Export Controls: Information on the Decision to Revise High Performance
Computer Controls (Letter Report, 09/16/98, GAO/NSIAD-98-196).

Pursuant to a legislative requirement and a congressional request, GAO
reviewed concerns that U.S. national security interests may have been
compromised by sales of unlicensed high performance computers (HPC) to
China and Russia, focusing on: (1) the basis for the executive branch's
revision of HPC export controls; (2) changes in licensing activities and
the implementation of certain U.S. licensing and export enforcement
requirements since the revision; and (3) the current foreign
availability of HPCs, particularly for certain countries of national
security concern.

GAO noted that: (1) a Stanford University study on foreign availability
of HPCs was a key element in the decision to revise HPC export controls;
(2) however, GAO's analysis of the study showed that it had 2
significant limitations; (3) first, the study lacked empirical evidence
or analysis to support its conclusion that HPCs were uncontrollable
based on worldwide availability and insufficient resources to control
them; (4) second, the study did not assess the capabilities of countries
of concern to use HPCs for military and other national security
applications; (5) the study's principal author said that U.S. government
data was insufficient to make such an assessment, and the study
recommended that better data be gathered so that such an analysis could
be done in the future; (6) the executive branch did not undertake a
threat analysis of providing HPCs to countries of concern, but raised
the computing power thresholds for HPC export controls and established a
four-tier control structure; (7) the 1996 revision to HPC export
controls had three key consequences; (8) the number of computer export
licenses issued declined from 395 in the fiscal year 1995 to 42 in 1997;
(9) U.S. HPC exporters were charged with responsibilities previously
conducted by the government, including screening and reporting on the
end use and end user of HPCs; (10) the regulation required HPC
manufacturers to keep records of the end users of all their HPC exports
over 2,000 million theoretical operations per second (MTOPS); (11) to
date, information on these exports reported to the government has been
incomplete; (12) responsibility for postshipment verification (PSV)
checks remained with the government; (13) however, because of how PSVs
for computers are implemented, their value is reduced because they
verify the physical location of a HPC, but not how it is used; (14)
subsidiaries of U.S. computer manufacturers dominate the overseas HPC
market, and they must comply with U.S. controls; (15) three Japanese
companies are global competitors of U.S. manufacturers, two of which
told GAO that they had no sales to tier 3 countries such as Russia and
China; (16) Japan, Germany and the United Kingdom each have export
controls on HPCs similar to those of the United States, according to
foreign government officials; (17) Russia, China, and India have
developed HPCs, but the capabilities of their computers are believed to
be limited; and (18) thus, GAO's analysis suggests that HPCs over 2,000
MTOPS are not readily available to tier 3 countries from foreign sources
without restrictions.

--------------------------- Indexing Terms -----------------------------

 REPORTNUM:  NSIAD-98-196
     TITLE:  Export Controls: Information on the Decision to Revise High 
             Performance Computer Controls
      DATE:  09/16/98
   SUBJECT:  Export regulation
             Foreign trade agreements
             International relations
             Foreign governments
             Technology transfer
             Computer equipment industry
             Supercomputers
             Dual-use technologies
             Foreign trade policies
             Nuclear proliferation
IDENTIFIER:  Japan
             Germany
             United Kingdom
             China
             Russia
             France
             India
             
******************************************************************
** This file contains an ASCII representation of the text of a  **
** GAO report.  Delineations within the text indicating chapter **
** titles, headings, and bullets are preserved.  Major          **
** divisions and subdivisions of the text, such as Chapters,    **
** Sections, and Appendixes, are identified by double and       **
** single lines.  The numbers on the right end of these lines   **
** indicate the position of each of the subsections in the      **
** document outline.  These numbers do NOT correspond with the  **
** page numbers of the printed product.                         **
**                                                              **
** No attempt has been made to display graphic images, although **
** figure captions are reproduced.  Tables are included, but    **
** may not resemble those in the printed version.               **
**                                                              **
** Please see the PDF (Portable Document Format) file, when     **
** available, for a complete electronic file of the printed     **
** document's contents.                                         **
**                                                              **
** A printed copy of this report may be obtained from the GAO   **
** Document Distribution Center.  For further details, please   **
** send an e-mail message to:                                   **
**                                                              **
**                                            **
**                                                              **
** with the message 'info' in the body.                         **
******************************************************************


Cover
================================================================ COVER


Report to the Chairman, Subcommittee on International Security,
Proliferation, and Federal Services, Committee on Governmental
Affairs, U.S.  Senate

September 1998

EXPORT CONTROLS - INFORMATION ON
THE DECISION TO REVISE HIGH
PERFORMANCE COMPUTER CONTROLS

GAO/NSIAD-98-196

Export Controls

(711296)


Abbreviations
=============================================================== ABBREV

  ACDA - Arms Control and Disarmament Agency
  DOD - Department of Defense
  DOE - Department of Energy
  EAA - Export Administration Act
  HPC - high performance computer
  MTOPS - millions theoretical operations per second
  PSV - post-shipment verification

Letter
=============================================================== LETTER


B-280320

September 16, 1998

The Honorable Thad Cochran
Chairman, Subcommittee on International Security,
 Proliferation, and Federal Services
Committee on Governmental Affairs
United States Senate

Dear Mr.  Chairman: 

In January 1996, the executive branch revised controls on the export
of U.S.- manufactured high performance computers (HPC) by raising
thresholds of computer performance for which exporters must obtain a
license.  Subsequently, several unlicensed HPCs were exported to both
China and Russia, including 17 computers illegally sent to a Russian
nuclear weapons lab.  You expressed concerns that U.S.  national
security interests may have been compromised by such sales\1 and
requested that we (1) assess the basis for the executive branch's
revision of HPC export controls and (2) identify changes in licensing
activities and the implementation of certain U.S.  licensing and
export enforcement requirements since the revision.  You also asked
us to determine the current foreign availability of HPCs,
particularly for certain countries of national security concern. 

We are also issuing a related report entitled, Export Controls: 
National Security Issues and Foreign Availability for High
Performance Computers (GAO/NSIAD-98-200, Sept.  16, 1998), pursuant
to section 1214 of the Fiscal Year 1998 National Defense
Authorization Act (P.L.  105-85). 


--------------------
\1 The circumstances surrounding these specific exports are being
investigated by the U.S.  Departments of Justice and Commerce and the
Customs Service.  On July 31, 1998, the Department of Justice
announced that IBM East Europe/Asia Ltd.  entered a guilty plea and
received the maximum allowable fine of $8.5 million for violating 17
counts of U.S.  export laws. 


   BACKGROUND
------------------------------------------------------------ Letter :1

The U.S.  export control system is about managing risk; exports to
some countries involve less risk than to other countries and exports
of some items involve less risk than others.  Under U.S.  law, the
President has the authority to control and require licenses for the
export of items that may pose a national security or foreign policy
concern.  The President also has the authority to remove or revise
those controls as U.S.  concerns and interests change.\2 In doing so,
the President is not required under U.S.  law to conduct a foreign
availability analysis. 

In 1995, as a continuation of changes begun in the 1980s, the
executive branch reviewed export controls on computer exports to
determine how changes in computer technology and its military
applications should affect U.S.  export control regulations.  In
announcing its January 1996 change to HPC controls, the executive
branch stated that one goal of the revised export controls was to
permit the government to tailor control levels and licensing
conditions to the national security or proliferation risk posed at a
specific destination. 

A key element of the executive branch review of HPC export controls
was a Stanford University study, jointly commissioned by the Commerce
and Defense Departments.\3 Among other things, the study was tasked
to provide an assessment of the availability of HPCs in selected
countries and the capabilities of those countries to use HPCs for
military and other national security applications.  The study
concluded that (1) U.S.-manufactured computer technology between
4,000 and 5,000 millions of theoretical operations per second
(MTOPS)\4 was widely available and uncontrollable worldwide, (2)
U.S.-manufactured computer technology up to 7,000 MTOPS would become
widely available and uncontrollable worldwide by 1997, and (3) many
HPC applications used in U.S.  national security programs occur at
about 7,000 MTOPS and at or above 10,000 MTOPS.  The study also
concluded that it would be too expensive for government and industry
to effectively control the international diffusion of computing
systems with performance below 7,000 MTOPS, and that attempts to
control computer exports below this level would become increasingly
ineffectual, would harm the credibility of export controls, and would
unreasonably burden a vital sector of the computer industry.  The
study also raised concerns about the ability to control HPC exports
in the future in light of advances in computing technology.\5

The export control policy implemented in January 1996 removed license
requirements for most HPC exports with performance levels up to
2,000 MTOPS--an increase from the previous level of 1,500 MTOPS.  The
policy also organized countries into four "computer tiers," with each
tier after tier 1 representing a successively higher level of concern
to U.S.  security interests.  The policy placed no license
requirements on tier 1 countries, primarily those in Western Europe
and Japan.  Exports of HPCs above 10,000 MTOPS to tier 2 countries in
Asia, Africa, Latin America, and Central and Eastern Europe would
continue to require licenses.  A dual-control system was established
for tier 3 countries, such as Russia and China.  For these countries,
HPCs up to 7,000 MTOPS could be exported to civilian end users
without a license, while exports at and above 2,000 MTOPS to end
users of concern for military or proliferation of weapons of mass
destruction reasons required a license.  Exports of HPCs above 7,000
MTOPS to civilian end users also required a license.  HPC exports to
terrorist countries in tier 4 were essentially prohibited.  (See
appendix II for details on the four-tier system of export controls.)

