The U.S. export control system is about managing risk; exports to some countries involve less risk than to other countries and exports of some items involve less risk than others. Under United States law, the President has the authority to control and require licenses for the export of items that may pose a national security or foreign policy concern. The President also has the authority to remove or revise those controls as U.S. concerns and interests change. In 1995, as a continuation of changes begun in the 1980s, the executive branch reviewed export controls on computer exports to determine how changes in computer technology and its military applications should affect U.S. export control regulations. In announcing its January 1996 change to HPC controls, the executive branch stated that one goal of the revised export controls was to permit the government to tailor control levels and licensing conditions to the national security or proliferation risk posed at a specific destination. According to the Commerce Department, the key to effective export controls is setting control levels above the level of foreign availability of materials of concern. The Export Administration Act (EAA) of 1979 describes foreign availability as goods or technology available without restriction to controlled destinations from sources outside the United States in sufficient quantity and comparable quality to those produced in the United States so as to render the controls ineffective in achieving their purposes. Foreign availability is also sometimes associated with the indigenous capability of foreign sources to produce their own HPCs, but this meaning does not meet all the EAA criteria. The 1996 revision of HPC export control policy removed license requirements for most HPC exports with performance levels up to 2,000 MTOPS—an increase from the previous level of 1,500 MTOPS. For purposes of export controls, countries were organized into four “computer tiers,” with each tier after tier 1 representing a successively higher level of concern to U.S. security interests. The policy placed no license requirements on tier 1 countries, primarily Western European countries and Japan. Exports of HPCs above 10,000 MTOPS to tier 2 countries in Asia, Africa, Latin America, and Central and Eastern Europe would continue to require licenses. A dual-control system was established for tier 3 countries, such as Russia and China. For these countries, HPCs up to 7,000 MTOPS could be exported to civilian end users without a license, while exports at and above 2,000 MTOPS to end users of concern for military or proliferation of weapons of mass destruction reasons required a license. Exports of HPCs above 7,000 MTOPS to civilian end users also required a license. HPC exports to terrorist countries in tier 4 were essentially prohibited. The executive branch has determined that HPCs are important for designing or improving advanced nuclear explosives and advanced conventional weapons capabilities. It has identified high performance computing as having applications in such national defense areas as nuclear weapons programs, cryptology, conventional weapons, and military operations. According to DOD, high performance computing is an enabling technology for modern tactical and strategic warfare and is also important in the development, deployment, and use of weapons of mass destruction. It has also played a major role in the ability of the United States to maintain and increase the technological superiority of its warfighting support systems. HPCs have particular benefits for military operations, such as battle management and target engagement, and they are also important in meeting joint warfighting objectives like joint theater missile defense, information superiority, and electronic warfare. However, the executive branch has not, with the exception of nuclear weapons, identified how or at what performance levels, countries of concern may use HPCs to advance their own military capabilities. The House Committee on National Security in December 1997 directed DOE and DOD to assess the national security risks of exporting HPCs with performance levels between 2,000 and 7,000 MTOPS to tier 3 countries. In June 1998, DOE concluded its study on how countries like China, India, and Pakistan can use HPCs to improve their nuclear programs. According to the study, the impact of HPC acquisition depends on the complexity of the weapon being developed and, even more importantly, on the availability of high-quality, relevant test data. The study concluded that “the acquisition and application of HPCs to nuclear weapons development would have the greatest potential impact on the Chinese nuclear program—particularly in the event of a ban on all nuclear weapons testing.” Also, India and Pakistan may now be able to make better use of HPCs in the 1,000 to 4,000 MTOPS range for their nuclear weapons programs because of the testing data they acquired in May 1998 from underground detonations of nuclear devices, according to the DOE report. The potential contribution to the Russian nuclear program is less significant because of its robust nuclear testing experience, but HPCs can make a contribution to Russia’s confidence in the reliability of its nuclear stockpile. An emerging nuclear state is likely to be able to produce only rudimentary nuclear weapons of comparatively simple designs for which personal computers are adequate. We were told that DOD’s study on national security impacts has not been completed. We attempted to identify national security concerns over other countries’ use of HPCs for conventional weapons development. However, officials from DOD and other relevant executive branch agencies did not have information on how specific countries would use HPCs for missile, chemical, biological, and conventional weapons development. Based on EAA’s description of foreign availability, we found that subsidiaries