The National Research Council, a group comprised of representatives of the National Academy of Sciences, the National Academy of Engineering, and the Institute of Medicine, recently released a report that argues that just about everything about U.S. export control regime is broken. Unfortunately, the Council seems incapable of providing concrete solutions to fix the problem other than say that the laws ought to be rewritten from the ground-up and that we need, of all things, two more export agencies. One of the proposed agencies is a gateway agency to receive applications and then send them to the appropriate existing export agency; the other, an appeal body to review the decisions of the various export agencies.

Most of the criticisms of the export regime are fair points and ones that we’ve all heard before. For example, the report argues that U.S. export laws wind up favoring foreign producers of high technology, that the control lists are long, difficult to apply and outdated and control items readily available abroad. With regard to the foreign availability point, the report diminishes its credibility by providing examples that, frankly, aren’t terribly convincing even though better examples were readily at hand.

The first example is, rather surprisingly, based on Sony’s Playstation 3:

Computers with an adjusted peak performance above 0.75 weighted TeraFlops (speed rating) in aggregation are controlled. Yet, using information easily obtained on the internet, linking together 8 Cell processors (jointly developed by IBM, Sony, and Toshiba, and commonly found in the Sony Playstation 3), can produce 1 TeraFlop.

This seems to be a reference to a project by a professor of computational astrophysics to connect 8 PS3s to make a supercomputer that could perform highly complex calculations intended to model black hole events. I couldn’t easily find on the Internet instructions to connect two or more PS3s in a grid and, I suspect, such instructions would require more than casual technical expertise to implement. In short, even if one can theoretically link a bunch of PS3s together into a TeraFlop computer, it’s one thing to obtain such a device already assembled and quite another to obtain components that might be assembled into the controlled item by someone with technical expertise.

The second example cited by the Report relates to the controversial area of encryption controls where there are indeed numbers of good examples of foreign availability. Still, the report botches it:

Symmetric key encryption using greater than 64 bits key is controlled. However, software algorithms with capability greater than 64 bits, such as Twofish and Serpent, are already widely available via the Web.

Apparently the authors of the Report were unaware that publicly-available algorithms like Twofish and Serpent can be exported without a license or even prior review as long as the exporter provides to the Bureau of Industry and Security (“BIS”) a notice providing the link where the source code can be obtained (or a copy of the source code). And even though the publicly-available encryption algorithm can be incorporated into an export-controlled encryption product, the process is not sufficiently trivial so that the algorithm and the encryption product should be treated the same for export purposes.

Permalink


Copyright © 2009 Clif Burns. All Rights Reserved.
(No republication, syndication or use permitted without my consent.)