The January 1996 regulation also made other changes.  It specified
that exporters would be responsible for (1) determining whether an
export license is required, based on the MTOPS level of the computer;
(2) screening end users and end uses for military or proliferation
concerns;\6 and (3) keeping records and reporting on exports of
computers with performance levels of 2,000 MTOPS.  In addition to the
standard record-keeping requirements, the regulation added
requirements for the date of the shipment, the name and address of
the end user and of each intermediate consignee, and the end use of
each exported computer.  The Fiscal Year 1998 National Defense
Authorization Act (P.L.  105-85) modified the policy for determining
whether an individual license is required and now requires exporters
to notify the Commerce Department of any planned sales of computers
with performance levels greater than 2,000 MTOPS to tier 3 countries. 
The government has 10 days to assess and object to a proposed HPC
sale.  The law also now requires Commerce to perform post-shipment
verifications (PSV) on all HPC exports with performance levels over
2,000 MTOPS to tier 3 countries.\7 The Commerce Department
promulgated regulations implementing the law on February 3, 1998. 


--------------------
\2 In this report, revision of export controls refers to removal of
licensing requirements for groups of countries based on the
performance levels of HPCs. 

\3 Building on the Basics:  An Examination of High-Performance
Computing Export Control Policy in the 1990's, Seymour Goodman, Peter
Wolcott, and Grey Burkhart (Center for International Security and
Arms Control, Stanford University, November 1995). 

\4 MTOPS is the composite theoretical performance of a computer
measured in millions of theoretical operations per second.  In
principle, higher MTOPS indicates greater raw performance of a
computer to solve computations quickly, but not the actual
performance of a given machine for a given application. 

\5 In April 1998, authors of the 1995 Stanford study published a
follow-on discussion paper, High-performance Computing, National
Security Applications, and Export Control Policy at the Close of the
20th Century, as a contribution to the periodic review of HPC export
controls.  This paper noted (1) that rapid advances in computer
technology were continuing but (2) that a proposed change in
licensing procedure--to review each HPC at its highest attainable
level, rather than its configuration at time of export--would remove
the concern of HPCs being upgraded without the knowledge of exporters
or the U.S.  government.  We did not evaluate the adequacy of the
analysis and support of the second study. 

\6 End-use screening is the process exporters follow to evaluate
whether a transaction involves an unacceptable risk of use in, or
diversion to, a proliferator or military end user. 

\7 PSVs are on-site visits, generally by U.S.  government officials,
to locations where goods are shipped. 


   RESULTS IN BRIEF
------------------------------------------------------------ Letter :2

The Stanford University study was a key element in the decision to
revise HPC export controls.  However, our analysis of the study
showed that it had two significant limitations.  First, the study
lacked empirical evidence or analysis to support its conclusion that
HPCs were uncontrollable based on (1) worldwide availability and (2)
insufficient resources to control them.  Second, the study did not
assess the capabilities of countries of concern to use HPCs for
military and other national security applications, as required by its
tasking.  The study's principal author said that U.S.  government
data was insufficient to make such an assessment, and the study
recommended that better data be gathered so that such an analysis
could be done in the future.  In addition, the executive branch did
not undertake a threat analysis of providing HPCs to countries of
concern.  Nonetheless, based on its undocumented view of the
worldwide availability of computing power and on the technological
advancements in this area, the executive branch raised the MTOPS
thresholds for HPC export controls and established the four-tier
control structure.  Although the Stanford study had limitations, it
made some observations regarding the potential to upgrade HPCs and
the export control challenge this will present in the future.  For
example, it noted that the technological trend toward upgrading
computer performance without vendor support or knowledge is reducing
the effectiveness of U.S.  export controls. 

The 1996 revision to HPC export controls had three key consequences. 
First, the number of computer export licenses issued declined from
395 in fiscal year 1995 to 42 in 1997.  Second, U.S.  HPC exporters
were charged with responsibilities previously conducted by the
government.  New U.S.  HPC exporters' responsibilities included
screening and reporting on the end use and end user of HPCs.  In
essence, the exporters had to decide whether a license was required
since the decision is made on the basis of the end use, the end user,
and the computer performance capability.  This decision could be
particularly difficult for exports to tier 3 countries, such as
China, where identifying the distinction between a civilian and
military end user can be difficult without information that is
sometimes available only to the U.S.  government.  This situation was
partly reversed by the Fiscal Year 1998 National Defense
Authorization Act, which requires exporters to notify the Commerce
Department of all HPC sales over 2,000 MTOPS to tier 3 countries
prior to their export.  Third, the regulation required HPC
manufacturers to keep records of the end users of all their HPC
exports over 2,000 MTOPS.  To date, information on these exports
reported to the government has been incomplete.  Responsibility for
PSV checks remained with the government.  However, because of how
PSVs for computers are implemented, their value is reduced because
they verify the physical location of an HPC, but not how it is used. 
Also, some governments, such as China, have not allowed the United
States to conduct them. 

With regard to foreign availability of HPCs,\8 we found that
subsidiaries of U.S.  computer manufacturers dominate the overseas
HPC market and they must comply with U.S.  controls.  Three Japanese
companies are global competitors of U.S.  manufacturers, two of which
told us that they had no sales to tier 3 countries.  The third
company did not provide data on such sales in a format that was
usable for our analysis.  Two of the Japanese companies primarily
compete with U.S.  manufacturers for sales of high-end HPCs at about
20,000 MTOPS and above.  Two other manufacturers, one in Germany and
one in the United Kingdom, also compete with U.S.  HPC suppliers, but
primarily within Europe.  Only the German company has sold HPCs to
tier 3 countries.  Japan, Germany, and the United Kingdom each have
export controls on HPCs similar to those of the United States,
according to foreign government officials.  Russia, China, and India
have developed HPCs, but the capabilities of their computers are
believed to be limited.  Thus, our analysis suggests that HPCs over
2,000 MTOPS are not readily available to tier 3 countries from
foreign sources without restrictions. 


--------------------
\8 We used a description of foreign availability in the Export
Administration Act (EAA) of 1979, as amended, as our criteria. 


   KEY STUDY USED AS BASIS FOR
   CHANGING HPC CONTROLS HAD
   LIMITATIONS
------------------------------------------------------------ Letter :3

The Stanford study, used as a key element by the executive branch in
its decision to revise HPC export controls, had significant
limitations.  It lacked empirical evidence or analysis regarding its
conclusion that HPCs were uncontrollable and, although tasked with
doing so, it did not assess the capabilities of countries of concern
to use HPCs for military and other national security applications. 
The study itself identified as a major limitation, its inability to
assess capabilities of countries of concern to use HPCs for their
military programs or national security applications, on the basis
that such information was not available, and recommended that such an
assessment be done.  The study noted that trends in HPC technology
development could affect U.S.  security and the ability to control
HPC exports in the future and need to be further studied.  Despite
the study's limitations, the executive branch decided to relax HPC
export controls. 


      THE STANFORD STUDY LACKED
      EVIDENCE OF HPC
      UNCONTROLLABILITY
---------------------------------------------------------- Letter :3.1

The Stanford study accumulated information from computer companies on
U.S.  HPC market characteristics and concluded--without empirical
evidence or analysis--that computers between 4,000 and 5,000 MTOPS
were already available worldwide and uncontrollable and that
computers at about 7,000 MTOPS would be widely available and
uncontrollable by 1997.\9 Using the findings from the Stanford study,
executive branch officials set the computer performance control
thresholds for each tier.  However, these officials could not explain
nor provide documentation as to how the executive branch arrived at
the decision to set the license requirements for exports of HPCs to
tier 3 countries for military or proliferation end users at 2,000
MTOPS, even though the study concluded that computing power below
4,000 or 5,000 MTOPS was already "uncontrollable."

The study identified the following six factors as affecting
controllability of HPCs:  computer power, ease of upgrading, physical
size, numbers of units manufactured and sold, sources of sales
(direct sales or through resellers), and the cost of entry level
systems.  It described uncontrollability as the relationship between
the difficulty of controlling computers and the willingness of
government and industry to meet the costs of tracking and controlling
them.  The study asserted that as U.S.  HPCs were sold openly for 2
years, their export would become uncontrollable.  Part of the study's
rationale was that, as older HPCs are replaced by newer models 2
years after product introduction, original vendors may no longer have
information on where replaced HPCs are relocated.  The study also
presumed a level of "leakage" of computers to countries of concern
from U.S.  HPC sources and asserted that costs of controlling such
leakage were no longer tolerable.  However, the study did not attempt
to calculate or specify those costs.  In addition, the study
suggested only vague thresholds for these six factors to determine
"uncontrollability." For example, it noted that the threshold at
which it becomes difficult to track numbers of units could vary from
200 to several thousand.  The study did not provide analysis or
empirical evidence to support its assumptions or conclusions. 


