reviewed DOD and DOE documents on how HPCs are being used for nuclear and military applications. We discussed high performance computing for both U.S. and foreign nuclear weapons programs with DOE officials in Washington, D.C., and at the Lawrence Livermore, Los Alamos, and Sandia National Laboratories. We also met with officials of the DOD HPC Modernization Office and other officials within the Under Secretary of Defense Acquisition and Technology, Office of the Secretary of Defense, the Joint Chiefs of Staff, and the intelligence community to discuss how HPCs are being utilized for weapons design, testing and evaluation and other military applications. Furthermore, to understand the trends occurring in computer technology, we analyzed HPC model descriptions and technical means for increasing computing performance. To identify changes in licensing activities and the implementation of certain U.S. licensing and export enforcement requirements since the revision: We reviewed two sets of data from the Commerce Department, as noted above, in order to determine trends in American HPC exports since the 1996 revision of controls. We examined all U.S. high performance computer-related license applications worldwide. We analyzed the data for trends and changes in MTOPS levels of HPC exports before and after revision of controls, numbers of licenses approved, denied, and withdrawn without action, and HPC exports by countries and country tiers. We did not review the data for completeness, accuracy, and consistency. We reviewed the end user and end-use screening systems of major American HPC manufacturers, Commerce Department implementation of the revised regulations, and selected foreign government export controls in order to determine licensing changes affecting U.S. HPC exporters since the revision of controls. We also reviewed applicable U.S. laws and regulations governing HPC export licensing and enforcement and discussed these laws and regulations with Commerce Department officials. We obtained Commerce Department procedures on end use and end user determinations as well as records on HPC vendor inquiries to Commerce on end users. In addition, we reviewed information on intelligence community assessments of foreign end users receiving HPC exports. We also discussed end user and end use screening procedures with officials from major U.S. HPC manufacturers—Digital Equipment Corporation, Hewlett Packard/Convex, International Business Machines, and Sun Microsystems—at their corporate offices in the United States and sales offices overseas. We also visited representatives of these companies’ foreign subsidiary offices from China, Germany, Russia, Singapore, South Korea, and the United Kingdom to review end use screening procedures and documentation for selected exports. In addition, we visited selected HPC sites in China and Russia. However, the Chinese government refused us permission to visit one of three requested sites in Beijing. The Russian government, while not denying us permission to visit one site in-country, required an extended period of notification that went beyond our timeframes. Silicon Graphics, Inc./Cray refused to meet with us pending the outcome of an ongoing criminal investigation. We reviewed Commerce Department data on pre-license and post-shipment verification (PSV) checks on HPCs and related technology and safeguards security plans associated with HPC export licenses in order to examine affects of licensing changes on government oversight. We discussed the implementation and utility of these checks with officials of the U.S. government, American computer companies, and host governments in the countries we visited. To determine foreign availability of HPCs, we reviewed the Export Administration Act (EAA) and Export Administration Regulations for criteria and a description of the meaning of the term. We then reviewed market research data from an independent computer research organization. We also reviewed lists, brochures, and marketing information from major U.S. and foreign HPC manufacturers in France (Bull, SA), Germany (Siemens Nixdorf Informationssysteme AG and Parsytec Computer GmbH), and the United Kingdom (Quadrics Supercomputers World, Limited) and met with them to discuss their existing and projected product lines. We also obtained market data, as available, from three Japanese HPC manufacturers. Furthermore, we met with government officials in China, France, Germany, Singapore, South Korea, and the United Kingdom to discuss each country’s indigenous capability to produce HPCs. We also obtained information from the Japanese government on its export control policies. In addition, we obtained and analyzed from two Commerce Department databases (1) worldwide export licensing application data for fiscal years 1994-97 and (2) export data from computer exporters provided to the Department for all American HPC exports between January 1996 and October 1997. We also reviewed a 1995 Commerce Department study on the worldwide computer market to identify foreign competition in the HPC market prior to the export control revision. To identify similarities and differences between U.S. and foreign government HPC export controls, we discussed with officials of the U.S. embassies and host governments information on foreign government export controls for HPCs and the extent of cooperation between U.S. and host government authorities on investigations of export control violations and any HPC diversions of HPCs to sensitive end users. We also reviewed foreign government regulations, where available, and both foreign government and independent reports on each country’s export control system. Table II.1 and the description that follows summarize the terms of the revised export