Why smuggle chips when you can remote in?

Politico

2 days ago

With help from Mohar Chatterjee
In the global race to control the most powerful new technologies, America has used aggressive export controls to cut off China's access to high-end microchips. And smugglers have grown ever more creative in evading them: paying students to pack them alongside clothes in luggage, mislabeling shipments as toys or tea, stowing them in container trucks filled with an assortment of other electronics.
But there's an easier way for China to tap into the computing power of those microchips: just access them remotely with cloud computing.
Last year, Reuters found that at least 11 companies or state-backed entities from China had sought out U.S. cloud services as a back-door way to access the computing power of restricted chips.
'This was always a gaping blind spot that policymakers are waking up to,' said Barath Harithas, a senior fellow at the Center for Strategic and International Studies. 'What's the point of spending all these efforts on smuggling of chips if you can just access the computing capacity remotely?'
Lawmakers are trying to close this loophole by extending export controls to cloud computing services. But that effort is about to get a lot trickier — thanks to none other than President Donald Trump.
The giant data center deals Trump recently announced in Saudi Arabia and the United Arab Emirates could make it even harder to restrict China's access to computing power by basing providers outside the U.S.
'These countries in the Gulf maintain close relationships with Chinese counterparts and maintain a political position between the U.S. and China,' said Janet Egan, a senior fellow at the Center for a New American Security (CNAS). 'That concerns me when I think about Chinese actors accessing vast amounts of compute.'
Controlling computing overseas goes back to the Cold War, and it's been evolving in the AI age. The Biden administration blocked the export of AI chips to China in 2022. It's since tightened the throttle with controls on more chips and on chipmaking equipment.
Compared to that push to control hardware, the U.S. has taken a much less focused approach to remote cloud access for AI. The Biden administration packed 'know your customer' rules into its AI diffusion framework issued in January; Trump scrapped that rule in May. Trump's Commerce Department is currently working on a replacement rule, though it's unclear whether it will include cloud provisions.
'It sounds like the administration is still figuring out [the cloud] as it tries to determine what it wants a diffusion rule to look like,' said Michael Horowitz, who served as a deputy assistant secretary of defense under former President Joe Biden and is a scholar on emerging technologies.
The Commerce Department did not respond to DFD's questions about the replacement rule.
Congress has yet to pass a bill on remote cloud access. In 2024 security report on DeepSeek, the House Select Committee on China recommended 'remote access controls' on all data centers.
A bill from Rep. Mike Lawler (R-N.Y.) to extend export controls to the cloud, and block 'CCP-aligned companies' from accessing U.S. technology remotely, advanced out of the House Foreign Affairs Committee in April. 'Closing this loophole is essential to preventing our adversaries like China from accessing restricted technology,' Lawler's communications director Ciro Riccardi told DFD.
There's a tension embedded into the cloud computing question. Some Chinese customers use U.S. cloud services for innocuous purposes, like storage or video games, rather than military or AI development – and that can be a good thing, said Sam Winter-Levy, a fellow at the Carnegie Endowment for International Peace.
'So long as the world's AI computing activities stay tethered to the U.S. cloud, policymakers can bake some degree of transparency into the system,' he said.
At the same time, Chinese users have been documented trying to set up accounts on Amazon Web Services and Microsoft Azure to access the advanced computing power needed for training AI models – not illegal but also not desirable in light of U.S. policy.
In the absence of a government rulebook, cloud companies have implemented some safeguards like 'know your customer' standards on their own – for example, Amazon may require appointing a legal representative and submitting certain identity documents and financial information, depending on the type of use.
Where remote access gets dicier is overseas, according to Egan of CNAS.
'As we start to export more chips around the world, particularly in regions like the Gulf, we need more guidelines,' she said.
In May, Trump announced a series of AI deals while on a tour of the Middle East, which would result in the sale of tens of thousands of the U.S.'s most advanced AI chips to build data centers in Saudi Arabia and the UAE.