--------------------
\9 The Commerce Department stated that Department of Defense (DOD)
information, which showed that a number of significant military
applications are run at performance levels above 7,000 MTOPS, also
supported the Stanford study's conclusion that an HPC control
threshold at this level could be justifiable. 


      NATIONAL SECURITY AND
      PROLIFERATION RISKS OF HPCS
      NOT ASSESSED
---------------------------------------------------------- Letter :3.2

Although the Stanford study was tasked with assessing the
capabilities of countries of concern to use HPCs for military and
other national security applications, it did not do so.  The study
discussed only U.S.  applications of HPCs for military purposes. 
According to the study's principal author, data on other countries'
use of HPCs for military and other national security purposes was
insufficient to make such assessments because the U.S.  government
does not gather such data in a systematic fashion.  The report
recommended that such an analysis be done. 

Despite the study's limitations and recommendations to gather better
data in the future on other countries' use of HPCs for military and
other national security purposes, the executive branch raised the
MTOPS thresholds for HPC export controls and established the
four-tier export control structure.  The former Deputy Assistant
Secretary of Defense for Counterproliferation Policy explained that
because DOD was not tasked to conduct a threat assessment, it did not
do so.  Instead, the executive branch assessed countries on the basis
of six criteria and assigned them to a particular tier.  The six
criteria were (1) evidence of on-going programs of national security
concern, including proliferation of weapons of mass destruction with
associated delivery systems and regional stability and conventional
threats; (2) membership in or adherence to non-proliferation and
export control regimes; (3) an effective export control system,
including enforcement and compliance programs and an associated
assessment of diversion risks; (4) overall relations with the United
States; (5) whether U.N.  sanctions had been imposed; and (6) prior
licensing history. 

Prior to the executive branch's decision to change computer
thresholds, scientists at Department of Energy (DOE) national
laboratories and other U.S.  government officials had accumulated
information to show how countries of concern could use HPCs to
facilitate the design of nuclear weapons and to improve advanced
nuclear weapons in the absence of tests of nuclear explosives. 
However, this information was not used as part of the decisionmaking
process for revising HPC export controls, according to the Commerce
Department.  In December 1997 the House Committee on National
Security directed the DOE and DOD to assess the national security
impacts of exporting HPCs with performance levels between 2,000 and
7,000 MTOPS to tier 3 countries.  In June 1998, 2 and
1/2 years after the executive branch revised HPC export controls, DOE
concluded its study on how countries like China, India, and Pakistan
can use HPCs to improve their nuclear programs. 

According to the DOE study, the impact of HPC acquisition depends on
the complexity of the weapon being developed and, even more
importantly, on the availability of high-quality, relevant test data. 
The study concluded that "the acquisition and application of HPCs to
nuclear weapons development would have the greatest potential impact
on the Chinese nuclear program--particularly in the event of a ban on
all nuclear weapons testing." Also, the study indicated that India
and Pakistan may now be able to make better use of HPCs in the 1,000
to 4,000 MTOPS range for their nuclear weapons programs because of
the testing data they acquired in May 1998 from underground
detonations of nuclear devices.  The potential contribution to the
Russian nuclear program is less significant because of its robust
nuclear testing experience, but HPCs can make a contribution to
Russia's confidence in the reliability of its nuclear stockpile.  An
emerging nuclear state is likely to be able to produce only
rudimentary nuclear weapons of comparatively simple designs, for
which personal computers are adequate.  We were told that DOD's study
of national security impacts had not been completed as of September
1, 1998, in part because the Department had not received requested
information from the Commerce Department until after July 1. 


      ADVANCES IN COMPUTING
      TECHNOLOGY MAY POSE
      LONG-TERM SECURITY
      CHALLENGES
---------------------------------------------------------- Letter :3.3

The Stanford study noted that trends in HPC technology development
may pose security and export control challenges and recommended
further study to determine their implications for national security
and export controls. 

The technology trends of concern include other countries' ability (1)
to upgrade the performance of individual computers and (2) to link
individual computers to achieve higher performance levels.  The
Stanford study team reviewed the computer industry's technological
advances in parallel processing and concluded that such advances as
"scalability" and "clustering" contributed to the uncontrollability
of high performance computing worldwide and are inevitably reducing
the effectiveness of U.S.  export controls.\10 "Scalability" refers
to the capability to increase computer performance levels of a system
by adding processor boards or by acquiring increasingly powerful
microprocessors.  "Clustering" refers to connecting many personal
computers or workstations to achieve higher computing performance in
a network of interconnected systems, working cooperatively and
concurrently on one or several tasks. 

Scalability and clustering offer opportunities to increase computer
power without the need to develop custom-built single processors
traditionally used in HPCs.  Some types of HPCs are designed today to
allow scalability without the need for vendor support or even
knowledge.\11 As a result, some HPCs could be exported below MTOPS
thresholds without an individual license, and, in theory, later
covertly scaled up to levels that exceed the threshold.  We asked
government agencies for information about diversions and violations
of U.S.  HPC export controls, but they provided no evidence that
countries of concern have increased the computing power of U.S. 
exported machines in violation of export restrictions. 

We found no U.S.  government reviews of alternatives to address these
security concerns, although authors of the Stanford study and others
with whom we spoke identified various options that could be assessed. 
These include (1) requiring government review and consideration of
machines at their highest scalable MTOPS performance levels and (2)
requiring that HPCs exported to tier 3 countries be physically
modified to prevent upgrades beyond the allowed levels. 


--------------------
\10 Parallel processing means breaking computational problems into
many separate parts and having a large number of processors tackle
those parts simultaneously.  Greatly increased processing speed is
achieved largely through the sheer number of processors operating
simultaneously, rather than through any exceptional power in each
processor. 

\11 Many HPC designs use commercial, off-the-shelf processors, such
as those found in personal computers or scientific workstations, and
may include hundreds or even thousands of processors. 


   CHANGES IN U.S.  LICENSING AND
   EXPORT ENFORCEMENT SINCE THE
   REVISION
------------------------------------------------------------ Letter :4

The executive branch's January 1996 export control revision (1)
increased thresholds for requiring licenses, which resulted in a
reduction in the numbers of licensed HPCs; (2) shifted some of the
government's end-use screening responsibility from the government to
the computer industry, until this policy was revised in 1998; and (3)
required HPC manufacturers to keep records of the end users of their
HPC exports.  The government continued to have responsibility for
post-shipment verifications for HPCs, which have reduced value as
traditionally conducted. 


      LICENSE APPLICATIONS HAVE
      DECREASED SINCE REVISION
---------------------------------------------------------- Letter :4.1

Since the export controls for computers were revised in 1996, HPC
export license applications have declined from 459 applications in
fiscal year 1995 to 125 applications in fiscal year 1997.  In fiscal
year 1995, the Commerce Department approved 395 license applications
for HPC exports, and denied 1.  In fiscal year 1997, Commerce
approved 42 license applications for HPC exports, and denied 6.  The
remainder of the applications in each year were withdrawn without
action.  Changes in the numbers of both licensed and unlicensed
exports might not be attributed entirely to the change in export
controls.  However, we did note some characteristics of U.S.  HPC
exports since the revision.  For example, while HPC exports increased
to each tier from January 1996 through September 1997, 72 percent of
machines were sold to tier 1 countries.  Also during this period, 77
HPCs were exported to China and 19 were exported to India, all
without individual licenses.  Most U.S.  HPCs exported in this period
(about 85 percent) had performance levels between 2,000 and 5,000
MTOPS.  (See appendix III for details on HPC exports.)


      END-USE SCREENING
      RESPONSIBILITY SHIFTED TO
      COMPUTER INDUSTRY
---------------------------------------------------------- Letter :4.2

The executive branch shifted some government oversight responsibility
to the computer industry, especially for tier 3 countries.  Exporters
became responsible for determining whether exports required a license
by screening end users and end uses for military or proliferation
concerns (end-use screening).\12 However, some industry and
government officials concluded that the computer industry lacked the
necessary information to distinguish between military and civilian
end users in some tier 3 countries--particularly China. 

Because of concerns about U.S.  HPCs being obtained by countries of
proliferation concern for possible use in weapons-related activities,
the Congress enacted a provision in Public Law 105-85 that required
exporters to notify the Commerce Department of all proposed HPC sales
over
2,000 MTOPS to tier 3 countries.  The law gives the government an
opportunity to assess these exports within 10 days to determine the
need for a license and it can use information that may not be
available to the exporter. 