controls for HPCs and according to their MTOPS levels and destinations. The revised controls announced by the President divide into four country groups, as follows: Tier 1 (28 countries: Western Europe, Japan, Canada, Mexico, Australia, New Zealand). No prior government review (license exception) for all computers, but companies must keep records on higher performance shipments that will be provided to the U.S. government, as directed. Tier 2 (106 countries: Latin America, South Korea, Association of Southeast Asian Nations or ASEAN, Hungary, Poland, Czech Republic, Slovak Republic, Slovenia, South Africa). No prior government review (license exception) up to 10,000 MTOPS with record-keeping and reporting, as directed; individual license (requiring prior government review) above 10,000 MTOPS. Above 20,000 MTOPS, the government may require certain safeguards at the end-user location. Tier 3 (50 countries: India, Pakistan, all Middle East/Maghreb, the former Soviet Union, China, Vietnam, rest of Eastern Europe). No prior government review (license exception) up to 2,000 MTOPS. Individual license for military and proliferation-related end uses and end users and license exception for civil end users between 2,000 MTOPS and 7,000 MTOPS, with exporter record-keeping and reporting, as directed. Individual license for all end users above 7,000 MTOPS. Above 10,000 MTOPS, additional safeguards may be required at the end-user location. Tier 4 (7 countries: Iraq, Iran, Libya, North Korea, Cuba, Sudan, and Syria). Current policies continue to apply (i.e., virtual embargo on computer exports). For all these groups, reexport and retransfer provisions continue to apply. The government continues to implement the Enhanced Proliferation Control Initiative, which provides authority for the government to block exports of computers of any level in cases involving exports to end uses or end users of proliferation concern or risks of diversion to proliferation activities. Criminal as well as civil penalties apply to violators of the Initiative. HPC exports have increased significantly since the 1996 export control revision. Figure III.1 shows the numbers of U.S. HPCs exported to all tiers from fiscal year 1994 through fiscal year 1997. In fiscal year 1996, U.S. computer vendors exported almost twice as many HPCs as they had in fiscal years 1994 and 1995 together. In fiscal year 1997, U.S. exports of HPCs more than quadrupled the fiscal year 1996 level. Figure III.1 also shows that growth in export volume was strong for tier 1 countries. Although tier 2 growth remained ahead of tier 1 for the whole period, the greatest volume of U.S. exports has been with the tier 1 countries. Table III.1 shows the largest importers of U.S. HPCs. U.S. allies and friends remained the largest market for U.S. HPC exports, but tier 2 countries were the fastest growing market. Figure III.2 summarizes the share of U.S. HPC exports that each tier took in this period. Figure III.3 shows the top five customers for U.S. HPCs and the portion of the exports they received. Finally figure III.4 shows that most HPCs exported in the past 2 years were rated between 2,000 and 3,000 MTOPS. Since the January 1996 revision, 68 countries worldwide, out of 193 in the tier system, purchased 3,967 U.S. HPCs, as of September 1997. These machines represent a total HPC computing power, as calculated in MTOPS, of over 15 million MTOPS. Twenty-six countries lead the world as the dominant customers for U.S. HPCs. These countries purchased 91 percent of all HPCs sold worldwide. Together they purchased over 14 million MTOPS, representing 93 percent of the HPC computing power exported from the U.S. in the period. Table III.1 ranks the countries by the quantities of MTOPS they purchased. It also shows the number of HPCs they purchased. The countries that purchased the most machines also purchased relatively more powerful machines as rated by MTOPS. (See table III.1.) As table III.1 shows, tier 1 countries, mainly U.S. friends and allies, were by far the largest market for U.S. HPCs. Figure III.2 summarizes the share of U.S. HPC exports that each tier received in the past 2 years. Since the export controls were revised, HPCs have been sold to more countries, but 26 countries account for 91 percent of all U.S. HPCs sold worldwide. Not only have the Tier 1 countries dominated as U.S. HPC customers, five U.S. allies were the largest customers for U.S. HPCs: Germany, the United Kingdom, Japan, South Korea, and France. As figure III.3 shows, these five countries together received over 52 percent of the machines exported. These countries also bought the most powerful machines, purchasing 58.36 percent of the MTOPS exported in HPCs. The large majority of U.S. HPCs exported since the revision and the largest number of most powerful computers were sent to tier 1 and 2 countries. For example, 50, 5, and 1 HPCs with computing power greater than 13,000 MTOPS went to tiers 1, 2, and 3, respectively. Of the 50 countries in tier 3, five—China, Israel, Russia, India, and Saudi Arabia—account for about 84 percent of the computers exported to tier 3. Table III.2 shows the numbers of computers each country has received. HPCs to China and India were exported with no individual licenses. Russia and Saudi Arabia received 1 licensed HPC each, while Israel received 18 licensed machines. China, which ranks first in the number of HPCs received by a tier 3 country, would have received even higher numbers of HPCs if its HPC totals were combined with those of its Hong Kong Special Administrative Region. Hong Kong and China rank 13th and 14th, respectively, on the HPC purchasers’ list. (See table III.1) If Hong Kong and China were treated as one for purposes of U.S. export controls and