|
Concerns Over High Performance
Computer Exporters' Ability to Review End-Users in the PRC
Prompted the Requirement for Prior Notification
The January 1996 revisions to the Export Administration Regulations
governing HPCs made several other important changes. Most importantly,
they made exporters responsible for determining whether an export
license is required, based on the MTOPS level of the computer,
and for screening end users and end uses for military or proliferation
concerns.134
Thus, U.S. companies that wish to export HPCs are now authorized
to determine their own eligibility for a license exception.135
Prior to this change, only U.S. HPC exports to Japan were
allowed without an individual license. At that time, a violation
of the Export Administration Regulations could be identified
by an export of an HPC that occurred without a license.
Since the change, in order to prove a violation of the regulations,
the Commerce Department must demonstrate that an exporter improperly
used the Composite Theoretical Performance license exception
and knew or had reason to know that the intended end user would
be engaged in military or proliferation activities.136
Also, the revised Export Administration Regulations required
that exporters keep records and report to the Commerce Department
on exports of computers with performance levels at or above 2,000
MTOPS. In addition to existing record-keeping requirements, the
regulations added requirements for the date of the shipment,
the name and address of the end user and of each intermediate
consignee, and the end use of each exported computer. Although
these records have been reported to the Commerce Department on
a quarterly basis for the past two years, some companies have
reported inconsistent and incomplete data for resellers or distributors
as end users.137
Since U.S. HPCs obtained by countries of proliferation concern
could be used in weapons-related activities, the Congress enacted
a provision in the Fiscal Year 1998 National Defense Authorization
Act138 that required exporters to notify the Commerce Department
of all proposed HPC sales over 2,000 MTOPS to Tier 3 countries.
The Act gives the U.S. Government an opportunity to assess these
exports within 10 days and determine the need for a license.
Following such notification, the Departments of Commerce, State,
Defense, and Energy, and the U.S. Arms Control and Disarmament
Agency, can review a proposed HPC sale and object to its proceeding
without an export license. The Commerce Department announced
regulations implementing the law on February 3, 1998.139
A November 1998
Defense Department study, however, identified potential problems
with the 10-day notification procedure. The study noted that
the Defense Department provides comments on export notices referred
to it regarding those end users for which the Defense Department
has information. The study also noted that:
The operating assumption is that, if there is no information
on the end-user, then the end-user is assumed to be legitimate.
This is probably true in most cases; however, there is no means
to verify that high performance computers are not making their
way to end-users of concern to the United States.140
Furthermore, the Defense Department study expressed concern
that foreign buyers might circumvent current Export Administration
Regulations provisions requiring attestation to the buyer's knowledge
that the export will have no military or proliferation end user
or end use.141 By designating a company in the United States
to act on its behalf, the foreign company could have its U.S.
designee submit the HPC notification to the Commerce Department;
the U.S. designee and not the foreign buyer would then be responsible
for all compliance with notification procedures.142 The U.S.
designee would be responsible only for shipping the item and
would not take title of the item.143
Under the Export Administration Regulations, the U.S. designee
could complete the notification to its knowledge, which might
be useless if the U.S. designee is in fact ignorant of the actual
end use. The Defense Department study noted the obvious problems
with this system.
The study also observed that the 10-day notification period
was insufficient to ensure that U.S. designees and foreign buyers
are providing accurate and complete information.144
Finally, the Defense Department study warned that foreign
buyers of U.S. computer technology might circumvent the notification
procedure by notifying the Commerce Department that they are
purchasing a system that is not above the 7,000 MTOPS threshold,
but later upgrading the system with processors that are below
the 2,000 MTOPS level. There would be no requirement to notify
the Commerce Department of the acquisition of the lower than
2,000 MTOPS upgrades to the previously-notified system.145
The
U.S. Government Has Conducted Only One End-Use Check for High
Performance Computers in the PRC
The Fiscal 1998 National Defense Authorization Act now requires
the Commerce Department to perform post-shipment verifications
on all HPC exports of HPCs to Tier 3 countries with performance
levels over 2,000 MTOPS.146
Post-shipment verifications are important for detecting and
deterring physical diversions of HPCs, but they do not always
verify the end use of HPCs.147
The PRC traditionally has not allowed the United States to
conduct post-shipment verifications, based on claims of national
sovereignty, despite U.S. Government efforts since the early
1980s.148 This obduracy has had little consequence for the PRC,
since HPC exports have continued to be approved and, in fact,
have increased in recent years.