--------------------
\12 To aid exporters in making end user determinations, Commerce
created specific guidance to educate exporters about signs they need
to be aware of that can be of concern to the government.  Companies
also were urged to contact the Commerce Department when in doubt
about an end user's activities.  According to Commerce, the end user
could then be researched by the government and the exporter advised
to seek a license if any strategic concerns were present. 


      U.S.  COMPANIES' RECORDS ON
      RESALES OF HPCS ARE
      INCOMPLETE
---------------------------------------------------------- Letter :4.3

Pursuant to the Export Administration Regulations, exporters are
required to keep accurate records of each licensed and unlicensed
export of a computer over 2,000 MTOPS to any destination.  These
records are to include names and addresses of each end user and each
"intermediate consignee" (resellers or distributors).  Exporters must
also provide quarterly reports to Commerce on license-exempt
exports--almost 96 percent of the total HPC exports in the past 2
years. 

The government relies on the exporters' data for end-use information,
but we found that companies had reported inconsistent and incomplete
data for intermediate consignees (resellers or distributors) as end
users.  For example, one company reported data for only one
intermediate consignee, even though company officials told us that
the company uses multiple resellers.  Company officials noted that
the company sells computers to companies in other countries, which
then sell the computers to other, unknown end users.  A second
company provided "end-use statements" from its resellers, rather than
the actual end users, and identified computers' end use for several
overseas sales as "resale." In contrast, a third company shows its
resellers as resellers, rather than as end users.  Company officials
said that the company contractually requires its resellers to
identify and provide end-use statements from the ultimate end-users. 


      SAFEGUARDS PROCEDURES FOR
      VERIFYING THE END USE OF
      HPCS ARE LIMITED
---------------------------------------------------------- Letter :4.4

The revision of HPC export controls did not reduce the government's
responsibility for certain safeguards procedures, notably conducting
PSVs.  Under current law, Commerce is required to conduct PSVs for
all HPC exports over 2,000 MTOPS to tier 3 countries.  While PSVs are
important for detecting and deterring physical diversions of HPCs,
PSVs, as traditionally conducted, do not verify computer end use. 
Also, some countries do not allow the United States to conduct them. 
China, for example, had not allowed PSVs,\13 but in June 1998, it
reportedly agreed to do so. 

U.S.  government officials agreed that the way PSVs of computers have
been traditionally conducted have reduced their value because such
PSVs establish only the physical presence of an HPC.  However, this
step assures the U.S.  government that the computer has not been
physically diverted.  According to DOE laboratory officials, it is
easy to conceal how a computer is being used.  They believed that the
U.S.  government officials performing the verifications cannot make
such a determination, partly because they have received no
computer-specific training.  Although it is possible to verify how an
HPC is being used through such actions as reviewing internal computer
data, this would be costly and intrusive, and require experts'
sophisticated computer analysis. 

Another limitation of PSVs concerns sovereignty issues.  Host
governments in some countries of greatest concern, notably China,
have precluded or restricted the U.S.  government's ability to
conduct PSVs.  Three European countries that we visited--United
Kingdom, Germany, and France--also do not allow U.S.  government
officials to do PSVs.  However, they perform the checks themselves
and provide the results to the U.S.  government. 

The government makes limited efforts to monitor exporters' and end
users' compliance with explicit conditions attached to export
licenses.  It relies largely on HPC exporters for end use monitoring
and may require them or the end users to safeguard the exports by
limiting access to the computers or inspecting computer logs and
outputs.  The end user may also be required to agree to on-site
inspections, even on short notice, by U.S.  government or exporting
company officials, who would review programs and software used on the
computer, or to remote electronic monitoring of the computer. 
Commerce officials stated that they may have reviewed computer logs
in the past, but do not do so anymore, and said that they have not
conducted any short notice visits, and that they do not do remote
monitoring.  They said that, ultimately, monitoring safeguards plans
is the exporter's responsibility. 


--------------------
\13 In the last 3 calendar years, U.S embassy officials conducted 20
PSVs of digital computers.  In addition, during 1997, Commerce
officials on special teams from headquarters also conducted 19 visits
to HPC locations. 


   CURRENT FOREIGN AVAILABILITY OF
   HPCS
------------------------------------------------------------ Letter :5

As requested, we evaluated the current foreign availability of HPCs. 
Using the EAA's general description of foreign availability as our
criteria, our analysis showed that subsidiaries of U.S.  companies
dominate the overseas sales of HPCs.  These companies primarily
compete against one another with limited competition from foreign
suppliers in Japan and Germany.  We also obtained information on the
capability of certain tier 3 countries to build their own HPCs and
found it to be limited in the capability to produce machines in
comparable quantity, quality, and power as the major HPC-supplier
countries. 

The EAA describes foreign availability as goods or technology
available without restriction to controlled destinations from sources
outside the United States in sufficient quantities and comparable
quality to those produced in the United States so as to render the
controls ineffective in achieving their purposes.  We found that the
only global competitors for general computer technology are three
Japanese companies, two of which compete primarily for sales of
high-end computersï¿½systems sold in small volumes and performing at
advanced levels.  Two of the companies reported no HPC exports to
tier 3 countries, while the third company reported some exports on a
regional, rather than country, basis.  One German company sells HPCs
primarily in Europe and has reported several sales of its HPCs over
2,000 MTOPS to tier 3 countries.  One British company said it is
capable of producing HPCs above 2,000 MTOPS, but company officials
said it has never sold a system outside the European Union. 

A 1995 Commerce Department study of the HPC global market showed that
American dominance had prevailed at that time, as well.  The study
observed that American HPC manufacturers controlled the market
worldwide, followed by Japanese companies.  It also found that
European companies controlled about 30 percent of the European market
and were not competitive outside Europe. 

The other countries that are HPC suppliers to countries outside
Europe also restrict their exports.  The United States and Japan
since 1984 have been parties to a bilateral arrangement, referred to
as the "Supercomputer Regime," to coordinate their export controls on
HPCs.  Also, both Japan\14 and Germany, like the United States, are
signatories to the Wassenaar Arrangement, which has membership
criteria of adherence to non-proliferation regimes and effective
export controls.\15 Each country also has national regulations that
generally appear to afford levels of protection similar to U.S. 
regulations for their own and for U.S.-licensed HPCs.  For example,
both countries place export controls on sales of computers over 2,000
MTOPS to specified destinations, according to German and Japanese
government officials.  However, foreign government officials said
that they do not enforce U.S.  reexport controls on unlicensed U.S. 
HPCs.  In fact, a study of German export controls noted that
regulatory provisions specify that Germany has no special provisions
on reexport of U.S.-origin goods.  According to German government
officials, the exporter is responsible for knowing the reexport
requirements of the HPC's country of origin.  We could not ascertain
whether improper reexports of HPCs occurred from tier 1 countries. 

Because some U.S.  government and HPC industry officials consider
indigenous capability to build HPCs a form of foreign availability,
we examined such capabilities for tier 3 countries.  Available
information indicates that the capabilities of China, India, and
Russia to build their own HPCs still lag well behind that of the
United States, Japan, and European countries.  Although details are
not well-known about HPC developments in each of these tier 3
countries, most officials and studies showed that each country still
produces machines in small quantities and of lower quality and power
compared to U.S., Japanese, and European computers.  For example,

  -- China has produced at least two different types of HPCs, called
     the Galaxy and Dawning series, based on U.S.  technology and
     they are believed to have a performance level of about 2,500
     MTOPS.  Although China has announced its latest Galaxy at 13,000
     MTOPS, U.S.  government officials have no confirmation of this
     report. 

  -- India has produced a series of computers called Param, which are
     based on U.S.  microprocessors and are believed by U.S.  DOE
     officials to be rated at about 2,000 MTOPS.  These officials
     were denied access to test the computer's performance. 

  -- Russia's efforts over the past three decades to develop
     commercially viable HPCs have used both indigenously-developed
     and U.S.  microprocessors, but have suffered from economic
     problems and a lack of customers.  According to one DOE
     official, Russia has never built a computer running better than
     2,000 MTOPS, and various observers believe Russia to be 3 to 10
     years behind the West in developing computers. 


--------------------
\14 We also obtained information from the Japanese government and HPC
vendors.  We identified controls in force, but did not assess their
implementation. 

\15 The 1996 Wassenaar Arrangement of Export Controls for
Conventional Arms and Dual-Use Goods and Technologies is an
arrangement to exchange export information between 33 states with the
purpose of contributing to regional and international security by
enhancing cooperation among export control systems and international
regimes. 


