Congressional Testimony | National Security Challenges: Outpacing China in Emerging Technology

Introduction

Chairman Brown, Ranking Member Scott, and Members of the Committee, thank you for the opportunity to testify before you today.

I lead a research and analysis team at the German Marshall Fund’s Alliance for Securing Democracy, studying how democracies can together outcompete autocrats—chiefly the People’s Republic of China (PRC)—in emerging technologies.  I am also a venture scientist with Deep Science Ventures. I come at this question from the perspective of a technologist with academic training in quantum physics and artificial intelligence and first-hand experience researching the technologies we now recognize as critical to US national competitiveness. I recently had the privilege of serving at the White House, where I crafted technology and national security competitiveness strategy across the US government. I also developed initiatives to implement that strategy, including through the US-EU Trade and Technology Council (TTC) and Quad Critical and Emerging Technology Working Group. Both during my time at the German Marshall Fund and in government, I have had the opportunity and privilege of engaging extensively with officials, policy, and technology communities across the Atlantic on PRC technology matters from 5G and digital infrastructure to AI and international standards setting. Finally, I spent the first part of my career working with start-up companies and venture capital, including founding a firm looking at emerging technologies.  The views I express in this testimony and before you are my own and should not be taken as representing those of my current or former employers.

Toward a New Mode of Techno-Economic Statecraft

The United States has spent decades investing in, inventing, and re-inventing new modes of warfare—from the Goldwater-Nichols Act to the first, second, and third offset strategies. And today, inspired in part by rapid capability-fielding in Ukraine, we are undergoing a transformation to enable the Pentagon to draw more effectively on private sector innovation for rapid capability deployment. Each of these offset strategies was aimed at a particular objective and a shift in adversary capability, largely in and around the role of nuclear weapons. Today, the United States’ strongest autocratic rival is using tactics in economic, technological, and societal realms that a defense-first national security apparatus was not designed to counter. In the PRC, we face a competitor who wields its own economic power to coerce nations, businesses, and individuals to achieve its technology and national security objectives. This multi-sectoral competition has strained the post-Cold War view of international relations in which more economic engagement implied greater political—even democratic—proximity. The cost of doing business in the PRC is often the hollowing out of technology advantages and intellectual property (IP), described as the greatest transfer of wealth in human history. The CCP also is clear-eyed about competition with the United States. According to PRC President Xi Jinping, “the United States is the biggest threat to China’s development and security.”

So how does the United States best compete with an autocratic rival when that competition is playing out chiefly in non-traditional spheres of battle: technology, economy, and society, in addition to military capability build-ups? Much in the way the Cold War led to a society-wide reworking of our institutions towards great power competition, so too now do we need a rethink of our tools. A key element of this effort is building out a doctrine, toolkit, and alliances for techno-economic statecraft.

We are not starting from whole cloth. Some of these tools already exist, but many were designed for a different era, when the chief concern was preventing the development of Weapons of Mass Destruction (WMD). The remit was far simpler: ensure that technology items with a ‘dual-use’ capability—i.e., those that could be used for both military and civilian applications—were used for the latter and not the former. Moreover, these dual applications often had clear signatures and relatively long timescales on which a civilian capability could transition to a WMD use. Nuclear energy vs. nuclear weapons is the canonical example, where uranium enriched above a certain threshold becomes weapons-grade and thus a proliferation concern.

These modes are outdated and unfit for our modern challenges for three reasons. First, straightforward distinctions and thresholds between military and civilian applications of emerging technologies in many cases do not exist. Emerging technologies like artificial intelligence, quantum information systems, advanced computing, and biotechnology are inherently dual-use. The same quantum computer that could revolutionize chemistry calculations and scientific discovery could break the encryption that secures our communications with submarines. The same synthetic biology and genomic engineering processes that could engineer novel cancer therapies could engineer pandemic pathogens. And the same computing capacity that fuels Large Language Models can fuel drone swarms or societal surveillance. AI is often described as falling into a class of technologies that economists refer to as ‘general-purpose technologies’ —akin to electricity, the steam engine, or the internal combustion engine. There are no thresholds to set when determining what constitutes a dual use of an internal combustion engine.  