of U.S. companies dominate overseas sales of HPCs. According to U.S. HPC exporters, there were no instances where U.S. companies had lost sales to foreign HPC vendors in tier 3 countries. The U.S. companies primarily compete against one another, with limited competition from foreign suppliers in Japan and Germany. We also obtained information on the capability of certain tier 3 countries to build their own HPCs and found it to be limited. Tier 3 countries are not as capable of producing machines in comparable quantity and of comparable quality and power, as the major HPC-supplier countries. The only global competitors for general computer technology are three Japanese companies, two of which compete primarily for sales of high-end computers—systems sold in small volumes and performing at advanced levels. Two of the companies reported no exports to tier 3 countries, while the third reported some exports on a regional, rather than country basis.One German company sells HPCs primarily in Europe but has reported a small number of sales of its HPCs over 2,000 MTOPS to tier 3 countries. One British company said it is capable of producing HPCs above 2,000 MTOPS, but company officials said it has never sold a system outside the European Union. Our findings in this regard were similar to those in a 1995 Commerce Department study of the HPC global market, which showed that American dominance prevailed at that time, as well. The study observed that American HPC manufacturers controlled the market worldwide, followed by Japanese companies. It also found that European companies controlled about 30 percent of the European market and were not competitive outside Europe. Other HPC suppliers also have restrictions on their exports. Since 1984, the United States and Japan have been parties to a bilateral arrangement, referred to as the “Supercomputer Regime,” to coordinate their export controls on HPCs. Also, both Japan and Germany, like the United States, are signatories to the Wassenaar Arrangement and have regulations that generally appear to afford levels of protection similar to U.S. regulations for their own and for U.S.-licensed HPCs. For example, both countries place export controls on sales of computers over 2,000 MTOPS to specified destinations, according to German and Japanese officials. However, foreign government officials said that they do not enforce U.S. reexport controls on unlicensed U.S. HPCs. A study of German export controls noted that regulatory provisions specify that Germany has no special provisions on the reexport of U.S.-origin goods. According to German government officials, the exporter is responsible for knowing the reexport requirements of the HPC’s country of origin. We could not ascertain whether improper reexports of HPCs occurred from tier 1 countries. Only one German company reported several sales to tier 3 countries of HPCs over 2,000 MTOPS, and U.S. HPC subsidiaries reported no loss of sales due to foreign competition. Officials of U.S. HPC subsidiaries explained that they primarily compete for sales in local markets with other U.S. HPC subsidiaries. None of these officials identified lost HPC sales to other foreign vendors in those markets. Further, none claimed to be losing sales to foreign vendors because of delays in delivery resulting from the subsidiary’s compliance with U.S. export control regulations. Because some U.S. government and HPC industry officials consider indigenous capability to build HPCs a form of foreign availability, we examined such capabilities for tier 3 countries. Based on studies and views of specialists, we found that the capabilities of China, India, and Russia to build their own HPCs still lag well behind those of the United States, Japan, and European countries. Although details are not well-known about HPC developments in each of these tier 3 countries, most officials said and studies show that each country still produces machines in small quantities and of lower quality and power than U.S., Japanese, and European computers. For example: China has produced at least two different types of HPCs, the Galaxy and Dawning series, both based on U.S. technology and each believed to have an initial performance level of about 2,500 MTOPS. Although China has announced its latest Galaxy’s capability at 13,000 MTOPS, U.S. government officials have not confirmed this report. India has produced a series of computers called Param, which are based on U.S. microprocessors and are believed by U.S. DOE officials to be capable of performing at about 2,000 MTOPS. These officials were denied access to test the computers’ performance. Over the past 3 decades Russia has endeavored to develop commercially viable HPCs using both indigenously developed and U.S. microprocessors, but has suffered economic problems and lacks customers. According to one DOE official, Russia has never built a computer running better than 2,000 MTOPS, and various observers believe Russia to be 3 to 10 years behind the West in developing computers. Commerce and DOD each provided one set of general written comments for both this report and our report entitled, Export Controls: Information On The Decision to Revise High Performance Computer Controls (GAO/NSIAD-98-196, Sept. 16, 1998). Some of those general comments do not relate to this report. Therefore, we respond to them in the other report. General comments relevant to this report are addressed below. Additional specific comments provided by Commerce on this report are addressed in appendix II. In its written comments, Commerce said that the report’s scope should be expanded to better reflect the rationale that led to the decision to change computer export control policy “from a relic of the Cold War to one more in tune with today’s technology and international security environment.” This report responds to the scope of work required by Public Law 105-85 (Nov. 18, 1997), that we evaluate