   CONCLUSIONS
------------------------------------------------------------ Letter :6

A key element in the 1996 decision to revise HPC export controls was
the findings of the Stanford study which did not have adequate
analyses of critical issues.  In particular, the study used to
justify the decision did not assemble empirical data or analysis to
support the conclusion that HPCs below specific performance levels
were uncontrollable and widely available worldwide.  Moreover, the
study did not analyze the capabilities of countries of concern to use
HPCs to further their military programs or engage in nuclear
proliferation, but rather recommended that such data be gathered and
such analysis be made.  Despite the limitations of the study, the
executive branch revised the HPC export controls.  Since the
executive branch's stated goals for the revised HPC export controls
included tailoring control levels to security and proliferation risks
of specific destinations, it becomes a vital factor to determine how
and at what performance levels specific countries would use HPCs for
military and other national security applications and how such uses
would threaten U.S.  national security interests in specific areas. 
In addition, the Stanford study identified trends in HPC technology
development which may pose security and export control challenges for
national security and export controls.  Some alternatives to address
these security challenges have been identified by authors of the
Stanford study and others with whom we spoke, and could be assessed. 


   RECOMMENDATIONS
------------------------------------------------------------ Letter :7

To complement the studies undertaken by DOD and DOE for the House
Committee on National Security, we recommend that the Secretary of
Defense assess and report on the national security threat and
proliferation impact of U.S.  exports of HPCs to countries of
national security and proliferation concern.  This assessment, at a
minimum, should address (1) how and at what performance levels
countries of concern use HPCs for military modernization and
proliferation activities; (2) the threat of such uses to U.S. 
national security interests; and (3) the extent to which such HPCs
are controllable. 

We also recommend that the Secretary of Commerce, with the support of
the Secretaries of Defense, Energy, and State, and the Director of
the U.S.  Arms Control and Disarmament Agency, jointly evaluate and
report on options to safeguard U.S.  national security interests
regarding HPCs.  Such options should include, but not be limited to,
(1) requiring government review and control of the export of
computers at their highest scalable MTOPS performance levels and (2)
requiring that HPCs destined for tier 3 countries be physically
modified to prevent upgrades beyond the allowed levels. 


   AGENCY COMMENTS AND OUR
   EVALUATION
------------------------------------------------------------ Letter :8

Commerce and DOD each provided one set of general written comments on
a draft of this and a companion report\16 and the Departments of
State and Energy and the Arms Control and Disarmament Agency provided
oral comments.  Commerce, Defense, and State raised issues about
various matters discussed in the report.  The Department of Energy
had no comments on the report but said it deferred to Commerce and
Defense to comment on the Stanford study.  The Arms Control and
Disarmament Agency agreed with the substance of the report. 
Commerce, State, Energy, and the Arms Control and Disarmament Agency
did not comment on our recommendations, but Defense did.  Defense
said that our recommendation concerning the assessment of national
security threats and proliferation impact of U.S.  exports to
countries of concern was done in connection with the 1995 decision to
revise HPC export controls, and that it would consider additional
options to safeguard exports of HPCs as part of its ongoing review of
export controls.  As noted below, we believe the question of how
countries of concern could use HPCs to further their military and
nuclear programs was not addressed as part of the executive branch's
1995 decision. 

Commerce commented that the President's decision was intended to
change the computer export policy from what it referred to as "a
relic of the Cold War to one more in tune with today's technology and
international security environment." Commerce said the decision was
based on (1) rapid technological changes in the computer industry,
(2) wide availability, (3) limited controllability, and (4) limited
national security applications for HPCs.  Commerce provided
additional views about each of these factors.  Commerce commented
that our report focused on how countries might use HPCs for
proliferation or military purposes and on what it called an outdated
Cold War concept of "foreign availability," rather than these
factors. 

Our report specifically addresses the four factors Commerce said it
considered in 1995.  These four factors are considered in the
Stanford University study upon which the executive branch heavily
relied in making its decision to revise HPC export controls.  Our
report agreed with the study's treatment of technological changes in
the computing industry and that advances in computing technology may
pose long-term security and controllability challenges. 

Commerce commented that our analysis of foreign availability as an
element of the controllability of HPCs was too narrow, stating that
foreign availability is not an adequate measure of the problem. 
Commerce stated that this "Cold War concept" makes little sense
today, given the permeability and increased globalization of markets. 
We agree that rapid technological advancements in the computer
industry have made the controllability of HPC exports a more
difficult problem; however, we disagree that foreign availability is
an outdated Cold War concept that has no relevance in today's
environment.  While threats to U.S.  security may have changed, they
have not been eliminated.  Commerce itself recognized this in its
March 1998 annual report to the Congress which stated that "the key
to effective export controls is setting control levels above foreign
availability." Moreover, the concept of foreign availability, as
opposed to Commerce's notion of "worldwide" availability, is still
described in EAA and the Export Administration Regulations as a
factor to be considered in export control policy. 

Commerce also commented that the need to control the export of HPCs
because of their importance for national security applications is
limited.  It stated that many national security applications can be
performed satisfactorily on uncontrollable low-level technology, and
that computers are not a "choke point" for military production. 
Commerce said that having access to HPCs alone will not improve a
country's military-industrial capabilities.  Commerce asserted that
the 1995 decision was based on research leading to the conclusion
that computing power is a secondary consideration for many
applications of national security concern.  We asked Commerce for its
research evidence, but none was forthcoming.  The only evidence that
Commerce cited was contained in the Stanford study. 

Moreover, Commerce's position on this matter is not consistent with
that of DOD.  DOD, in its Militarily Critical Technologies List,\17
has determined that high performance computing is an enabling
technology for modern tactical and strategic warfare and is also
important in the development, deployment, and use of weapons of mass
destruction.  High performance computing has also played a major role
in the ability of the United States to maintain and increase the
technological superiority of its war-fighting support systems.  DOD
has noted in its High Performance Computing Modernization Program\18
annual plan that the use of HPC technology has led to lower costs for
system deployment and improved the effectiveness of complex weapons
systems.  DOD further stated that as it transitions its weapons
system design and test process to rely more heavily on modeling and
simulation, the nation can expect many more examples of the profound
effects that the HPC capability has on both military and civilian
applications.  Furthermore, we note that the concept of "choke point"
is not a standard established in U.S.  law or regulation for
reviewing dual-use exports to sensitive end users for proliferation
reasons. 

In its comments, DOD said that the Stanford study was just one of
many sources of information and analysis used in the 1996 executive
branch decision.  We reviewed all of the four sources of information
identified to us by DOD, DOE, State, Commerce, and Arms Control and
Disarmament Agency (ACDA) officials as contributing to their
assessment of computer export controls.  However, the Stanford study
was a key analytical study used in the decision-making process and
the only source whose findings were consistently and repeatedly cited
by the executive branch in official announcements, briefings,
congressional testimony, and discussions with us in support of the
HPC export control revision. 

In its comments, DOD stated that our report inaccurately
characterized DOD as not considering the threats associated with HPC
exports.  DOD said that in 1995 it "considered" the security risks
associated with the export of HPCs to countries of national security
and proliferation concern.  What our report actually states is that
(1) the Stanford study did not assess the capabilities of countries
of concern to use HPCs for military and other national security
applications, as required by its tasking and (2) the executive branch
did not undertake a threat analysis of providing HPCs to countries of
concern.  DOD provided no new documentation to demonstrate how it
"considered" these risks.  As the principal author of the Stanford
study and DOD officials stated during our review, no threat
assessment or assessment of the national security impact of allowing
HPCs to go to particular countries of concern and of what military
advantages such countries could achieve had been done in 1995.  In
fact, the April 1998 Stanford study on HPC export controls by the
same principal author also noted that identifying which countries
could use HPCs to pursue which military applications remained a
critical issue on which the executive branch provided little
information. 

In its comments, the Department of State disagreed with our
presenting combined data on HPC exports to China and Hong Kong in
appendix III because the U.S.-Hong Kong Policy Act of 1992 calls for
the U.S.  government to treat Hong Kong as a separate territory
regarding economic and trade matters.  While, in principle, we do not
disagree with State, it should be noted that we reported in May 1997
that given the decision to continue current U.S.  policy toward Hong
Kong, monitoring various indicators of Hong Kong's continued autonomy
in export controls becomes critical to assessing the risk to U.S. 
nonproliferation interests.\19 Our presentation of the combined HPC
export data for China and Hong Kong is intended to help illustrate a
potential risk to U.S.  nonproliferation interests regarding HPCs
should Hong Kong's continued autonomy in export controls be weakened. 
We believe that monitoring data on HPC exports to Hong Kong becomes
all the more important since Hong Kong is treated as a tier 2
country, whereas China is a tier 3 country. 

Commerce also provided technical comments which we have incorporated
as appropriate.  Commerce and DOD written comments are reprinted in
appendixes IV and V, respectively, along with our evaluation of them. 

ACDA provided oral comments on this report and generally agreed with
it.  However, it disagreed with the statement that "according to the
Commerce Department, the key to effective export controls is setting
control levels above the level of foreign availability of materials
of concern." ACDA stressed that this is Commerce's position only and
not the view of the entire executive branch.  ACDA said that in its
view (1) it is difficult to determine the foreign availability of
HPCs and (2) the United States helps create foreign availability
through the transfer of computers and computer parts. 

Our scope and methodology are in appendix I.  Appendix II contains
details on the four-tier system of export controls and appendix III
shows characteristics of HPC exports since the revision. 