In June 1998, the PRC agreed with the United States to cooperate
and allow post-shipment verifications for all exports, including
HPCs.149 PRC conditions on the implementation of post-shipment
verifications for HPCs, however, render the agreement useless.150
Specifically:
· The PRC
considers requests from the U.S. Commerce Department to verify
the actual end-use of a U.S. HPC to be non-binding
· The PRC
insists that any end-use verification, if it agrees to one, be
conducted by one of its own ministries, not by U.S. representatives
· The PRC
takes the view that U.S. Embassy and Consulate commercial service
personnel may not attend an end-use verification, unless they
are invited by the PRC
· The PRC
argues scheduling of any end-use verification - or indeed, whether
to permit it at all - is at the PRC's discretion
· The PRC
will not permit any end-use verification of a U.S. HPC at any
time after the first six months of the computer's arrival in
the PRC
The Select Committee has reviewed the terms of the U.S.-PRC
agreement and found them wholly inadequate. The Clinton administration
has, however, advised the Select Committee that the PRC would
object to making the terms of the agreement public. As a result,
the Clinton administration has determined that no further description
of the agreement may be included in this report.
According to Iain S. Baird, Deputy Assistant Secretary of
Commerce for Export Administration within the Bureau of Export
Administration, post-shipment verifications are conducted by
the PRC's Ministry of Foreign Trade and Economic Cooperation
for U.S. computers having over 2,000 MTOPS that are exported
to the PRC. He says such verifications are done in the presence
of the U.S. commercial attaché.151
Commerce reported on November 17, 1998, that no post-shipment
verifications would be performed on HPCs that were exported to
the PRC from November 18, 1997 through June 25, 1998 because
the PRC/U.S. agreement applies only prospectively from June 26.
Since June 26, the
Commerce Department reported, only one post-shipment verification
has been completed and one was pending as of November 12, 1998.
Commerce also stated that "Post shipment verifications were
not done on most of the others [HPCs] because the transactions
do not conform to our arrangement with the PRC for end use checks."152
Thus, post-shipment verifications will not be done on any
HPCs exported to the PRC prior to the agreement, nor on any HPCs
shipped that are exported in the future under the Composite Theoretical
Performance license exception (that is, those between 2,000 and
7,000 MTOPS) to civilian end users.
According to Commerce Department Under Secretary for Export
Enforcement William Reinsch, a pending regulatory change will
instruct HPC exporters to seek end-use certificates from the
PRC Government. Where PRC end-use certificates are obtained,
this regulation purportedly would allow more post-shipment verifications
to be requested consistent with the PRC-U.S. agreement.153
Reinsch stated that the PRC has indicated that it would be
willing to issue end-use certificates. However, the PRC office
in question reportedly has a staff of five, which would severely
limit the number of post-shipment verifications it could implement.154
According to a September 1998 report from the General Accounting
Office, U.S. Government officials agreed that the manner in which
post-shipment verifications for computers traditionally have
been conducted has limited their value because they establish
only the physical presence of an HPC, not its actual use. In
any event, according to national weapons laboratory officials
within the Energy Department, it is easy to conceal how a computer
is being used.155
Even when U.S. Government officials perform the post-shipment
verification, the verifying officials have received no specific
computer training and are capable of doing little more than verifying
the computer's location. It is possible to verify an HPC's use
by reviewing internal computer data, but this is costly and intrusive,
and requires sophisticated computer analysis.156
The General Accounting Office report also noted that the U.S.