statistics, the combined region would have purchased more machines than Italy, which ranked seventh in U.S. machines exported, and almost as many machines as Switzerland, which ranked sixth. The largest numbers of U.S. HPCs exported were less powerful HPCs. HPCs at the 2,000 to 3,000 MTOPS level made up the bulk of machines exported, about 58 percent of all HPC exports. HPCs at the 2,000 to 7,000 MTOPS level constitute the large majority of U.S. HPC exports, about 92 percent of all U.S. HPC exports, or 3,638 machines exported. The remaining 8 percent of HPC exports, 329 machines, were above 7,000 MTOPS. Figure III.4 shows these relationships. (See fig. III.4.) The following are GAO’s comments on the Department of Commerce letter dated August 7, 1998. Commerce provided one set of written comments for this report. We addressed Commerce’s general comments relevant to this report on page 15 and its specific comments below. 1. We have made the suggested changes, as appropriate. 2. Commerce also commented that a number of foreign manufacturers indigenously produce HPCs that compete with those of the United States. Evidence cited by Commerce concerning particular countries with HPC manufacturing capabilities came from studies that were conducted in 1995 and that did not address or use criteria related to “foreign availability.” As stated in our report, we gathered data from multiple government and computer industry sources to find companies in other countries that met the terms of foreign availability. We met with major U.S. HPC companies in the United States, as well as with their overseas subsidiaries in a number of countries we visited in 1998, to discuss foreign HPC manufacturers that the U.S. companies considered as providing foreign availability and competition. We found few. Throughout Europe and Asia, U.S. computer subsidiary officials stated that their competition is primarily other U.S. computer subsidiaries and, to a lesser extent, Japanese companies. Our information does not support Commerce’s position on all of these manufacturers. For example, our visit to government and commercial sources in Singapore indicated that the country does not now have the capabilities to produce HPCs. We asked Commerce to provide data to support its assertion on foreign manufacturers, but we received no documentary support. In addition, although requested, Commerce did not provide documentary evidence to confirm its asserted capabilities of India’s HPCs and uses. 3. Commerce stated that policy makers did not receive DOE information prior to the revision of the HPC controls in 1995 and, further, there is current disagreement within DOE over the contribution that HPCs make to nuclear programs in countries of concern. We agree that Commerce did not obtain available information on this issue from DOE laboratories, although such information was available and provided to us upon request. In addition, we found no dissent or qualification of views identified in DOE’s official study on this matter. 4. Commerce stated that worldwide availability of computers indicates that there is a large installed base of systems in the tens of thousands or even millions. Commerce further stated that license requirements will not prevent diversion of HPCs unless realistic control levels are set that can be enforced effectively. While we agree, in principle, that increasing numbers of HPCs makes controllability more difficult, a realistic assessment of when an item is “uncontrollable” would require an analysis of (1) actual data, (2) estimated costs of enforcing controls, and (3) pros and cons of alternatives—such as revised regulatory procedures—that might be considered to extend controls. Such an analysis was not done by the executive branch before its 1995 decision. In addition, Commerce provided no documentary evidence for its statement that there is a large installed base of HPCs in the millions. 5. Commerce stated that most European governments do not enforce U.S. export control restrictions on reexport of U.S.-supplied HPCs. We agree that at least those European governments that we visited (Germany and United Kingdom) hold this position. However, although requested, Commerce provided no evidence to support its statement that the government of the United Kingdom has instructed its exporters to ignore U.S. reexport controls. The following are GAO’s comments on the Department of Defense letter dated July 16, 1998. DOD provided one set of written comments for this report. We addressed DOD’s general comments relevant to this report on page 17. We address DOD’s specific comments below. 1. DOD stated that the Stanford study was only one of many inputs considered by the executive branch in its 1995 assessment of computer export controls. We agree, and our report states, that there were other inputs to the decision. However, officials at Commerce, DOD, State, DOE, and ACDA referred us to the Stanford study in explaining the basis for the executive branch decision to revise the controls. Moreover, in announcing the 1996 HPC export control changes, the executive branch highlighted two conclusions of its review: (1) U.S.-manufactured computer technology up to 7,000 MTOPS would become widely available worldwide by 1997 and (2) many HPC applications used in U.S. national security programs occur at or above 10,000 MTOPS. Both conclusions were based on information provided only in the Stanford study. Also, DOD provided briefing slides on the HPC export control revision to the House Committee on National Security dated October 17, 1995, using information drawn almost exclusively from the Stanford study. Finally, a March 1998 Commerce Department report on foreign policy export controls noted only one source—a new Stanford study—as part of a 1998 review of HPC export controls. 