We conducted our review between August 1997 and June 1998 in
accordance with generally accepted government auditing standards. 


--------------------
\16 Export Controls:  National Security Issues and Foreign
Availability for High Performance Computer Exports (GAO/NSIAD-98-200,
September 1998)

\17 The Militarily Critical Technologies List, required by EAA, is a
compendium of the technologies DOD assesses as critical to
maintaining superior U.S.  military capabilities.  According to DOD,
it should be used as a reference for evaluating potential technology
transfers and to determine if the proposed transaction would permit
potential adversaries access to technologies with specific
performance levels at or above the characteristics identified as
militarily critical. 

\18 The High Performance Computing Modernization Program is the major
force designed to improve DOD's ability to exploit the computation
necessary to sustain technological superiority on the battlefield. 
Managed by the Director, Defense Research and Engineering, the
program is intended to establish a nationwide integrated
infrastructure to support the defense research, development, test,
and evaluation communities. 

\19 Hong Kong's Reversion To China:  Effective Monitoring Critical to
Assess U.S.  Nonproliferation Risks (GAO/NSIAD-97-149, May 1997). 


---------------------------------------------------------- Letter :8.1

We will provide copies of this report to other congressional
committees; the Secretaries of Commerce, Defense, Energy, and State;
the Director, U.S.  Arms Control and Disarmament Agency; and the
Director, Office of Management and Budget.  Copies will be provided
to others upon request. 

Please contact me on (202) 512-4128 if you or your staff have any
questions concerning this report.  Major contributors to this report
are listed in appendix IV. 

Sincerely yours,

Harold J.  Johnson, Associate Director
International Relations and Trade Issues


SCOPE AND METHODOLOGY
=========================================================== Appendix I

To assess the basis for the U.S.  government's 1996 decision to
change HPC controls, we reviewed a 1995 Stanford University study on
high performance computing and export control policy commissioned by
the Commerce and Defense Departments and evaluated the executive
branch's assessment of national security risks of HPCs.  We reviewed
several classified charts and briefing slides prepared by the
intelligence community and DOD that were identified as important
support for the revision of controls.  We also talked with the
Stanford study's principal authors to discuss their methodology,
evidence, conclusions, and recommendations.  In addition, we met with
the Department of Defense (DOD), the Department of Energy (DOE),
State and Commerce Department officials to discuss the interagency
process used leading up to the decision to revise controls on HPCs. 
We also requested, but were denied access to, information from the
National Security Council on data and analyses that were used in the
interagency forum to reach the final decision to revise controls. 

To determine how the government assessed the national security risks
of allowing the high performance computers (HPC) to be provided to
countries of proliferation and military concern as part of the basis
for the decision to revise the controls, we reviewed DOD and DOE
documents on how HPCs are being used for nuclear and military
applications.  We discussed high performance computing for both U.S. 
and foreign nuclear weapons programs with DOE officials in
Washington, D.C., and at the Lawrence Livermore, Los Alamos, and
Sandia National Laboratories.  We also met with officials of the DOD
HPC Modernization Office and other officials within the Under
Secretary of Defense Acquisition and Technology, Office of the
Secretary of Defense, the Joint Chiefs of Staff, and the intelligence
community to discuss how HPCs are being utilized for weapons design,
testing and evaluation and other military applications.  Furthermore,
to understand the trends occurring in computer technology, we
analyzed HPC model descriptions and technical means for increasing
computing performance. 

To identify changes in licensing activities and the implementation of
certain U.S.  licensing and export enforcement requirements since the
revision: 

  -- We reviewed two sets of data from the Commerce Department, as
     noted above, in order to determine trends in American HPC
     exports since the 1996 revision of controls.  We examined all
     U.S.  high performance computer-related license applications
     worldwide.  We analyzed the data for trends and changes in MTOPS
     levels of HPC exports before and after revision of controls,
     numbers of licenses approved, denied, and withdrawn without
     action, and HPC exports by countries and country tiers.  We did
     not review the data for completeness, accuracy, and consistency. 

  -- We reviewed the end user and end-use screening systems of major
     American HPC manufacturers, Commerce Department implementation
     of the revised regulations, and selected foreign government
     export controls in order to determine licensing changes
     affecting U.S.  HPC exporters since the revision of controls. 
     We also reviewed applicable U.S.  laws and regulations governing
     HPC export licensing and enforcement and discussed these laws
     and regulations with Commerce Department officials.  We obtained
     Commerce Department procedures on end use and end user
     determinations as well as records on HPC vendor inquiries to
     Commerce on end users.  In addition, we reviewed information on
     intelligence community assessments of foreign end users
     receiving HPC exports.  We also discussed end user and end use
     screening procedures with officials from major U.S.  HPC
     manufacturers--Digital Equipment Corporation, Hewlett
     Packard/Convex, International Business Machines, and Sun
     Microsystems--at their corporate offices in the United States
     and sales offices overseas.  We also visited representatives of
     these companies' foreign subsidiary offices from China, Germany,
     Russia, Singapore, South Korea, and the United Kingdom to review
     end use screening procedures and documentation for selected
     exports.  In addition, we visited selected HPC sites in China
     and Russia.  However, the Chinese government refused us
     permission to visit one of three requested sites in Beijing. 
     The Russian government, while not denying us permission to visit
     one site in-country, required an extended period of notification
     that went beyond our timeframes.  Silicon Graphics, Inc./Cray
     refused to meet with us pending the outcome of an ongoing
     criminal investigation. 

  -- We reviewed Commerce Department data on pre-license and
     post-shipment verification (PSV) checks on HPCs and related
     technology and safeguards security plans associated with HPC
     export licenses in order to examine affects of licensing changes
     on government oversight.  We discussed the implementation and
     utility of these checks with officials of the U.S.  government,
     American computer companies, and host governments in the
     countries we visited. 

To determine foreign availability of HPCs, we reviewed the Export
Administration Act (EAA) and Export Administration Regulations for
criteria and a description of the meaning of the term.  We then
reviewed market research data from an independent computer research
organization.  We also reviewed lists, brochures, and marketing
information from major U.S.  and foreign HPC manufacturers in France
(Bull, SA), Germany (Siemens Nixdorf Informationssysteme AG and
Parsytec Computer GmbH), and the United Kingdom (Quadrics
Supercomputers World, Limited) and met with them to discuss their
existing and projected product lines.  We also obtained market data,
as available, from three Japanese HPC manufacturers.  Furthermore, we
met with government officials in China, France, Germany, Singapore,
South Korea, and the United Kingdom to discuss each country's
indigenous capability to produce HPCs.  We also obtained information
from the Japanese government on its export control policies.  In
addition, we obtained and analyzed from two Commerce Department
databases (1) worldwide export licensing application data for fiscal
years 1994-97 and (2) export data from computer exporters provided to
the Department for all American HPC exports between January 1996 and
October 1997.  We also reviewed a 1995 Commerce Department study on
the worldwide computer market to identify foreign competition in the
HPC market prior to the export control revision.\1 To identify
similarities and differences between U.S.  and foreign government HPC
export controls, we discussed with officials of the U.S.  embassies
and host governments information on foreign government export
controls for HPCs and the extent of cooperation between U.S.  and
host government authorities on investigations of export control
violations and any HPC diversions of HPCs to sensitive end users.  We
also reviewed foreign government regulations, where available, and
both foreign government and independent reports on each country's
export control system. 


--------------------
\1 Part III, Global Supercomputer Industry and Market Assessment,
June 2, 1995, Department of Commerce, Bureau of Export
Administration, Office of Strategic Industries and Economic Security,
Economic Analysis Division


CURRENT EXPORT LICENSING
REQUIREMENTS FOR HIGH PERFORMANCE
COMPUTERS
========================================================== Appendix II

Table II.1 and the description that follows summarize the terms of
the revised export controls for HPCs and according to their MTOPS
levels and destinations. 



                                    Table II.1
                     
                      Current Export Licensing Requirements
                         for High Performance Computers\a

MTOPS           Tier 1          Tier 2          Tier 3          Tier 4
--------------  --------------  --------------  --------------  ----------------
20,000 and up   No license      License and     License         License required
                required under  additional      required
                license         safeguards may                  Presumption of
                exception\b     be required                     denial

                                                                Various
                                                                terrorist and
                                                                boycott
                                                                restrictions
                                                                apply

10,000 to                       License
20,000                          required

up to 10, 000                   No license
                                required under
                                license
                                exception

2,000 to 7,000                                  License
                                                required for
                                                military or
                                                proliferation
                                                end users or
                                                end use

                                                No license
                                                required for
                                                civilian end
                                                user under
                                                license
                                                exception

                                                Ten-day review
                                                period for
                                                government
                                                review

Up to 2,000                                     No license      License required
                                                required under  to Sudan & Syria
                                                license         at or over 6
                                                exception       MTOPS
                                                                and for any
                                                                MTOPS to rest of
                                                                tier
--------------------------------------------------------------------------------
\a For each tier, exporters must maintain and provide records to the
Commerce Department and reexport and retransfer restrictions apply. 