Second, the PRC has pursued an explicit strategy of military-civil fusion (MCF) that further blurs the lines of these domains and makes it difficult to have confidence that any civilian use will stay a civilian use. By sharing talent and resources, the PRC hopes that economic and military modernization can develop side-by-side and in ways that are mutually reinforcing. According to the US Department of Defense:

The PRC’s MCF development strategy encompasses six interrelated efforts: (1) fusing the PRC’s defense industrial base and its civilian technology and industrial base; (2) integrating and leveraging science and technology innovations across military and civilian sectors; (3) cultivating talent and blending military and civilian expertise and knowledge; (4) building military requirements into civilian infrastructure and leveraging civilian construction for military purposes; (5) leveraging civilian service and logistics capabilities for military purposes; and, (6) expanding and deepening the PRC’s national defense mobilization system to include all relevant aspects of its society and economy for use in competition and war. [emphasis added]

And third, not all the national security risks associated with PRC emerging technology acquisition and dominance fall into the military domain. Human rights abuses, the promotion of autocratic values and standards baked into emerging technologies, and strategic economic and technological dependence of critical supply chains fall outside the scope of structures aimed at the traditional conception of dual use.

Today, a growing list of ‘defensive technology measures’ for techno-economic statecraft include:

• Export controls
• Sanctions
• Supply Chain Due Diligence
• Investment Screening
  • Inbound investment
  • Outbound investment
• Anti-dumping measures
• Research security
• Prosecution of IP theft
• Tariffs on high-tech industries

A new doctrine for techno-economic statecraft must survey and leverage US and allied advantages (and realistically assess willingness to fuse these ecosystems), deepen capabilities, and define short-, medium-, and long-term objectives for technology competition. It must be supported by a robust analytical and intelligence apparatus and resourced appropriately. And it must blend proactive (‘promote’) tools with defensive (‘protect’) technology measures. On the latter, outpacing the PRC no longer simply means outrunning the PRC but also impeding its capabilities in select game-changer and ‘force-multiplier’ technologies. National Security Advisor Jake Sullivan’s stated goal in the context of foundational semiconductors “to maintain as large of a lead as possible” will require the United States and its allies to control capabilities, not only technologies.

Emerging Technologies’ Inputs: Considerations for Control

Critical to a strategy for techno-economic statecraft is the selection of objectives in critical technology areas that drive considerations for how their transfer may be controlled. I discuss several such considerations in the cases of AI, biotechnology, and quantum information technologies. All three can be thought of in terms of their data, software, and ‘hardware’ (or ‘bio-ware’) inputs. Hardware is the most straightforward to control, but new advances may render that focus insufficient.

Artificial Intelligence: Inputs to AI include data to train models on, algorithms to build those models and perform the training, and computing power to process this development. Pioneering controls on the PRC’s AI capabilities issued on October 7, 2022 focused on hardware—exploiting a chokepoint to stifle the flow of ultra high-end semiconductor technology, specialized manufacturing tools, and manufacturing capacity to the PRC. With complex controls including end user applications of the Entity List and Foreign Direct Product Rule, end use controls, PRC-wide controls, and restrictions on US persons, they demonstrate a holistic approach to controlling capabilities. Netherlands and Japan enacted similar controls, though Germany, whose Zeiss and Trumpf laser and optoelectronics firms supply the Dutch ASML for lithography equipment, has not. Moreover, PRC developers are already finding workarounds, and smuggling networks risk blunting the controls’ effects. One glaring loophole is the ability to access equivalent processing power using cloud computing infrastructure. With the advent of frontier models, whether to restrict their application in specific end uses including military and human rights abuses will need to be considered as well. Indeed, the most fraught elements of the Treasury Department’s Advanced Notice of Proposed Rulemaking on outbound investment included the breadth of AI and the ability to circumvent military end-uses dependent on exclusive or primary use.

