The Export Control Cascade—Part 1: A Problem of Unintended Consequences
The approach to export controls on semiconductor technology is one of the most complex topics that governmental officials face today. In an era of great power competition between the United States and China, there is a sense of urgency to take action to ensure that America can maintain its longstanding global technological leadership position. Unfortunately, the urgency to take action has manifested itself in the reflexive use of Cold War-era policies intent on restricting the flow of advanced technology to geopolitical rivals, despite the fact that these policies produce real and harmful effects on American companies and their ability to innovate while the intended outcomes of these approaches are difficult to measure and seemingly impossible to quantify.
Because of this complexity, the implementation of new controls tends to create unintended consequences that spark a harmful cycle of future legislative action. Congress’s instinct is to stack new bills on top of these emerging problems, rather than examining, amending, or repealing prior regulatory schemes. This creates a cascade of legislative fixes targeted at closing the gaps created by prior bills. This pattern is clearly evident in the semiconductor space, as the Biden administration’s export control regime for advanced semiconductors spawned four distinct problems that current legislative efforts are looking to address. Chips are being smuggled to China, Chinese firms are renting cloud computing assets, allied countries’ semiconductor equipment manufacturing firms sell to China, and the executive branch is unilaterally adjusting policy without Congress.
Each of these issues has a bill attached that purports to solve the problem. The Chip Security Act (CSA) would mandate the development and deployment of a global tracking system for advanced semiconductors; the Remote Access Security Act would extend export controls to cloud computing; the MATCH Act would coerce allies into complying with U.S. export regimes; and the AI OVERWATCH Act would enforce congressional oversight over export licensing.
Three of these bills, the CSA, the MATCH Act, and the AI OVERWATCH Act, passed the House Foreign Affairs Committee along with other export control measures with bipartisan support, and now find themselves in the manager’s amendment to the National Defense Authorization Act (NDAA). This amount of tailwind was achieved without sufficient deliberation, which is concerning, because this tranche of bills is seeking to fill voids related to the unforeseen complexities caused by prior attempts at export control. Putting these bills in the must-pass NDAA all but ensures that none of these bills will ever receive the level of scrutiny that is required of complex policy solutions.
The following series of posts will focus on one of these bills, the Chip Security Act. The Biden-era export regime revealed a real weakness of export controls on advanced semiconductors: chip smuggling. Entities in countries not covered by the export control restrictions are purchasing chips as an intermediary and sending them to countries whose imports are blocked. This was seen earlier this year with the Supermicro incident. While framed as a unique scenario to semiconductors, smuggling to circumvent bans is a time-tested technique seen during America’s prohibition era, oil sanctions on Russia after its invasion of Ukraine, and the drug trade, where interdiction has not addressed the incentive to smuggle.
To tackle this particular unintended consequence of chip export controls, policymakers have turned to technology through the CSA, which would mandate location tracking of covered semiconductor devices. This bill is deliberately non-prescriptive on how to achieve verification of a chip’s physical location, yet requires a mechanism to do so. While this is a preferable approach to policymaking in most situations, it is usually more effective when companies can implement a known solution with flexibility rather than receiving a mandate to invent one.
In September of 2026, Georgetown University’s CSET published a study that evaluated several approaches for chip tracking and their feasibility. This feasibility study provides evidence that chip tracking is possible; however, it does nothing to address the question of the merit of tracking chips in the first place.
The Engineering Analysis
CSET’s paper provides an exceptionally thorough and rigorous technical and cost-benefit analysis on the prospect of chip tracking, systematically evaluating seven location verification methods: physical inspections, mail-in inspections, video inspections, inventory management, GPS-based geolocation, topology-based geolocation, and ping-based location verification (PLV). These methods were examined according to four distinct criteria: verifiability, accuracy, security, and repeatability.
After rejecting five methods as infeasible, the paper establishes physical inspections and PLV as the two viable approaches to chip tracking. The majority of the paper focuses on PLV, mainly due to its cost and technological novelty, and evaluates two separate implementation models: one where the U.S. government or a private entity owns the infrastructure required to locate chips, and one where the infrastructure is rented. These approaches are estimated to cost the government between $3.1 million and $28.8 million and $2.6 million and $72.4 million per year, respectively.
The paper is also careful to list the limitations of PLV implementation. First, enabling PLV on chips already in circulation would be very difficult for software and firmware implementations, and impossible for hardware-based implementations. Second, PLV only works when chips are constantly online. Third, adversaries, especially those with control over their nation’s network infrastructure, can obfuscate the location. Fourth, PLV is imprecise and could only achieve location precision within approximately a 116-mile radius. Finally, there is an identity gap between where the chip is located and where the end user is located.