Government makes limited efforts to monitor exporter and end-user
compliance with explicit conditions that are often attached to
HPC export licenses for sensitive end users. The U.S. Government
relies largely on the HPC exporters to monitor end use, and may
require them or the end users to safeguard the exports by limiting
access to the computers or inspecting computer logs and outputs.157
The end user may also be required to agree to on-site inspections,
even on short notice, by the U.S. Government or exporter. These
inspections would include review of the programs and software
that are being used on the computer, or remote electronic monitoring
of the computer.158
Commerce officials stated to GAO that they may have reviewed
computer logs in the past, but do not do so anymore, and that
they have not conducted any short-notice visits. They also acknowledged
that they currently do not do any remote monitoring of HPC use
anywhere and that, ultimately, monitoring compliance with safeguards
plans and their conditions is the HPC exporter's responsibility.159
Some
U.S. High Performance Computer Exports
to the PRC Have Violated U.S. Restrictions
During the 1990s, there have been several cases of export
control violations involving computer technology shipments to
the PRC. One ongoing case concerns the diversion of a Sun Microsystems
HPC from Hong Kong to the PRC.160
On December 26, 1996, a Hong Kong reseller for Sun Microsystems,
Automated Systems Ltd., sold an HPC to the PRC Scientific Institute,
a technical institute under the Chinese Academy of Sciences -
a State laboratory specializing in parallel and distributed processing.
At some point after the sale but before delivery, the computer
was sold to Changsha Science and Technology Institute in Changsha,
Hunan Province. The machine was delivered directly to that Institute
in March 1997.161
Automated Systems of Hong Kong claimed to Sun officials in
June 1997 that it had understood that the Changsha Institute
was "an educational institute in Wuhan Province providing
technological studies under the Ministry of Education."
The end use there, according to Automated Systems, was to be
for "education and research studies in the college and sometimes
for application development for outside projects." Sun was
recommended to contact the end user, the Changsha Institute,
for more specific end-use information.162
The HPC sale came to the attention of the Deputy Assistant
Secretary for Export Enforcement, Frank Deliberti. He queried
the U.S. Embassy in Beijing about the Changsha Institute. Deliberti
gave the information he obtained to Sun Microsystems, which then
initiated efforts to have its computer returned.163
During the same period, the Foreign Commercial Officer at
the U.S. Embassy in Beijing consulted his contacts at the PRC's
Ministry of Foreign Trade and Economic Cooperation. The Ministry
denied that the Changsha Institute was affiliated with the PRC
military.164
Subsequently, the
Ministry called the FCO to inform him that the actual buyer of
the computer was an entity called the Yuanwang Corporation, and
that Sun Microsystems had been aware of this corporation's PRC
military ties. Reportedly, Yuanwang is an entity of the Commission
on Science, Technology, and Industry for National Defense (COSTIND).
So far as the PRC's Ministry of Foreign Trade and Economic Cooperation
reportedly could determine, the end-use statements that had been
provided to Sun through Automated Systems of Hong Kong were totally
fictitious. The Changsha Science and Technology Institute, according
to the Ministry, did not exist.165
The official position of the Ministry of Foreign Trade and
Economic Cooperation was that the PRC Government would not help
to obtain the return of the computer. The role of the PRC Government,
the Ministry asserted, had been merely to help two private parties
rectify a misunderstanding. In any event, the computer was returned
to the United States on November 6, 1997.166 The Commerce Department
investigation reportedly is continuing.167
A number of other violations of U.S. laws and regulations
concerning computers exported to the PRC have been investigated
by the Commerce Department:
New World Transtechnology
On December 20, 1996, New World Transtechnology of Galveston,
Texas, pled guilty to charges that it violated the export control
laws and engaged in false statements by illegally exporting controlled
computers to a nuclear equipment factory in the PRC in August
1992. The company was also charged with attempting to illegally
export an additional computer to the PRC through Hong Kong in
October 1992. The company was sentenced to pay a $10,000 criminal
fine and a $600 special assessment fee.168
Compaq Computer Corporation
On April 18, 1997, the Commerce Department imposed a $55,000
civil penalty on Compaq Computer Corporation of Houston, Texas,
for alleged violations of the Export Administration Regulations.
The Commerce Department alleged that, on three separate occasions
between September 17, 1992 and June 11, 1993, Compaq exported
computer equipment from the United States to several countries,
including the PRC, without obtaining required export licenses.