the current foreign availability of HPCs and their national security implications. Therefore, this report does not focus on the 1995 decisions by the Department of Commerce. Our companion report, referred to above, assesses the basis for the executive branch’s revision of HPC export controls. Commerce commented that our analysis of foreign availability as an element of the controllability of HPCs was too narrow, stating that foreign availability is not an adequate measure of the problem. Commerce stated that this “Cold War concept” makes little sense today, given the permeability and increased globalization of markets. We agree that rapid technological advancements in the computer industry have made the controllability of HPC exports a more difficult problem. However, we disagree that foreign availability is an outdated Cold War concept that has no relevance in today’s environment. While threats to U.S. security may have changed, they have not been eliminated. Commerce itself recognized this in its March 1998 annual report to the Congress, which stated that “the key to effective export controls is setting control levels above foreign availability.” Moreover, the concept of foreign availability, as opposed to Commerce’s notion of “worldwide” availability, is still described in EAA and Export Administration Regulations as a factor to be considered in export control policy. Commerce also commented that the need to control the export of HPCs because of their importance for national security applications is limited. It stated that many national security applications can be performed satisfactorily on uncontrollable low-level technology, and that computers are not a “choke point” for military production. Commerce said that having access to HPCs alone will not improve a country’s military-industrial capabilities. Commerce asserted that the 1995 decision was based on a variety of research leading to the conclusion that computing power is a secondary consideration for many applications of national security concern. We asked Commerce for its research evidence, but it cited only a 1995 Stanford study used in the decision to revise HPC export controls. Moreover, Commerce’s position on this matter is not consistent with that of DOD. DOD, in its Militarily Critical Technologies List, has determined that high performance computing is an enabling technology for modern tactical and strategic warfare and is also important in the development, deployment, and use of weapons of mass destruction. High performance computing has also played a major role in the ability of the United States to maintain and increase the technological superiority of its war-fighting support systems. DOD has noted in its High Performance Computing Modernization Program annual plan that the use of HPC technology has led to lower costs for system deployment and improved the effectiveness of complex weapon systems. DOD further stated that as it transitions its weapons system design and test process to rely more heavily on modeling and simulation, the nation can expect many more examples of the profound effects that the HPC capability has on both military and civilian applications. Furthermore, we note that the concept of choke point is not a standard established in U.S. law or regulation for reviewing dual-use exports to sensitive end users for proliferation reasons. In its comments, DOD stated that our report inaccurately characterized DOD as not considering the threats associated with HPC exports. DOD said that in 1995 it “considered” the security risks associated with the export of HPCs to countries of national security and proliferation concern. What our report actually states is that (1) except for nuclear weapons, the executive branch has not identified how and at what performance levels specific countries of concern may use HPCs for national security applications and (2) the executive branch did not undertake a threat analysis of providing HPCs to countries of concern. DOD provided no new documentation to demonstrate how it “considered” these risks. As DOD officials stated during our review, no threat assessment or assessment of the national security impact of allowing HPCs to go to particular countries of concern and of what military advantages such countries could achieve had been done in 1995. In fact, an April 1998 Stanford study on HPC export controls also noted that identifying which countries could use HPCs to pursue which military applications remained a critical issue on which the executive branch provided little information. The Arms Control and Disarmament Agency (ACDA) provided oral comments on this report and generally agreed with it. However, it disagreed with the statement that “according to the Commerce Department, the key to effective export controls is setting control levels above the level of foreign availability of materials of concern.” ACDA stressed that this is Commerce’s position only and not the view of the entire executive branch. ACDA said that in its view (1) it is difficult to determine the foreign availability of HPCs and (2) the United States helps create foreign availability through the transfer of computers and computer parts. The Departments of State and Energy had no comments on a draft of this report. Our scope and methodology are in appendix I. Commerce’s and DOD’s comments are reprinted in appendixes II and III, respectively, along with an evaluation of each. We conducted our review between December 1997 and June 1998 in accordance with generally accepted government auditing standards. Please contact me on (202) 512-4128 if you or your staff have any questions concerning this report. Major contributors to this report are listed in appendix IV. Section 1214 of the Fiscal Year 1998 National Defense Authorization Act (P.L. 105-85) required that we review the national security risks relating to the sale of computers with a composite theoretical