If my reading is correct, the proposed rule changes by the Bureau of Industry and Security (BIS) in the Department of Commerce that were posted in the March 28 Federal Register contain changes that appear to be designed to prevent many foreigners in the US, specifically including foreign students, from having access to more than very basic computing power. I have written a quick analysis.
Which countries are involved?
There are four tiers of countries with respect to export controls. Tier 1 includes Canada, Mexico and most U.S. allies, and has virtually no restrictions. Tier 2 includes most of South America, Poland, much of Asia, Hungary, the Czech Republic, Slovenia, South Africa and South Korea. This is restricted, but the restrictions are so loose that you have to be working on a specialized multi-million dollar cluster to be affected.
People from countries in Tier 3 and Tier 4 are the ones that are going to be most affected. Tier 3 states include Russia, China, India, Pakistan, Israel, Vietnam and most Middle East, Maghreb, former-Soviet Union and non-NATO Central European states. Computing power available to Tier 3 countries is restricted to 190,000 MTOPS (Million Theoretical Operations per Second, a measure of the government-defined Composite Theoretical Performance, or CTP). Tier 4 countries include Cuba, Iran, Iraq, Libya, Sudan and Syria, and export of any computing power whatsoever is forbidden. As I understand it, if you ship an X-Box to Libya, you go to jail. Under the proposed rules, allow an Iraqi in the US to play an X-Box, you go to jail.
Update: the list of which countries are in which tiers is at http://www.bxa.doc.gov/HPCs/ctpchart.htm.
Who is affected?
The changes in wording in this area are slight, but very significant. Most notably, citizenship or permanent residency in a Tier 1 country will no longer matter if the birth country was in a lower tier:
Current BIS deemed export license requirements are based on a foreign national's most recent citizenship or permanent residency. The OIG expressed concern that this policy allows foreign nationals originally from countries of concern to obtain access to controlled dual-use technology without scrutiny if they maintain current citizenship or permanent resident status in a country to which the export of the technology would not require a license. For example, transfer of technology to an Iranian who has established permanent residency or citizenship in Canada would be treated, for export licensing purposes under the existing guidelines, as a deemed export to a Canadian foreign national. This policy is described in the deemed export guidance provided on the BIS Web site at: http://www.bis.doc.gov/DeemedExports/DeemedExportsFAQs.html.The OIG recommended that BIS amend its policy to require U.S. organizations to apply for a deemed export license for employees or visitors who are foreign nationals and have access to dual-use controlled technology if they were born in a country where the technology transfer in question would require an export license, regardless of their most recent citizenship or permanent residency.
Also, restrictions on "use" currently define use as:
Operation, installation (including on-site installation), maintenance (checking), repair, overhaul, and refurbishing.
Basically, a foreign national would have to own, administer, and maintain the machine personally for it to apply. That is being changed to:
"Use". (All categories and General Technology Note)--Means all aspects of "use," such as: operation, installation (including on-site installation) maintenance (checking), repair, overhaul, or refurbishing.
This catches anyone who does any work at all on a machine, hardware or software, even if you don't even have a login of your own. If you allow someone from a Tier 4 country to check e-mail from your cluster-accessible account, this makes you guilty. If you allow that same person even without an account to replace a fan or a hard drive on a machine in a cluster, this makes you guilty.
The previous wording about academic research also implied that it was okay to allow someone from a lower-tier country to work with larger amounts of computing power if they were involved with pure research, though that appears to have been unintentional:
Question D(1), which falls under the "research, correspondence, and informal scientific exchanges" category, discusses whether a license would be required for a foreign graduate student to "work" in a laboratory. The answer provided in the supplement states, "not if the research on which the foreign student is working qualifies as `fundamental research' * * *" However, because allowing scientists, engineers, or students to work in a laboratory may necessitate their "use" of equipment, the OIG stated that this answer may lead a potential license applicant to assume that "use" of equipment is covered under the fundamental research exemption.
This is being clarified to show that being involved in academic research does not grant an exception:
In its comments on the OIG report, BIS agreed that the answer to question D(1) requires clarification. BIS proposes to revise the answer for D(1) to qualify the statement that no license is required, by stating that, whereas no license is required for the transfer of technology to conduct "fundamental research," a license may be required if, in conducting fundamental research, the foreign graduate student needs access to technology to "use" equipment if the export of the equipment to the student would require a license under the EAR.
What machines qualify? How much is 190,000 MTOPS?
Currently available PC processors will range from about 4,000 to almost 14,000 MTOPS each, depending on speed and model. Intel has published CTP values for all of their processors (though they are somewhat confusing, as different numbers are sometimes published twice for what appears to be the same processor), and AMD has published CTP values for their Opteron line for reference. (As an odd aside, these numbers may have only a vague real-world relationship to actual performance, but it's the way the government wanted them calculated.)
Assuming the Intel value of over 10,000 MTOPS for a single 2.8 GHz processor (the slowest you can currently order in a Dell server) is correct, you only need 10 dual-processor systems in a cluster to hit the limit. That's not very much. A 1.5 GHz machine from yesteryear still pulls in 4,000 MTOPS; 50 low power machines puts you over the limit.
This is particularly problematic if you have a large number of systems with a single authentication source, so that one account can log into all of them simultaneously. If that is the case, particularly if the machines will accept network-based batch job submissions (as practically all UNIX-based systems will), as you are then effectively running a cluster with the cumulative CTP of every machine on the network. (In ideal cases, this actually does equate to that much computing power, though for most applications your performance will be limited by I/O issues.)
Conclusion:
The net result of this is that under the proposed changes, it may be illegal for universities to provide computer accounts to students from Tier 3 and Tier 4 countries, at least until someone comes up with a mechanism to prevent them from logging into more than one machine at once (a rather difficult task with most operating systems). This isn't yet carved in stone, however; the BIS is soliciting comments until May 27.
To submit comments, you can use one of the following methods:
- Submit comments online by following the comments link at the regulations.gov web page for BIS proposals
- Send e-mail to:
with a subject line including "RIN 0694-AD29"
- Send a fax to (202) 482-3355
- Mail or Hand Delivery/Courier: U.S. Department of Commerce, Bureau of Industry and Security, Regulatory Policy Division, 14th & Pennsylvania Avenue, NW., Room 2705, Washington, DC 20230, ATTN: RIN 0694-AD29.
Credit goes to Nicholas Weaver, via Educated Guesswork, for writing about this originally and bringing it to my attention.
What I wrote to the BIS
Any update on the status of the proposed BIS EAR changes?
I'm unable to find any further information on the proposed changes you describe, and the Federal Register article is gone. Heard anything new?
- Gregg TeHennepe
Nothing new
I did hear of a presentation at UTexas that said the government was planning to start audits, but I haven't been able to confirm that anywhere else.