Compaq agreed to pay the civil penalty to settle the allegations.169
Digital Creations
On June 12, 1997, Digital Creations Corporation of Closter, New
Jersey, was sentenced to pay an $800,000 criminal fine for violating
the Export Administration Act and Regulations in connection with
exports of computers to the PRC. Digital had previously pled
guilty in December 1994 to charges that it had violated the Export
Administration Regulations by illegally exporting a Digital Equipment
Corporation computer to the PRC without obtaining the required
export license.170
Lansing Technologies Corporation
On June 17, 1997, Lansing Technologies Corporation, of Flushing,
New York, pled guilty to charges that it violated the Export
Administration Regulations in 1992 by exporting a Digital Equipment
Corporation computer vector processor and a data acquisition
control system to the PRC without obtaining the required export
licenses from the Commerce Department.171
Other serious violations of HPC export control laws and regulations
have occurred in recent years, but these concerned Russia. On
July 31, 1998, for example, the Department of Justice announced
that IBM East Europe/Asia Ltd. entered a guilty plea. IBM received
the maximum allowable fine of $8.5 million for 17 counts of violating
U.S. export laws through the sale of HPCs to a Russian nuclear
weapons laboratory known as Arzamus-16. In another example, an
ongoing U.S. Government investigation of Silicon Graphics Incorporated/Convex
is examining whether a violation of law occurred in a sale of
HPCs to another Russian nuclear weapons laboratory, Chelyabinsk-70.172
High Performance Computers
at U.S. National Weapons Laboratories
Are Targets for PRC Espionage
No other place in the world exceeds the computational power
found within the U.S. national weapons laboratories. For this
reason, both the computational power and the data it can generate
have been the focus of the PRC's and other countries' intelligence
collection efforts.
The desire for access to this computing power and data, in
turn, is one of the reasons so many foreign nationals want to
visit the laboratories.
According to David Nokes, the network administrator at Los
Alamos National Laboratory, all operating systems have vulnerabilities
that can be exploited by a knowledgeable, valid user.173 Nokes
also says that there are a few solutions to issues of HPC network
security. These include:
· Allowing
only U.S. students to use the networks
· Limiting
physical access to high performance computer networks at universities
· Enhancing
physical security and security education at universities174
U.S.
National Weapons Laboratories Have Failed
to Obtain Required Export Licenses for
Foreign High Performance Computer Use
When foreign nationals use the U.S. national weapons laboratories'
HPCs, their activities should generally be considered "deemed
exports." The "deemed export" rule [15 CFR 734.2
(b) (ii)] covers those situations in which an export-controlled
technology or software-source code information is released to
a visiting foreign national, for which a license would have been
required. In such situations, an "export" is "deemed"
to have occurred.
The Select Committee is concerned that HPC system managers
in the U.S. national weapons laboratories lack an essential understanding
of the deemed export rule. This lack of understanding was substantiated
by interviews with representatives from the Department of Commerce
who had no recollection of ever having seen an application for
a deemed export from any of the U.S. national weapons laboratories.
When PRC nationals visit and use the HPCs at a U.S. national
weapons laboratory, their access should be limited to the same
computing capabilities to which the PRC itself is restricted,
especially for military uses.175 The Select Committee discovered,
however, that the laboratories do not even measure the computational
power of their HPCs in MTOPS. Moreover, many of the laboratories
have difficulty in converting to MTOPS from the units they use
to measure the power of an HPC.
The Department of
Commerce could not recall a laboratory ever having sought guidance
on how to compute an HPC's MTOPS rating. Significantly, the
Select Committee discovered that a rather modest HPC (by Department
of Energy standards) in a U.S. National Laboratory used by foreign
nationals had a substantially higher MTOPS rating than the controlled
threshold. No licenses, however, had ever been obtained.
The "deemed export" rule also applies in those instances
in which a PRC national or entity accesses an HPC remotely via
the Internet.