performance of between 2,000 and 7,000 millions of theoretical operations per second (MTOPS) to end users in tier 3 countries. Accordingly, we examined the executive branch’s actions to assess the risks of these sales. As required by the act, we also reviewed the foreign availability of computers with performance levels at 2,000 to 7,000 MTOPS and the impact on U.S. exporters of foreign sales of these computers to tier 3 countries. To determine the executive branch’s actions to assess or analyze the national security risks of allowing high performance computers (HPC) to be provided to countries of proliferation and military concern, we reviewed the Department of Defense (DOD) and the Department of Energy (DOE) documents on how HPCs are being used for nuclear and military applications. We discussed high performance computing for both U.S. and foreign nuclear weapons programs with DOE officials in Washington, D.C., and at the Lawrence Livermore, Los Alamos, and Sandia National Laboratories. We also met with officials of the DOD HPC Modernization Office and other officials within the Under Secretary of Defense for Acquisition and Technology, the Office of the Secretary of Defense, the Joint Chiefs of Staff, and the intelligence community to discuss how HPCs are being utilized for weapons design, testing and evaluation, and other military applications. Additionally, we met with DOD and Institute of Defense Analyses officials to discuss the basis for identifying high performance computing on the Militarily Critical Technologies List, a compendium of technologies identified by DOD as critical for maintaining U.S. military and technological superiority. We also reviewed intelligence reports on the use of high performance computing for developing weapons of mass destruction. To determine foreign availability of HPCs, we reviewed the Export Administration Act (EAA) and the Export Administration Regulations for criteria and a description of the meaning of the term. We then reviewed market research data from an independent computer research organization. We also reviewed lists, brochures, and marketing information from major U.S. and foreign HPC manufacturers in France (Bull, SA), Germany (Siemens Nixdorf Informationssysteme AG and Parsytec Computer GmbH), and the United Kingdom (Quadrics Supercomputers World, Limited), and met with them to discuss their existing and projected product lines. We also obtained market data, as available, from three Japanese HPC manufacturers. Furthermore, we met with government officials in China, France, Germany, Singapore, South Korea, and the United Kingdom to discuss each country’s indigenous capability to produce HPCs. We also obtained information from the Japanese government on its export control policies. In addition, we obtained and analyzed from two Commerce Department databases (1) worldwide export licensing application data for fiscal years 1994-97 and (2) export data from computer exporters provided to the Department for all American HPC exports between January 1996 and October 1997. We also reviewed a 1995 Commerce Department study on the worldwide computer market to identify foreign competition in the HPC market prior to the export control revision. To identify similarities and differences between U.S. and foreign government HPC export controls, we discussed with officials of the U.S. embassies and host governments information on foreign government export controls for HPCs and the extent of cooperation between U.S. and host government authorities on investigations of export control violations and any HPC diversions of HPCs to sensitive end users. We also reviewed foreign government regulations, where available, and both foreign government and independent reports on each country’s export control system. To obtain information on the impact of HPC sales on U.S. exporters, we interviewed officials of American HPC firms and their subsidiaries and U.S. and foreign government officials. The following are GAO’s comments on the Department of Commerce’s letter, dated August 7, 1998. Commerce provided one set of written comments for this report and for a companion report, in which we discuss our analysis of the basis for the 1995 executive branch decision to revise export controls for HPCs. We addressed Commerce’s general comments relevant to this report on page 9 and its specific comments below. 1. Commerce stated that one key to effective export controls is setting control limits of items of concern above that which is widely available throughout the world. However, this wording is a change that contrasts with documentary evidence previously provided to us and to the Congress. In successive Export Administration Annual Reports, the Commerce Department stated that “the key to effective HPC export controls is setting control levels above foreign availability. . .” In addition, Commerce has provided us with no empirical evidence to demonstrate the “widespread availability” of HPCs, either through suppliers in Europe and Asia or a secondary market. 