The Trump administration has cheered on these ventures, including their implications for cloud computing. 'American companies will operate the data centers and offer American-managed cloud services throughout the region,' Commerce Secretary Howard Lutnick said in a statement. 'These are America First deals that drive investment into the U.S., improve our trade balance, and lock in American technology as the global standard,' White House AI and crypto czar David Sacks wrote in a May post on X.
Critics including House China Chair John Moolenaar (R-Mich.) called for scrutiny of the deals, especially in light of Gulf countries' alliances with China.
But it's unclear what guardrails exist on the deals, for the chips themselves or the data centers they will power.
When asked about the security of the Gulf data centers, the White House pointed DFD to a fact sheet stating that agreements in the UAE include 'strong protections to prevent the diversion of U.S.-origin technology.'
Amazon and Microsoft have also inked deals to help those Middle Eastern companies develop their cloud services. Asked about their cloud security measures for those Gulf projects, Amazon said 'AWS complies with all applicable U.S. laws, including trade laws.' Microsoft pointed DFD to a press release stating that its UAE partnership includes a commitment 'to world-leading standards in AI safety and security.'
Chris Miller, a Tufts University semiconductor historian and author of 'Chip War,' said the current approach leaves Big Tech companies largely responsible for policing who uses their cloud services, especially when it comes to the data centers planned for the Middle East.
'Different countries and governments have different interests,' Miller said. 'This seems to me to be just as important, if not more important, as where physically the chips and servers are.'
EU firms want an AI moratorium too
European companies are pushing for a pause on AI regulations, and what they're asking sounds an awful lot like the failed effort backed by Silicon Valley to pause state AI law enforcement in the megabill.
As POLITICO's Eliza Gkritsi reports, 46 leaders of the European Union's biggest firms – including Airbus, Mistral, and Mercedes-Benz – sent an open letter Thursday asking Brussels for a two-year delay on implementing its AI Act, which is set to go into effect on Aug. 2. They complain of 'unclear, overlapping and increasingly complex EU regulations' as being a major obstacle to scaling AI systems and competing on a global level. The pause would allow for 'further simplification of the new rules,' they said.
The AI Act, which the EU passed last year, includes an overarching set of rules regulating AI systems like chatbots and facial recognition. Those rules include transparency requirements, restrictions on AI-powered surveillance, and a ban on biometric systems that classify peoples' protected characteristics like race. Companies like Meta and Google have criticized the AI Act as unworkable. Henna Virkkunen, the EU's technology chief, told POLITICO that she would decide by the end of August whether to delay enactment of the legislation.
THE KOSA POWER PLAY THAT SANK THE AI MORATORIUM
At the center of Sen. Marsha Blackburn's decision this week to withdraw support for an artificial intelligence measure she worked on with Sen. Ted Cruz (R-Texas) was her Kids Online Safety Act, according to four people familiar with the situation, POLITICO's Ruth Reader and Mohar Chatterjee report.
Those four people, granted anonymity to discuss private negotiations, said Blackburn (R-Tenn.) hoped a compromise to limit the scope and span of the 10-year AI moratorium would allow her to advance her KOSA legislation to markup in the Senate Commerce Committee, which Cruz chairs. The amendment she worked out with Cruz would have allowed states to enforce laws passed in recent years to keep kids safe from online sexual predators, bullying, drug sales and other negative health impacts, but it prevented states from putting 'undue or disproportionate burden' on AI systems.
After a coalition of 130 organizations said they opposed that amendment, Blackburn went to Cruz on Monday and tried to get the 'undue or disproportionate burden' language removed from the bill. But Cruz wouldn't budge, one of the people said.
By Monday night, Blackburn changed her amendment with Cruz to include KOSA as a symbolic move, three of the people said. She then partnered with Senate Commerce ranking member Maria Cantwell (D-Wash.) to strike the original AI moratorium from the megabill, which lawmakers approved with a 99-1 vote. Cruz's office didn't return a request for comment, and Blackburn's office declined to comment.
post of the day
THE FUTURE IN 5 LINKS