In the absence of an effective audit system, which monitors
the codes being run by the PRC user, the U.S. national weapons
laboratories cannot verify that they are in compliance with the
law, or that PLA or PRC intelligence is not using the HPCs for
the design or testing of nuclear or other weapons.
PRC
Students Have U.S. Citizen-Like Access To High Performance Computers
at the National Weapons Laboratories
The U.S. national weapons laboratories rely upon nuclear weapons
test simulation software and computers provided by the Accelerated
Strategic Computer Initiative (ASCI). Five major U.S. universities
support ASCI through the Academic Strategic Alliances Program
(ASAP).
As a result, hundreds of research students and staff at these
universities have access to the HPCs used by the national weapons
laboratories for U.S. nuclear weapons research and testing. As
many as 50 percent of these research students and staff are foreign
nationals, some of whom may have foreign intelligence affiliations.
Holders of Immigration and Naturalization Service "green
cards" - PRC nationals who have declared their intent to
remain permanently in the U.S. - are treated as U.S. citizens
for export control purposes. They are then given U.S. citizen-like
HPC access, free to return to the PRC once their objectives are
fulfilled.
In November 1998, the Secretary of Energy issued an Action
Plan that includes a task force to review HPC usage by foreign
nationals and provide a report to the Secretary within six months.
The Department of Energy is currently preparing an implementation
plan to address counterintelligence issues identified in a July
1998 report, entitled "Mapping the Future of the Department
of Energy's Counterintelligence Program," including HPC
usage by foreign nationals.
Many Types of Computer Technology
Have Been Made Available to the PRC
That Could Facilitate Running Programs
Of National Security Importance
One of the bases for the 1996 increase in export control thresholds
was that individual PCs were widely available on the open market
in the United States, but not able to be exported to the potentially
huge PRC market.176 What was an HPC in 1993 (those capable of
195 or more MTOPS) was no longer even considered necessary to
control for weapons proliferation concerns.177
By 1997, PCs and workstations assembled in the PRC captured
approximately 60 percent of the PRC's domestic market.178 All
of these locally-assembled computers used imported parts - over
70 percent contained United States-produced Pentium microprocessors.179
Three of the largest manufacturers in the PRC were affiliates
of IBM, Hewlett Packard, and Compaq, with a combined market share
of approximately 21 percent.180 A large share (but probably not
more than 20 percent) of the PC assembly in the PRC was done
by small, independent assembly shops.181
The largest individual producer of PCs and workstations in
the PRC is the Legend enterprise, a spin-off of the Chinese Academy
of Sciences.182 This domestic computer assembly industry dovetails
well with Beijing's overall plans for economic modernization.
Beijing reportedly desires an independent PRC source of most
high-technology items to avoid reliance on foreign providers
for these goods.
To participate more
fully in the PRC market, United States firms have been pressured
by the PRC government to relinquish technological advantage for
short-term market opportunities. The PRC requires that foreign
firms be granted access to the PRC market only in exchange for
transferring technology that would enable the state-run enterprises
to eventually capture the home market and begin to compete internationally.
However, the PRC's strategy of coercing technology from foreign
firms has not enabled state-run industries to close the technology
gap with more developed nations. In the context of establishing
domestic production of computers for sale in the PRC, this PRC
"technology coercion" policy appears to have worked.183
The PRC now has a growing industrial base of small computer assemblers.
For the most part, these companies are not State-run. The technology
that was "coerced" from U.S. computer manufacturers
as a cost of entering the PRC market apparently better serves
the expansion needs of small, relatively independent enterprises
and not the intended needs of central planners in Beijing.
90 percent of PRC consumers of PCs and workstations are business,
government, and educational entities, with individual purchases
accounting for only 10 percent of the PRC's PC market.184 To
illustrate the size of the individual purchaser segment of the
PRC's market, it is estimated that only 5 million individuals
out of the PRC's 1.2 billion have the expendable funds required
to purchase a low-end PC in the PRC.185
Despite the limited number of individual purchasers, the actual
size of the PRC PC and workstation market was 2.18 million units
in 1996; 3 million units in 1997; and 4.5 million units in 1998.