Biotechnology: Inputs to biotechnology advances include: genetic material (DNA, RNA, genomes); data (such as genetic data); bioinformatics tools and advanced computing (such as software and algorithms for analyzing biological data); specialized biological components (molecules and materials harvested organically or synthetically produced); and specialized equipment (such as DNA sequencers or bioreactors). However, the PRC’s biomanufacturing ecosystem is highly developed, leading to strategic dependencies for the United States in advanced pharmaceutical ingredients and making prospects for technology controls difficult.

The story of Beijing’s genetic data rise is also one of failed defensive technology measures ill-adapted to a new reality. The PRC is amassing global bio data, taking advantage of partnerships with BGI, Huawei, and firms like WuXi App Tech, which has been associated with the popular genetics company 23andMe. Concerning pieces of the PRC’s biotechnology industry can be tied directly to US partnerships. In 2012, PRC biotech giant BGI received CFIUS clearance to acquire California-based Complete Genomics. Today, multiple BGI affiliates, including BGI Research and BGI Tech Solutions, have been placed on the US Entity List for their collection and analysis of genetic data that risks contributing to PRC surveillance and monitoring, as well as the risk of diversion to military programs. However, BGI maintains a network of over 200 global subsidiaries, most of whom are not on the Entity List, allowing it access to genomic data from around the globe. As innovators globally incorporate AI into biotechnology, these concerns will grow. Despite being flagged by CFIUS over a decade ago, the rise of BGI demonstrates a complete failure of imagination to envision the drivers of national power—a mistake the United States cannot afford to repeat and must attempt to better forecast.

Quantum Computing and Information Technologies: In quantum information, the PRC has led in large-scale applications of quantum communications. These technologies aim to encrypt information using quantum key distribution (QKD) that may be theoretically more tamper-proof. In 2016, the PRC launched the world’s first quantum satellite (Micius) —enabled in part by German and EU funding. It continues to test technologies through its Quantum Experimentation at Space Scale (QUESS) quantum-enabled communications satellite, including sending quantum keys for use in quantum cryptography between Austrian and PRC ground stations. Quantum communications is also an increasing area of Sino-Russian collaboration, as the no-limits partnership blossoms in the technology and information arena. In December 2023, PRC and Russian scientists demonstrated the encrypted communication using quantum key distribution of images between ground stations in Urumqi, Xinjiang and outside Moscow, by way of the PRC’s quantum satellite.

However, the real competition in quantum computing is the race to a universal fault-tolerant quantum computer, which carries the ability to break the classical encryption services that modern secure systems from our intelligence apparatus to our nuclear deterrent rely on. There is a case, therefore, to be made for taking steps to put the United States in a significant leadership position towards this goal. Concerns over military applications in counter-stealth and counter-submarine technologies as well as the potential to break classical encryption drove Entity List additions of PRC quantum technology entities including QuantumCTek. And some post-quantum cryptography algorithms are subject to BIS export licenses. Proposed outbound investment controls would prohibit covered investments into quantum computers and components (such as cooling systems), quantum sensors, quantum networking and communication systems, as well as low-temperature semiconductors operating under 4.5 Kelvin used for quantum chips. Here, technology forecasting and tracking will be essential to defensive measures, as preferred approaches are still evolving with scientific research.

Building and Resourcing the Defensive Technology Measures Toolkit

Just as we have spent decades resourcing the US military for strategic advantage, so too we must resource the tools of techno-economic statecraft. At the heart of this effort is the Commerce Department and specifically its Bureau of Industry and Security, charged with implementing and enforcing export controls on critical and emerging technologies and helping to secure the nation’s supply chains.

