Commerce lacks intelligence resources to keep U.S. tech from fueling Chinese cyberthreat, experts warn

The Commerce Department unit that approves sensitive U.S. technology exports does not have the intelligence resources to fully realize the national security consequences of selling advanced equipment and software to China, several experts and a former agency official told CyberScoop.

These critics are especially alarmed by the high percentage of technology approved for the Chinese market and question whether the Bureau of Industry and Security has the staffing and Intelligence Community connections to carry out its mission to safeguard U.S. national security and protect economic interests.

Last year, for example, BIS approved 86% of all technology export licenses, a number experts say is far too high given the national security concerns in play and the fact that many of the technologies have potential military uses. And multiple experts estimated that the unit approved about 90% of all export licenses for technology sales to China over the past decade.

“They could use better intelligence, there’s no doubt about it,” Derek Scissors, a senior fellow at the American Enterprise Institute, told CyberScoop. “They have not made the transition to China being a national security problem.”

The Biden administration has recently made a series of policy decisions designed to protect U.S. national security in response to what it portrays as the growing technological and cybersecurity threat posed by China. Last month, the administration signed legislation that earmarks $50 billion to support expansion of U.S. semiconductor chip manufacturing and reduce American reliance on Chinese-made chips. Reuters reported last Thursday that the White House will broaden bans on U.S. exports of semiconductors used to advance artificial intelligence technology and chipmaking equipment next month.

But critics say that BIS is a weak link in U.S. efforts to compete with China on technologies such as artificial intelligence, chip manufacturing and other core technologies that also play a fundamental role in national security. “The weaker our industries become — semiconductors, telecommunications, critical minerals and rare earth elements, high-capacity batteries, and pharmaceuticals and medical equipment — the more our national security is at risk,” Nazak Nikakhtar, former BIS chief, testified in June during a Senate Intelligence Committee hearing.

Nikakhtar, who now heads the national security practice at the law firm of Wiley Rein, told lawmakers that Commerce has ignored the threat posed by China for too long, leading to “supply chain vulnerabilities across hundreds of critical products, ranging from semiconductor and electronics manufacturing to the development of active pharmaceutical ingredients.”

She testified that as the former head of the Commerce Department’s Committee on Foreign Investment in the United States, which screens overseas investment for national security reasons, her team was “completely in the dark, our intelligence community didn’t have adequate information, and I was frequently in the office until three in the morning using any open source information I could to get to the ultimate beneficial owner.”

The message from critics that BIS needs to boost its intelligence capabilities has led to some action in Congress. The 2023 Intelligence Authorization Act includes a provision for the Director of National Intelligence to carry out a pilot program to “assess the feasibility and advisability of providing intelligence derived from open source, publicly and commercially available information to the Department of Commerce to support the export control and investment screening functions of the department.” The provision is expected to pass.

A spokesperson for Senate Intelligence Committee Chairman Mark Warner, D-Va., said the committee added the provision to enhance intelligence support to Commerce activities “critical to U.S. economic and national security, such as export controls and entity listing.”

BIS officials also have recognized the office needs to increase staffing. Its leadership recently asked Congress for nearly $200 million in discretionary spending and 593 positions to meet its goals, according to its budget request for the 2023 fiscal year. The bureau currently employees 448 people with almost all of them working on export administration and enforcement.

Still, BIS defended its current work and told CyberScoop it already works closely with the intelligence community, including through “direct access” to its information.

“As the threat environment has evolved as it relates to nation-state threats, new technologies, and an expanding array of contested domains, we are constantly working to build on those relationships, bring on additional resources, and leverage all sources of information to fulfill our critical and expanding mission,” said Under Secretary of Commerce for Industry and Security Alan Estevez in a statement to CyberScoop.

A Commerce Department spokesperson highlighted the Office of the Director of National Intelligence pilot project as an example of the agency’s work to bolster intelligence gathering efforts. The ODNI declined to comment because the legislation creating the pilot program with BIS has not yet passed.

But critics say that just looking at the number of technology exports that BIS approves is cause for alarm. The U.S. exported $125 billion worth of goods to China in 2020 and BIS officials required a license for less than half a percent, according to a Wall Street Journal analysis of Commerce Department data. Of that fraction, the agency approved 94%, or 2,652, of the applications it received for technology exports to China that year, the Journal reported. (Some experts argue that since companies don’t typically apply for licenses when they know they are going to be rejected, the data shows an artificially high number of approvals).

Kevin Wolf, a lawyer at Akin, Gump, Strauss, Hauer & Feld, ran BIS for seven years during the Obama administration and said the agency needs to act more aggressively than it has in the past.

“Export controls need to be thought of and used more broadly than has been traditionally the case in response to China’s technology acquisition and use objectives,” Wolf told CyberScoop, arguing for substantial funding increases. “I don’t think that’s really a debate anymore.”

But Wolf said it will be important to handle this change in partnership with U.S. allies, a process that he said will take time and a lot of effort. Even once there is more funding, it can be difficult to find subject matter and technology experts to do the needed analysis, he said.

Other analysts pointed out that BIS needs more Chinese language experts. “For BIS, both in terms of enforcement and new listings, a lack of Chinese language capabilities can really hinder investigations,” Emily Weinstein, a research fellow at Georgetown’s Center for Security and Emerging Technology, said via email.

Overall, the role Commerce Department plays in the national security bureaucracy is “probably still opaque to much of the IC,” said Gavin Wilde, a former National Security Agency official who is now a senior fellow at the Carnegie Endowment for International Peace. “As the administration increasingly relies on BIS to counter and compete with adversaries, it would make sense to deliberately enhance Commerce’s stature and presence as an IC partner and consumer, in addition to the usual suspects.”

Jon Bateman, another senior fellow at Carnegie, said that today Commerce and BIS are more central to U.S. foreign policy than ever before.

“If we accept that China is a key great power competitor and the key bilateral challenge, and that much of that challenge relates to this complicated economic relationship and this technological competition that cross cuts the military dimension, economic dimension and informational dimension,” he said, “you could argue that BIS is at the center of US foreign policy, decision-making and action.”