It is anticipated the PRC PC and workstation market will grow
at the rate of 1.5 million to 2 million units per year through
the year 2000. According to figures provided by the Asia Technology
Information Project, an independent research foundation, non-PRC
manufacturers of PCs and workstations, including U.S. manufacturers,
could expect to partake of a portion of the almost 2 million
units expected to be imported for sale in the PRC in 1998.186
The PRC Has a Limited Capability
to Produce High Performance Computers
The PRC has demonstrated the capability to produce an HPC
using U.S.-origin microprocessors over the current threshold
of 7,000 MTOPS. The PRC "unveiled" a 10,000 MTOPS HPC
- the Galaxy III - in 1997 based on Western microprocessors.
But PRC HPC application software lags farther behind world
levels than its HPC systems. Also, despite the existence of a
few PRC-produced HPCs based on Western components, the PRC cannot
cost-effectively mass-produce HPCs currently. There really is
no domestic HPC industry in the PRC today.
While it is difficult to ascertain the full measure of HPC
resources that have been made available to the PRC from all sources,
available data indicates that U.S. HPCs dominate the market in
the PRC.187
Although the PRC has a large market for workstations and high-end
servers, there is a smaller market for parallel computers which
is entirely dominated by non-PRC companies such as IBM, Silicon
Graphics/Cray, and the Japanese NEC. However, there continues
to be significant market resistance to Japanese HPC products
in Asia, especially as U.S. products are beginning to have significant
market penetration.188
U.S. High Performance Computer
Exports
To the PRC Are Increasing Dramatically
A review of Commerce Department information regarding the
total of HPC license applications that were received for the
time frame January 1, 1992 to September 23, 1997, revealed the
following:
· Only one
HPC export license to Hong Kong (with a value of $300,000) was
rejected
· 100 HPC
export licenses to the PRC (with a total value of $11,831,140)
were rejected by Commerce
· 37 HPC
export licenses to Hong Kong (with a total value of $55,879,177)
were approved
· 23 HPC
export licenses to the PRC for HPCs within the 2,000 to 7,000
MTOPS range (with a total value of $28,067,626) were approved
· Two of
the 23 HPC export licenses to the PRC for HPCs within the 11,000
to 12,800 MTOPS range (with a total value of $2,550,000) were
approved in 1998189
The approximate total value of the HPCs exported, of whatever
description, to both Hong Kong and the PRC, for the six-year
period ending September 23, 1997, was only $86 million.190
The nine-month period between January 1998 and September 1998,
however, saw U.S. exporters notify the Commerce Department of
their intention to export 434 HPCs (in the 2,000 to 7,000 MTOPS
range) to the PRC (total value $96,882,799).191 Nine times the
number of HPCs were exported in one-ninth the time.192
During approximately the same time frame (calendar year 1998)
it is estimated that 9,680,000 individual PCs and workstations
were sold in the PRC. The market share that U.S. exporters could
reasonably expect to benefit from was approximately 3,872,000
units, worth approximately $1.8 billion.193
Apparently, the proximate cause of U.S. computer manufacturers
aggressively lobbying for the raising and maintaining of export
thresholds above the PC level was to capture this $1.8 billion
per year market share.
The United States dominates the PRC's HPC market, but U.S.
exports clearly do not dominate the PRC's personal computer and
workstation market.194 The difference between the 460-unit, $100
million HPC market described above, stretched over a six-year
period, and the yearly 3.8 million-unit PC and workstation market,
with a value of $1.8 billion, is dramatic.
The performance levels of U.S. HPCs reported to be exported
to the PRC over the past year continued to be predominantly in
lower-end machines, as shown in the following table. For example,
77 percent of U.S. HPCs (a total of 388 machines) have performance
levels below 4,000 MTOPS.
The PRC Is Obtaining Software
From U.S. and Domestic Sources
In June 1997, it was estimated that 96 percent of software
programs sold in the PRC were pirated versions of commercially
available U.S. programs. These programs were designed for use
on PCs and workstations, and are not considered useful for the
very sophisticated programming done on HPCs.