Here, I offer three categories of recommendations:

1. Significantly expand US and allied analytical capacity. In order to make informed decisions on which levers of the techno-economic toolkit to pull, the United States needs a significant analytical capability that can forecast technology areas and needs, analyze the effects of techno-economic measures, assess US leadership potential and the PRC’s indigenization prospects in critical technology areas, and wargame techno-economic actions and responses. As Daleep Singh told this Committee, economic wargames should model the extensive wargaming the Pentagon conducts for military affairs.

• Establish a National Technology Competitiveness Analysis Center (NTCAC) modelled after National Counterterrorism Center or National Counterintelligence Center to conduct red-blue team analyses on critical and emerging technology ecosystems. This center should draw on expertise across the federal government —such as in the national labs and Defense Department—in addition to industry analysis. It should also include input from the intelligence community on areas of PRC IP theft, the state of technology transfer, and identification and tracking of chokepoints. This center could be housed at the US Department of Commerce and report to the Secretary’s Office with a dotted line reporting structure to the ODNI. It should include a wargaming cell dedicated to conducting red-blue team exercises in the techno-economic sphere.

2. Increase funding for personnel, but also technology tools. BIS’s overall budget has not kept paced with its growing responsibilities. In the Commerce Department’s FY 2023 budget request, BIS identified more than $53 million in unfunded requirements. These included ICTS supply chain security, additional Special Agents and Enforcement analysts to keep pace with the rise cases related to the PRC and Russia, industry survey studies, the use of data to assess the effectiveness of licensing systems, and expanding a partnership with Canada on securing supply chains. In FY2024, that number was $14 million, including elements of developing a modern Data Science and Impact Analysis Capability. The FY 2024 budget requests a $31 million increase in BIS budget from FY 2023. Congress should at minimum fully fund this request, $16.866 million of which accounts for inflationary adjustments, and increase BIS’s FY 2024 budget to fund its $14 million in unfunded priorities. Moreover, US techno-economic competition should be resourced with cutting-edge tools, including leveraging technologies like AI and data science to track smuggling networks that help evade controls, and keep pace with the proliferation of subsidiaries and shell companies that regularly spin up from companies on the Entity List. Automatic systems could flag new entities that may be owned in whole or in part by listed entities. Knowledge graphs or link-analysis tools could modernize BIS’s ability to trace smuggling networks, track shell companies, and fuse data from Chinese-language technology and financial sources to discern whether and how controls were being violated. The US Army, for example, uses such software to manage a 3 TB database to forecast logistical needs for replacement parts, calculate mean time for failure rates, perform multi-dimensional cost comparisons, and inform budget requirements—slashing needed employee hours by 88%. MITRE’s Cygraph analyzes large loads of isolated data  and optimizes pattern recognition to find and stop cyber-attacks.  Tools like expanded versions of the Australian Strategic Policy Institute’s China Defence Universities Tracker can help analysts discover and prevent export controls evasion by elucidating the complex linkages among PRC actors with military-industrial ties. The datasets relevant to export enforcement are likely harder to come by, but no less critical. Finally, controlled hardware parts could embed geolocation tagging so that export enforcement analysts could track their movement globally. To address concerns around data security and influence stemming from autocratic ICTS platforms, Congress should:

• Pass legislation on a risk-based framework for assessing ICTS platforms operating in the United States and lead by example on autocratic apps. Develop an international coalition a comprehensive, risk-based framework for autocratic internet apps—democratic allies and partners to develop a comprehensive framework for addressing the threats posed by authoritarian internet apps and critical information infrastructure. TikTok and Huawei are not one-offs. We cannot treat them as such. As we head into the 2024 election season with more Americans than ever getting their news from a platform whose parent company answers to the CCP, there is true urgency.
• Pass Federal Data Privacy and Data Security Legislation. We cannot solve technology espionage through data privacy alone, but we can close loopholes and punish excess abuses.