\b A license exception for HPCs is a regulatory authorization that
allows exporters to export or reexport, based on MTOPS levels and
destination, computers that otherwise would require a license. 


   THE REVISED CONTROLS
-------------------------------------------------------- Appendix II:1

The revised controls announced by the President divide into four
country groups, as follows: 

  -- Tier 1 (28 countries:  Western Europe, Japan, Canada, Mexico,
     Australia, New Zealand).  No prior government review (license
     exception) for all computers, but companies must keep records on
     higher performance shipments that will be provided to the U.S. 
     government, as directed. 

  -- Tier 2 (106 countries:  Latin America, South Korea, Association
     of Southeast Asian Nations or ASEAN, Hungary, Poland, Czech
     Republic, Slovak Republic, Slovenia, South Africa).  No prior
     government review (license exception) up to 10,000 MTOPS with
     record-keeping and reporting, as directed; individual license
     (requiring prior government review) above 10,000 MTOPS.  Above
     20,000 MTOPS, the government may require certain safeguards at
     the end-user location. 

  -- Tier 3 (50 countries:  India, Pakistan, all Middle East/Maghreb,
     the former Soviet Union, China, Vietnam, rest of Eastern
     Europe).  No prior government review (license exception) up to
     2,000 MTOPS.  Individual license for military and
     proliferation-related end uses and end users and license
     exception for civil end users between 2,000 MTOPS and 7,000
     MTOPS, with exporter record-keeping and reporting, as directed. 
     Individual license for all end users above 7,000 MTOPS.  Above
     10,000 MTOPS, additional safeguards may be required at the
     end-user location. 

  -- Tier 4 (7 countries:  Iraq, Iran, Libya, North Korea, Cuba,
     Sudan, and Syria).  Current policies continue to apply (i.e.,
     virtual embargo on computer exports). 

For all these groups, reexport and retransfer provisions continue to
apply.  The government continues to implement the Enhanced
Proliferation Control Initiative, which provides authority for the
government to block exports of computers of any level in cases
involving exports to end uses or end users of proliferation concern
or risks of diversion to proliferation activities.  Criminal as well
as civil penalties apply to violators of the Initiative. 


U.S.  HIGH PERFORMANCE COMPUTER
EXPORTS SINCE THE 1996 EXPORT
CONTROL REVISION
========================================================= Appendix III

HPC exports have increased significantly since the 1996 export
control revision.  Figure III.1 shows the numbers of U.S.  HPCs
exported to all tiers from fiscal year 1994 through fiscal year 1997. 
In fiscal year 1996, U.S.  computer vendors exported almost twice as
many HPCs as they had in fiscal years 1994 and 1995 together.  In
fiscal year 1997, U.S.  exports of HPCs more than quadrupled the
fiscal year 1996 level.  Figure III.1 also shows that growth in
export volume was strong for tier 1 countries.  Although tier 2
growth remained ahead of tier 1 for the whole period, the greatest
volume of U.S.  exports has been with the tier 1 countries. 
Table III.1 shows the largest importers of U.S.  HPCs.  U.S.  allies
and friends remained the largest market for U.S.  HPC exports, but
tier 2 countries were the fastest growing market.  Figure III.2
summarizes the share of U.S.  HPC exports that each tier took in this
period.  Figure III.3 shows the top five customers for U.S.  HPCs and
the portion of the exports they received.  Finally figure III.4 shows
that most HPCs exported in the past 2 years were rated between 2,000
and 3,000 MTOPS. 

   Figure III.1:  Numbers of U.S. 
   High Performance Computers
   Exported to All Tiers, Fiscal
   Years 1994 through 1997

   (See figure in printed
   edition.)

Note:  This shows the number of items licensed for export rated at
above 1,500 MTOPS for fiscal years 1994 and 1995, as well as the
number of items at or above 2,000 MTOPS for fiscal years 1996 and
1997 reported as exported.  The regulations changed in January 1996,
so that first quarter fiscal year 1996 data includes HPCs at above
1,500 MTOPS and the second quarter includes 18 machines rated at
between 1,500 and 2,000 MTOPS licensed for export in January 1996. 

Since the January 1996 revision, 68 countries worldwide, out of 193
in the tier system, purchased 3,967 U.S.  HPCs,\2 as of September
1997.  These machines represent a total HPC computing power, as
calculated in MTOPS, of over 15 million MTOPS.  Twenty-six countries
lead the world as the dominant customers for U.S.  HPCs.  These
countries purchased 91 percent of all HPCs sold worldwide.  Together
they purchased over 14 million MTOPS, representing 93 percent of the
HPC computing power exported from the U.S.  in the period.  Table
III.1 ranks the countries by the quantities of MTOPS they purchased. 
It also shows the number of HPCs they purchased.  The countries that
purchased the most machines also purchased relatively more powerful
machines as rated by MTOPS.  (See table III.1.)



                              Table III.1
                
                 Largest importers of U.S. HPCs, Fiscal
                Years 1996 -1997, ranked by Total MTOPS
                                Exported

                                                            Total
                                                            MTOPS
                                                Total    Exported
                             FY96    FY97    Machines          to
                           Machin  Machin   for FY96-     Country  Tie
Country                        es      es          97     FY96-97    r
-------------------------  ------  ------  ----------  ----------  ---
Germany                       111     488         599   2,600,949    1
United Kingdom                 87     489         576   2,359,761    1
Japan                          74     233         307   1,667,745    1
South Korea                    62     269         331   1,128,945    2
France                         29     229         258   1,070,385    1
Italy                          16     142         158     601,979    1
Switzerland                    23     147         170     500,327    1
Spain                          10     123         133     484,862    1
Sweden                         20      77          97     441,541    1
Australia                      32      88         120     398,198    1
Netherlands                    10      95         105     321,352    1
Belgium                        12      88         100     288,194    1
Hong Kong                       9      73          82     259,072    2
China                          23      54          77     239,037    3
Brazil                          2      68          70     214,350    2
Israel                          7      41          48     200,177    3
Mexico                         12      45          57     199,133    1
Malaysia                       23      53          76     194,805    2
Singapore                       5      60          65     189,729    2
South Africa                    8      28          36     132,675    2
Thailand                        2      35          37     110,536    2
Austria                         6      25          31     108,449    1
Norway                          1      15          16     107,388    1
Indonesia                       0      27          27      91,561    2
Russia                          7      21          28      84,961    3
Finland                         1      23          24      81,571    1
======================================================================
Total                         588   3,040       3,628  14,077,682
----------------------------------------------------------------------
As table III.1 shows, tier 1 countries, mainly U.S.  friends and
allies, were by far the largest market for U.S.  HPCs.  Figure III.2
summarizes the share of U.S.  HPC exports that each tier received in
the past 2 years. 

   Figure III.2:  Quantity and
   Percent of U.S.  HPC Exports to
   Each Tier, January 1996 -
   September 1997

   (See figure in printed
   edition.)

Source:  Department of Commerce and GAO Analysis. 

Since the export controls were revised, HPCs have been sold to more
countries, but 26 countries account for 91 percent of all U.S.  HPCs
sold worldwide.  Not only have the Tier 1 countries dominated as U.S. 
HPC customers, five U.S.  allies were the largest customers for U.S. 
HPCs:  Germany, the United Kingdom, Japan, South Korea, and France. 
As
figure III.3 shows, these five countries together received over 52
percent of the machines exported.  These countries also bought the
most powerful machines, purchasing 58.36 percent of the MTOPS
exported in HPCs. 

   Figure III.3:  Quantity and
   Percent of Total Machines
   Purchased by Five Largest
   Customers for U.S.  HPCs, from
   January 1996 - September 1997

   (See figure in printed
   edition.)

Source:  U.S.  Department of Commerce and GAO Analysis. 

The large majority of U.S.  HPCs exported since the revision and the
largest number of most powerful computers were sent to tier 1 and 2
countries.  For example, 50, 5, and 1 HPCs with computing power
greater than
13,000 MTOPS went to tiers 1, 2, and 3, respectively.  Of the 50
countries in tier 3, five--China, Israel, Russia, India, and Saudi
Arabia--account for about 84 percent of the computers exported to
tier 3.  Table III.2 shows the numbers of computers each country has
received. 



                              Table III.2
                
                Numbers of Machines Exported To Top Five
                    Tier 3 Recipients, January 1996-
                            September 1997\a

                                                                Percen
                                                                     t
                                                          Tota      of
Country                                       1996  1997     l   total
--------------------------------------------  ----  ----  ----  ------
China                                           23    54    77    35.0
Israel                                           7    41    48    21.8
Russia                                           7    21    28    12.7
India                                            6    13    19     8.6
Saudi Arabia                                     2    11    13     5.9
Other Tier 3                                     4    31    35    15.9
======================================================================
Total                                           49   171   220     100
----------------------------------------------------------------------
\a HPCs to China and India were exported with no individual licenses. 
Russia and Saudi Arabia received 1 licensed HPC each, while Israel
received 18 licensed machines. 