Some major U.S. software producers have begun contracting
with PRC programming firms. These PRC software firms are comprised
of recently-graduated PRC university students. They are attempting
to write programs in Chinese to capitalize on a huge domestic
market.196
Two factors mitigate against the success of the PRC developing
its domestic programming industry.
The first factor is that street-level "software pirates"
sell dozens of U.S. computer programs at a time on one CD-ROM
for a small fee (reportedly $20). In other words, one can meet
most or all of one's programming needs in the PRC for a nominal
fee. It is anticipated that it will be difficult, if not impossible,
for a domestic software industry to recoup the start up costs
associated with just one software program, let alone the dozens
needed to compete with the street level dealers.
The second factor is that these pirated U.S.-produced, English
language programs are more mature, widespread, and robust than
PRC programs.197 It is axiomatic that any new product will have
"bugs in the system." It is considered unlikely that
new, unproven, and possibly weak software programs will effectively
compete with cheap, proven, and robust software that is widely
available at such nominal fees. It is conceivable that the PRC
will abandon instituting a domestic programming industry altogether.198
Potential Methods of
Improving End-Use Verification
According to a 1996 RAND study, there are non-intrusive and
intrusive approaches to assessing the manner in which a buyer
is actually applying dual-use technologies. Among the non-intrusive
methods are:
· Memoranda
of understanding and agreements
· National
technical means of verification
· Limitations
designed into the transferred technologies
· Transparency
measures
Among the intrusive methods are:
· Inspections
· Tagging199
Tagging
Tagging is achieved by attaching an active system to the item
that is to be exported, rather than just a passive tag for identification
during an inspection. The active system would both monitor the
object tagged and communicate that information back to the United
States. The RAND study noted that in practice, this means the
objects to be tagged must be physically large systems, such as
a machine-tool cell, or a major component of some larger system,
such as a turbine engine in a helicopter.200
According to the RAND study, the tag should be capable of
at least communicating information about the item's physical
location. Some sensors may provide other kinds of information,
as well. The information could be communicated to a satellite
or over a data link. Early versions of such devices were already
in use in 1996 to monitor nuclear materials and technologies.201
These "smart" tags exploit the potential of several
technologies, according to the RAND study. They combine encryption,
the Global Positioning System, and emerging global wireless communications
systems, such as Iridium or Orbcomm. These technologies would
allow the tags to report back on the status and location of the
tagged object. In principle, such tags could report the position
of an object at any given time in order to verify limitations
on their location. Such tags could also report on the activities
of a "smart" system to which they are attached. For
example, a machine-tool cell could report whether the machine
had been used to make parts resembling aircraft components.202
Such tags could have many applications in a cooperative regime.
Their application and use in a prohibited environment would be
more difficult and consequential.203
The RAND study cautioned that all sellers of a particular
technology must participate in the tagging and that this would
probably also require cooperation of the buyers. Otherwise, buyers
would gravitate to untagged items, if they were available. Attempts
to conceal system location or deviate from a pattern of cooperation
would be considered evidence of a potential failure of performance
by the buyer. The study concluded that tagging may become an
important oversight method for controlling technology transfers,
but that it should never become the sole means of oversight.204
Technical
Safeguards
In 1994 several types of technical safeguards were in advanced
development in the United States. The technologies required for
these safeguards were expected to enter testing within the next
two years. They included:
· Controlled-execution
UNIX - a modified computer operating system that could run
only certain pre-approved programs; likely to be most useful
for computers sold to facilities such as weather-forecasting
centers, oil companies, automobile manufacturers, and banks
· "Black
box" monitoring hardware - inexpensive, secure, long-term
audit recording devices, possibly based on write-once optical
storage units that could be embedded in mass-produced workstations;
analogous to the black box flight-data recorders that are installed
in aircraft and used for post-crash accident analysis
· "Meltdown"
software - modified operating system programs designed to
require updating by the manufacturer at fixed times; if not updated,
the computer refuses to run
· Automated
auditing tools - pattern-recognition or rule-based software;
would assist monitoring agencies to more effectively inspect
huge collections of data from system activity logs and detect
the (presumably few) incidents worth detailed analysis
Although these techn | 