2. DOD stated that it identified numerous national security applications used by the United States that require various levels of computing power, which helped to establish the revised licensing policies. We agree, and our report discusses the fact that DOD identified how the U.S. government uses HPCs for national security applications. However, this misses the point because these applications did not refer to particular countries of concern. As we noted in our report, the principal author of the Stanford study and DOD officials said that they had not performed a threat assessment or analysis of other countries’ use of HPCs for military and other national security purposes. The current DOD analysis of how countries of concern can use HPCs is being done at the request of the House National Security Committee and might provide the information needed to perform our recommended assessment. 3. We disagree that the executive branch fulfilled the intent of our recommendations. Specifically, it did not have information on how and at what performance levels countries of concern, such as China, India, and Pakistan, use HPCs for military modernization and nonnuclear proliferation activities. Regarding the degree of controllability of computers, neither the Stanford study nor any of the other inputs used in the 1995 computer export control review provided any empirical evidence or analysis to support assertions that HPCs with certain performance levels are widely available and uncontrollable. In fact, the 1998 Stanford study recommends procedural export licensing changes that would make such HPCs controllable again. Hai Tran The first copy of each GAO report and testimony is free. Additional copies are $2 each. Orders should be sent to the following address, accompanied by a check or money order made out to the Superintendent of Documents, when necessary. VISA and MasterCard credit cards are accepted, also. Orders for 100 or more copies to be mailed to a single address are discounted 25 percent. U.S. General Accounting Office P.O. Box 37050 Washington, DC 20013 Room 1100 700 4th St. NW (corner of 4th and G Sts. NW) U.S. General Accounting Office Washington, DC Orders may also be placed by calling (202) 512-6000 or by using fax number (202) 512-6061, or TDD (202) 512-2537. Each day, GAO issues a list of newly available reports and testimony. To receive facsimile copies of the daily list or any list from the past 30 days, please call (202) 512-6000 using a touchtone phone. A recorded menu will provide information on how to obtain these lists.

Summary: Pursuant to a legislative requirement and a congressional request, GAO reviewed concerns that U.S. national security interests may have been compromised by sales of unlicensed high performance computers (HPC) to China and Russia, focusing on: (1) the basis for the executive branch's revision of HPC export controls; (2) changes in licensing activities and the implementation of certain U.S. licensing and export enforcement requirements since the revision; and (3) the current foreign availability of HPCs, particularly for certain countries of national security concern. GAO noted that: (1) a Stanford University study on foreign availability of HPCs was a key element in the decision to revise HPC export controls; (2) however, GAO's analysis of the study showed that it had 2 significant limitations; (3) first, the study lacked empirical evidence or analysis to support its conclusion that HPCs were uncontrollable based on worldwide availability and insufficient resources to control them; (4) second, the study did not assess the capabilities of countries of concern to use HPCs for military and other national security applications; (5) the study's principal author said that U.S. government data were insufficient to make such an assessment, and the study recommended that better data be gathered so that such an analysis could be done in the future; (6) the executive branch did not undertake a threat analysis of providing HPCs to countries of concern, but raised the computing power thresholds for HPC export controls and established a four-tier control structure; (7) the 1996 revision to HPC export controls had three key consequences; (8) the number of computer export licenses issued declined from 395 in fiscal year 1995 to 42 in 1997; (9) U.S. HPC exporters were charged with responsibilities previously conducted by the government, including screening and reporting on the end use and end user of HPCs; (10) the regulation required HPC manufacturers to keep records of the end users of all their HPC exports over 2,000 million theoretical operations per second (MTOPS); (11) to date, information on these exports reported to the government has been incomplete; (12) responsibility for postshipment verification (PSV) checks remained with the government; (13) however, because of how PSVs for computers are implemented, their value is reduced because they verify the physical location of a HPC, but not how it is used; (14) subsidiaries of U.S. computer manufacturers dominate the overseas HPC market, and they must comply with U.S. controls; (15) three Japanese companies are global competitors of U.S. manufacturers, two of which told GAO that they had no sales to tier 3 countries such as Russia and China; (16) Japan, Germany and the United Kingdom each have export controls on HPCs similar to those of the United States, according to foreign government officials; (17) Russia, China, and India have developed HPCs, but the capabilities of their computers are believed to be limited; and (18) thus, GAO's analysis suggests that HPCs over 2,000 MTOPS are not readily available to tier 3 countries from foreign sources without restrictions.