Because of these limitations, CSET only suggests PLV with caution, noting that “the utility of a PLV system is limited by the [Bureau of Industry and Security’s] BIS capacity to pursue those leads.” CSET’s work is not the first study into PLV system implementation considerations. It builds upon prior work from the Institute for AI Policy and Strategy, which drew similar conclusions about PLV feasibility.
The Authority Effect
Because of its quality, rigor, and refusal to wholeheartedly recommend either for or against implementing a PLV system, none of the contents of the CSET paper itself contribute to the problem of advancing the Chip Security Act; however, the paper’s existence still gives credence to the Chip Security Act as an approach to counter chip smuggling.
Five of the seven chip tracking methods are eliminated from evaluation early in the document. As such, the bulk of the 101-page document is systems engineering analysis of PLV focused on trilateration mathematics, spherical cap geometry, TEE firmware architecture, and landmark server optimization. This technical analysis is being served to a policymaking audience, and as a result, the executive summary becomes the product Congress will actually read. The actual depth of the paper, despite likely being skimmed or ignored, still signals credibility to policymakers. The fact that the paper doesn’t fully recommend PLV becomes almost irrelevant, as it lays out the feasibility of implementing a global system to achieve it.
The authority effect from the CSET paper is being amplified by work from geolocation vendors like GeoComply, who would be the likely candidate to build and operate the global PLV system that the Chip Security Act would mandate. While feasibility studies are conducted to establish that policies are indeed actionable, they can inadvertently advance policy proposals regardless of the authors’ intent. It is critically important to remember to ask the question “should it be done?” after the answer to “can it be done?” is yes.
This conflation of what question is being answered is further complicated by the CSA being part of the NDAA. As a part of an enormous, must-pass bill, it is highly unlikely that the CSA will receive the standalone floor debate that it merits, and feasibility studies from research institutions like CSET and IAPS, as well as papers from vendors with a financial interest like GeoComply, will become de facto policy analysis in support of the measure.
The CSA is part of a bundle of measures seeking to address the unintended consequences of using a blunt policy instrument in a complex and nuanced space. The CSET report has identified five real limitations to PLV that are likely to create additional challenges if the approach is implemented. There is an opportunity to address these foreseen consequences up front before another cascade of legislation is required to address the issues that will emerge from the CSA, but this is all but impossible with the NDAA as the legislative vehicle.
What Remains Unexamined in the Chip Debate
While CSET’s assessments on the limitations of implementing PLV for chip tracking are accurate, they are engineering limitations and are not comprehensive from a policy analysis perspective. This means the policy and economic trade-offs are missed. This series intends to highlight four more categories that need serious evaluation and exploration from a policy perspective.
The next piece in the series will outline the cybersecurity argument. PLV mandates would inadvertently create a permanent, unpatchable attack surface by design. In addition to the chip level, the global PLV system’s communications channels, firmware, and centralized reporting infrastructure would create numerous possibilities for exploits that the CSET paper acknowledges in its endnotes, but not its conclusions. Unfortunately, the paper’s cost-benefit analysis quantifies the benefits of detection without acknowledging the potential costs of compromise.
Next will come the policy escalation analysis. While the CSA’s proponents have stated that the legislation prohibits backdoors and kill switches, the paper’s five limitations generate that as a logical policy response. As enforcement of location becomes the binding constraint as a result of the Chip Security Act, following legislative cascades are likely to converge on remote disablement— especially since this trajectory is already visible within current congressional action.
After that will come the global competitiveness argument. The Trump administration is simultaneously pushing to export the American AI stack while Congress is seeking to mandate surveillance mechanisms on American chips. This will become a distinct problem when potential buyers from sovereign nations are evaluating their options for AI adoption. This was shown during the global 5G rollout, where many nations sought readily available alternatives with fewer strings attached.
Finally, this series will address the institutional argument. BIS capacity is the binding constraint that CSET specifically mentions, and PLV implementation will create a compliance ecosystem of auditors, server operators, and geolocation vendors. This will generate institutional momentum around solving the tracking problem, but will do nothing when it comes to enforcement. It appears that little consideration has been given to the value of the conventional investigative measures that routinely catch smugglers in the face of a theoretical yet feasible technological solution.
Each of these potential unintended consequences has the ability to trigger the next round of legislative fixes and continue the cascade of blunt policies that generated the CSA in the first place.