2. Commerce commented that a number of foreign manufacturers indigenously produce HPCs that compete with those of the United States. Our information does not support Commerce’s position on all of these manufacturers. For example, our visit to government and commercial sources in Singapore indicated that the country does not now have the capabilities to produce HPCs. We asked Commerce to provide data to support its assertion on foreign manufacturers, but it cited studies that were conducted in 1995 and that did not address or use criteria related to “foreign availability.” As stated in our report, we gathered data from multiple government and computer industry sources to find companies in other countries that met the terms of foreign availability. We met with major U.S. HPC companies in the United States, as well as with their overseas subsidiaries in a number of countries we visited in 1998, to discuss foreign HPC manufacturers that the U.S. companies considered as providing foreign availability and competition. We found few. Throughout Europe and Asia, U.S. computer subsidiary officials stated that their competition is primarily other U.S. computer subsidiaries and, to a lesser extent, Japanese companies. In addition, although requested, Commerce did not provide documentary evidence to confirm its asserted capabilities of India’s HPCs and uses. 3. Commerce stated that worldwide availability of computers indicates that there is a large installed base of systems in the tens of thousands or even millions. Commerce further stated that license requirements will not prevent diversion of HPCs unless realistic control levels are set that can be enforced effectively. While we agree, in principle, that increasing numbers of HPCs makes controllability more difficult, as our recommendation in our companion report suggests, a realistic assessment of when an item is “uncontrollable” would require an analysis of (1) actual data, (2) estimated costs of enforcing controls, and (3) pros and cons of alternatives—such as revised regulatory procedures—that might be considered to extend controls. Commerce did not perform such an analysis before revising export controls in 1995. In addition, although we requested that Commerce provide documentary evidence for its statement that there is a large installed base of HPCs in the millions, it did not provide such evidence. 4. Commerce stated that most European governments do not enforce U.S. export control restrictions on reexport of U.S.-supplied HPCs. We agree that at least those European governments that we visited hold this position. However, although requested, Commerce provided no evidence to support its statement that the government of the United Kingdom has instructed its exporters to ignore U.S. reexport controls. The following is GAO’s comment on DOD’s letter dated July 16, 1998. 1. DOD provided one set of written comments for this report and for a companion report, in which we discuss our analysis of the basis for the 1995 executive branch decision to revise export controls for HPCs. We addressed DOD’s comments relevant to this report on page 8. Hai Tran The first copy of each GAO report and testimony is free. Additional copies are $2 each. Orders should be sent to the following address, accompanied by a check or money order made out to the Superintendent of Documents, when necessary. VISA and MasterCard credit cards are accepted, also. Orders for 100 or more copies to be mailed to a single address are discounted 25 percent. U.S. General Accounting Office P.O. Box 37050 Washington, DC 20013 Room 1100 700 4th St. NW (corner of 4th and G Sts. NW) U.S. General Accounting Office Washington, DC Orders may also be placed by calling (202) 512-6000 or by using fax number (202) 512-6061, or TDD (202) 512-2537. Each day, GAO issues a list of newly available reports and testimony. To receive facsimile copies of the daily list or any list from the past 30 days, please call (202) 512-6000 using a touchtone phone. A recorded menu will provide information on how to obtain these lists.

Summary: Pursuant to a legislative requirement, GAO reviewed the efforts by the executive branch to determine national security risks associated with exports of high performance computers (HPC). GAO noted that: (1) the executive branch has identified high performance computing as having applications in such national defense areas as nuclear weapons programs, cryptology, conventional weapons, and military operations; (2) however, except for nuclear weapons, the executive branch has not identified how and at what performance levels specific countries of concern may use HPCs for national defense applications--an important factor in assessing risks of HPC sales; (3) a Department of Energy study on nuclear weapons was completed in June 1998; (4) the study shows that nuclear weapons programs in tier 3 countries (which pose some national security and nuclear proliferation risks to the United States), especially those of China, India, and Pakistan, could benefit from the acquisition of HPC capabilities; (5) the executive branch has only recently begun to identify how specific countries of concern would use HPCs for nonnuclear national defense applications; (6) to date, a Department of Defense study on this matter begun in early 1998 is not completed; (7) with regard to foreign availability of HPCs, GAO found that subsidiaries of U.S. computer manufacturers dominate the overseas HPC market and they must comply with U.S. controls; (8) three Japanese companies are global competitors of U.S. manufacturers, two of which told GAO that they had no sales to tier 3 countries; (9) the third company did not provide data on such sales in a format that was usable for GAO's analysis; (10) two of the Japanese companies primarily compete with U.S. manufacturers for sales of high-end HPCs at about 20,000 millions of theoretical operations per second (MTOPS) and above; (11) two other manufacturers, one in Germany and one in the United Kingdom, also compete with U.S. HPC suppliers, but primarily within Europe; (12) only the German company has sold HPCs to tier 3 countries; (13) Japan, Germany, and the United Kingdom each have export controls on HPCs similar to those of the United States, according to foreign government officials; (14) because there is limited competition from foreign HPC manufacturers and U.S. manufacturers reported no lost sales to foreign competition in tier 3 countries, GAO concluded that foreign suppliers of HPCs had no impact on sales by U.S. exporters; (15) in addition, Russia, China, and India have developed HPCs, but the capabilities of their HPCs are believed to be limited; (16) thus, GAO's analysis suggests that HPCs over 2,000 MTOPS are not available to tier 3 countries without restriction from foreign sources.