China, which ranks first in the number of HPCs received by a tier 3
country, would have received even higher numbers of HPCs if its HPC
totals were combined with those of its Hong Kong Special
Administrative Region.  Hong Kong and China rank 13th and 14th,
respectively, on the HPC purchasers' list.  (See table III.1) If Hong
Kong and China were treated as one for purposes of U.S.  export
controls and statistics\3 , the combined region would have purchased
more machines than Italy, which ranked seventh in U.S.  machines
exported, and almost as many machines as Switzerland, which ranked
sixth. 

The largest numbers of U.S.  HPCs exported were less powerful HPCs. 
HPCs at the 2,000 to 3,000 MTOPS level made up the bulk of machines
exported, about 58 percent of all HPC exports.  HPCs at the 2,000 to
7,000 MTOPS level constitute the large majority of U.S.  HPC exports,
about 92 percent of all U.S.  HPC exports, or 3,638 machines
exported.  The remaining 8 percent of HPC exports, 329 machines, were
above 7,000 MTOPS.  Figure III.4 shows these relationships.  (See
fig.  III.4.)

   Figure III.4:  Quantity and
   Percentage of U.S.  HPC Exports
   by MTOPS Levels, January
   1996-September 1997

   (See figure in printed
   edition.)

Source:  U.S.  Department of Commerce and GAO analysis. 



(See figure in printed edition.)Appendix IV

--------------------
\2 Depending on a personal computer's configuration, a PC with an
Intel Pentium II 350 megahertz chip is rated at 408.33 MTOPS.  Each
of the 3,967 HPC machines is rated at least 2,000 MTOPS.  The 3,967
HPCs shipped from the United States are equivalent to about 37,000
Pentium II computers in terms of MTOPs. 

\3 In our report Hong Kong's Reversion To China:  Effective
Monitoring Critical to Assess U.S.  Nonproliferation Risks
(GAO/NSIAD-97-149, May 1997), we emphasized the need to monitor the
continuation of Hong Kong's separate and autonomous export controls. 
U.S.  officials agreed that monitoring Hong Kong's autonomy in the
conduct of export controls is necessary, given the potential risks
involved and the U.S.  policy commitment to ensure that exports of
sensitive technology to Hong Kong are protected. 


COMMENTS FROM THE DEPARTMENT OF
COMMERCE
========================================================= Appendix III



(See figure in printed edition.)



(See figure in printed edition.)



(See figure in printed edition.)

Now on p.  3. 

Now on p.  4. 

Now on p.  4. 

Now on p.  4. 



(See figure in printed edition.)

Now on p.  10.

Now on p.  5. 



(See figure in printed edition.)

Now on p.  6. 



(See figure in printed edition.)


The following are GAO's comments on the Department of Commerce letter
dated August 7, 1998.  Commerce provided one set of written comments
for this report.  We addressed Commerce's general comments relevant
to this report on page 15 and its specific comments below. 

GAO COMMENTS

1.  We have made the suggested changes, as appropriate. 

2.  Commerce also commented that a number of foreign manufacturers
indigenously produce HPCs that compete with those of the United
States.  Evidence cited by Commerce concerning particular countries
with HPC manufacturing capabilities came from studies that were
conducted in 1995 and that did not address or use criteria related to
"foreign availability." As stated in our report, we gathered data
from multiple government and computer industry sources to find
companies in other countries that met the terms of foreign
availability.  We met with major U.S.  HPC companies in the United
States, as well as with their overseas subsidiaries in a number of
countries we visited in 1998, to discuss foreign HPC manufacturers
that the U.S.  companies considered as providing foreign availability
and competition.  We found few.  Throughout Europe and Asia, U.S. 
computer subsidiary officials stated that their competition is
primarily other U.S.  computer subsidiaries and, to a lesser extent,
Japanese companies.  Our information does not support Commerce's
position on all of these manufacturers.  For example, our visit to
government and commercial sources in Singapore indicated that the
country does not now have the capabilities to produce HPCs.  We asked
Commerce to provide data to support its assertion on foreign
manufacturers, but we received no documentary support.  In addition,
although requested, Commerce did not provide documentary evidence to
confirm its asserted capabilities of India's HPCs and uses. 

3.  Commerce stated that policy makers did not receive DOE
information prior to the revision of the HPC controls in 1995 and,
further, there is current disagreement within DOE over the
contribution that HPCs make to nuclear programs in countries of
concern.  We agree that Commerce did not obtain available information
on this issue from DOE laboratories, although such information was
available and provided to us upon request.  In addition, we found no
dissent or qualification of views identified in DOE's official study
on this matter. 

4.  Commerce stated that worldwide availability of computers
indicates that there is a large installed base of systems in the tens
of thousands or even millions.  Commerce further stated that license
requirements will not prevent diversion of HPCs unless realistic
control levels are set that can be enforced effectively.  While we
agree, in principle, that increasing numbers of HPCs makes
controllability more difficult, a realistic assessment of when an
item is "uncontrollable" would require an analysis of (1) actual
data, (2) estimated costs of enforcing controls, and (3) pros and
cons of alternatives--such as revised regulatory procedures--that
might be considered to extend controls.  Such an analysis was not
done by the executive branch before its 1995 decision.  In addition,
Commerce provided no documentary evidence for its statement that
there is a large installed base of HPCs in the millions. 

5.  Commerce stated that most European governments do not enforce
U.S.  export control restrictions on reexport of U.S.-supplied HPCs. 
We agree that at least those European governments that we visited
(Germany and United Kingdom) hold this position.  However, although
requested, Commerce provided no evidence to support its statement
that the government of the United Kingdom has instructed its
exporters to ignore U.S.  reexport controls. 




(See figure in printed edition.)Appendix V
COMMENTS FROM THE DEPARTMENT OF
DEFENSE
========================================================= Appendix III



(See figure in printed edition.)


The following are GAO's comments on the Department of Defense letter
dated July 16, 1998.  DOD provided one set of written comments for
this report.  We addressed DOD's general comments relevant to this
report on page 17.  We address DOD's specific comments below. 

GAO COMMENTS

1.  DOD stated that the Stanford study was only one of many inputs
considered by the executive branch in its 1995 assessment of computer
export controls.  We agree, and our report states, that there were
other inputs to the decision.  However, officials at Commerce, DOD,
State, DOE, and ACDA referred us to the Stanford study in explaining
the basis for the executive branch decision to revise the controls. 
Moreover, in announcing the 1996 HPC export control changes, the
executive branch highlighted two conclusions of its review:  (1)
U.S.-manufactured computer technology up to 7,000 MTOPS would become
widely available worldwide by 1997 and (2) many HPC applications used
in U.S.  national security programs occur at or above 10,000 MTOPS. 
Both conclusions were based on information provided only in the
Stanford study.  Also, DOD provided briefing slides on the HPC export
control revision to the House Committee on National Security dated
October 17, 1995, using information drawn almost exclusively from the
Stanford study.  Finally, a March 1998 Commerce Department report on
foreign policy export controls noted only one source--a new Stanford
study--as part of a 1998 review of HPC export controls. 

2.  DOD stated that it identified numerous national security
applications used by the United States that require various levels of
computing power, which helped to establish the revised licensing
policies.  We agree, and our report discusses the fact that DOD
identified how the U.S.  government uses HPCs for national security
applications.  However, this misses the point because these
applications did not refer to particular countries of concern.  As we
noted in our report, the principal author of the Stanford study and
DOD officials said that they had not performed a threat assessment or
analysis of other countries' use of HPCs for military and other
national security purposes.  The current DOD analysis of how
countries of concern can use HPCs is being done at the request of the
House National Security Committee and might provide the information
needed to perform our recommended assessment. 

3.  We disagree that the executive branch fulfilled the intent of our
recommendations.  Specifically, it did not have information on how
and at what performance levels countries of concern, such as China,
India, and Pakistan, use HPCs for military modernization and
nonnuclear proliferation activities.  Regarding the degree of
controllability of computers, neither the Stanford study nor any of
the other inputs used in the 1995 computer export control review
provided any empirical evidence or analysis to support assertions
that HPCs with certain performance levels are widely available and
uncontrollable.  In fact, the 1998 Stanford study recommends
procedural export licensing changes that would make such HPCs
controllable again. 


MAJOR CONTRIBUTORS TO THIS REPORT
========================================================== Appendix VI

NATIONAL SECURITY AND
INTERNATIONAL AFFAIRS DIVISION,
WASHINGTON D.C. 

Eugene Beye
Jason Fong
Christian Hougen
Jeffrey D.  Phillips
Minette Richardson
James Shafer
Pierre Toureille
David Trimble

OFFICE OF THE GENERAL COUNSEL,
WASHINGTON, D.C. 

Richard Seldin

ACCOUNTING AND INFORMATION
MANAGEMENT DIVISION, WASHINGTON,
D.C. 

Hai Tran


*** End of document. ***