3. Build capacity among US allies and partners on novel techno-economic statecraft tools and approaches. As business groups from the Semiconductor Industry Association to the National Foreign Trade Council have exhorted, unilateral controls harm US businesses relative to allied foreign competitors, as these competitors simply backfill the void created by US exits in the context of remaining market demand. The extent and timescale over which this backfilling is possible depends on the degree to which US industry corners the market, but unilateral controls do risk the United States shooting itself in the foot, especially if such controls end up being insufficient to meaningfully limit PRC capabilities at issue due to allied backfilling. For these reasons, multilateral action is a necessity. The challenge is that democratic nations are experimenting with new tools, new authorities, new uses, and new modes of statecraft themselves, at the same time as there is a need to implement these measures jointly. On export controls and outbound investment screening, FIRRMA’s expansion of CFIUS for inbound investment screening provides a strong model for international cooperation. FIRRMA included three provisions to aid US allies and partners in strengthening their own investment screening mechanisms:

• A formal process for information transfer to allow for shared understanding of national security rationales for investment screening among US allies and partners.
• Outreach and technical support. Treasury conducted international outreach and offered technical support and capacity-building for countries interested in constructing investment review mechanisms.
• Incentives to strengthen screening mechanisms. At the same time, FIRRMA’s implementing regulations created a category of “excepted foreign states, whose covered investments into the United States could be subject to less rigorous review, provided these states had developed robust enough investment screening mechanisms in their own right.”

While incomplete, this process has been a resounding success. In 2019, the European Commission announced guidelines to encourage member states to stand-up formal investment review procedures. As of October 2023, 21 EU member states had screening mechanisms (up from 11 in 2017), and several others are in the process of adopting an investment review regime.

This international technical assistance capacity should be expanded in the context of outbound investment screening and replicated at the Commerce Department in the context of export controls.

Complementary to this effort, the United States should:

1. Build out joint competitive analytic capacity with key allies and partners. The Quad Critical and Emerging Technology effort on Horizon Scanning is a first step, but this effort needs deeper resourcing, a more permanent commitment, and the eventual involvement of Five Eyes partners. The US-EU TTC’s work on investment security can be a natural jumping off point for this cooperation in the transatlantic context, where the United States should seek to build capacity and shared understanding at the European Commission, even as many measures will be implemented at the Member State level.
2. Invest in the US-EU Trade and Technology Council and Quad for semi-permanence. Congress should build a line-item into the State and Foreign Operations budget to support the TTC over a five-to-10-year timescale. Connective tissue is important, and bureaucratic mechanisms take time and effort to stand up and to build trust. Congress can help insulate this mechanism from changing political winds in the United States, while providing the means for its strategic evolution and adaptation over time.
3. Guided de-risking: Adopt a framework with key allies and partners to measure the PRC’s technological control in a given country or region. My team at GMF has developed a proof of concept of this analysis on the PRC’s Digital Technology Stack. Building a true allied understanding of the PRC’s penetration in global technology ecosystems is the first step towards robust allied competitiveness and a common operating picture of the threat. Such analysis can also guide G7 and multilateral development efforts.
4. Coordinate targeted outbound investment screening with allies and partners, including information sharing mechanisms. While discussions on outbound investment screening are further ahead in the United States, aligning approaches and critical technology sectors with Europe can help drive allied competitiveness.At a minimum, screening tools should include restrictions on private investment to entities on the Entity List and Treasury’s NS-CMIC. The United States must ensure coordination amongst these lists and use sector-specific outbound investment screening to close loopholes in export controls aimed at exploiting chokepoints.
5. Develop a new multilateral export control regime for critical and emerging technologies that includes a strong consideration of human rights abuses.Existing Cold War-era regimes such as the Wassenaar Arrangement are inadequate to address the explosion of dual-use technology across all segments of society as well as their democracy and human rights implications. Many allied export control regimes lack or are just developing the capacity to implement end-user controls. Few are structured to account for human rights abuses, yet multilateralizing US defensive policies is essential to their success.

US allies and partners have an extremely strong hand to play if they act thoughtfully, decisively, and multilaterally in building out the doctrine and tools of techno-economic statecraft. I look forward to your questions.