Decoding the Past: Why Cyber Export Regulations Fail Amid Encryption, Spyware, and Mythos

On Friday, the White House ordered Anthropic to halt the export of its AI models, Fable and Mythos, due to unspecified national security issues. This measure limits access to both models for foreign entities and non-citizens within the U.S. As a result, the company quickly removed both models, rendering them inaccessible for the past week.

This incident marks a significant test of the U.S. government’s ability to impose export controls on cutting-edge AI technologies, reminiscent of previous attempts to regulate encryption and spyware, albeit with mixed success. The resolution of this issue may influence Anthropic’s international market opportunities and set precedents that other AI organizations will need to consider.

For context, Anthropic introduced Mythos back in April, portraying it as a potentially dangerous cyber tool that could disrupt the internet if not managed properly. Prior to the export ban, only a select group of about 150 companies and government organizations had access to the model, aimed at enhancing cybersecurity measures before malicious actors could exploit similar capabilities.

The trigger for the ban involved two main incidents. The first was Anthropic granting access to Mythos to a South Korean telecom company identified by U.S. officials as possibly having links to China. Meanwhile, Amazon’s CEO Andy Jassy reportedly notified the administration about a potential vulnerability in Fable 5 discovered by Amazon’s researchers. This vulnerability was disputed by Anthropic, which labeled the issue as minor and already resolved.

In response, the Commerce Department swiftly enacted export control measures, forcing Anthropic to restrict product access soon after being informed.

This scenario isn’t unprecedented; governments have long attempted to control the spread of technologies deemed hazardous. Historically, these efforts have yielded mixed results. Notably, during the early 1990s, the U.S. faced significant challenges with the encryption software PGP, which was viewed as a security threat that could hinder intelligence operations. The ensuing conflict saw the software’s creator, Phil Zimmermann, publish the source code as a book, sparking the “Crypto Wars.”

Zimmermann ultimately prevailed, leading to the development of essential encryption protocols widely used today, such as those by Signal and WhatsApp.

Fast forward to the early 2010s, when Western-made spyware was discovered being used against activists in the Middle East. In response, several nations came together to enhance the Wassenaar Arrangement, a treaty attempting to regulate the export of dual-use technologies applicable to both civilian and military purposes.

This initiative aimed to categorize surveillance software as dual-use, requiring its manufacturers to obtain export licenses. However, Wassenaar has its limitations, notably with non-compliance from certain nations like Israel, which hosts prominent spyware developers.

There have been notable failures in enforcing these controls. For instance, the Italian government permitted a well-known spyware manufacturer, Hacking Team, to export its tools despite its history of supplying oppressive governments. Similar leniencies have been observed among other European nations as well, raising concerns about the effectiveness of regulations against spyware exports to authoritarian regimes.

Despite the challenges, there have been some positive outcomes. For example, in 2022, the German spyware company FinFisher was shut down following a lengthy investigation for unlawfully selling spyware to Turkey, which had been used against political dissenters.

As it stands, the conflict between Anthropic and the U.S. government continues. There is a possibility that the administration will reconsider its restrictions to remain competitive in the global AI landscape, acknowledging that advancements in AI capabilities are likely to occur elsewhere, regardless of U.S. actions. Conversely, American AI firms might be required to obtain governmental approval before engaging with foreign clients, adding a compliance burden that could negatively impact their profitability.

Given past experiences with software regulation, it seems unlikely that government-enforced export controls will be an effective strategy to prevent misuse of advanced dual-use cyber technologies.