Export controls: how supply-chain chokepoints become policy

An export control is a rule that conditions the movement of specified goods, software, or technology across borders on government permission. It is one of the oldest tools of statecraft (arms embargoes are ancient), but its modern form targets dual-use items: things with both civilian and military applications, which describes essentially all advanced computing.

This lesson teaches the machinery, not a verdict on it. The previous two lessons supplied the preconditions that make semiconductor controls administrable at all:

• Production of advanced chips runs through a few identifiable chokepoints (one lithography vendor, three leading-edge fabs, a short list of materials suppliers).
• Capability has sharp technical boundaries (the DUV/EUV line, node classes, interconnect speeds) that lawyers can write into definitions.
• The chokepoint firms sit in a small number of allied jurisdictions (chiefly the United States, the Netherlands, Japan, South Korea, Taiwan), so a handful of governments can, in principle, cover the chain.

A control regime is therefore best read as a mapping from industrial structure to legal text: every rule in this lesson corresponds to a physical or economic fact from the previous ones. Where the mapping is tight, controls bind; where it leaks, they don't, and the leaks are as instructive as the rules.

The workhorse mechanism, common to most jurisdictions, has three parts:

1. A control list. In the United States, the Commerce Control List assigns sensitive items an ECCN (Export Control Classification Number) describing precisely what is controlled: a lithography tool above a defined capability, a chip above defined performance thresholds, software for designing advanced ICs. Precision matters: an item either matches the technical parameters in its entry or it does not.
2. A licensing requirement. Exporting a listed item to specified destinations requires a license from the responsible agency (in the US, the Bureau of Industry and Security, BIS, in the Commerce Department). Licenses are granted, denied, or granted with conditions; some destination-item pairs carry a formal presumption of denial, meaning applications are expected to fail.
3. Destination and end-use rules. The same item may flow freely to one country, need a license for another, and be effectively barred from a third. Rules can also attach to end uses (no exports knowingly supporting certain military or supercomputing applications) and end users, regardless of the item.

Two standing definitions widen the net. "Export" includes releasing controlled technology to a foreign national anywhere, even inside the exporting country (a deemed export). And re-export rules follow controlled items to their next border crossing, so routing through a third country does not launder the obligation.

Control lists regulate things; the Entity List regulates counterparties. It is a published register of specific organizations (companies, universities, labs) that a government has determined act contrary to its national-security or foreign-policy interests. Listing an entity imposes license requirements on exports to that entity that go beyond what the item alone would trigger, frequently with a presumption of denial.

Mechanically, entity listing has properties worth noticing:

• Surgical scope. It targets named organizations rather than whole countries, which concentrates impact on specific fabs, toolmakers, or design houses while leaving the broader market formally open. Large expansions have added over a hundred entities at once, spanning fabs, equipment makers, and the investment firms that fund them.
• A compliance cascade. Every supplier worldwide must now screen counterparties against the list, and the screening obligation itself changes behavior: firms over-comply, dropping listed customers entirely rather than risk violations ("de-risking"), which amplifies the formal restriction.
• A structural weakness. Names are cheap. A listed organization can, in principle, procure through newly created intermediaries, so entity-based controls demand continuous investigation and list maintenance, and enforcement quality determines whether the list means anything.

Entity listing is thus the pointer mechanism of the system: it lets a government aim the general machinery at particular nodes of the industrial map from the previous lessons.

The most consequential, and most contested, piece of machinery answers a jurisdictional puzzle: how can one country's rules reach a product manufactured entirely abroad by a foreign company?

The Foreign Direct Product (FDP) rule extends US jurisdiction to foreign-made items that are the direct product of controlled US technology, software, or equipment, or made in plants that themselves are such direct products. The lever engages because of a fact from the previous lessons: essentially every advanced chip on Earth is made with American inputs somewhere in the stack, design software, deposition and etch tools, components inside the lithography machines. A chip fabricated in Taiwan by a Taiwanese firm for a listed customer can therefore require a US license, because US tools touched the production line.

Companion mechanisms complete the reach:

• De minimis rules: foreign-made items containing more than a threshold share of controlled US content, and for some semiconductor rules any amount, fall under US jurisdiction.
• Knowledge standards: obligations trigger not only on certainty but on constructive knowledge, what a party reasonably should have known about where items are headed, which pushes screening duties deep into supply chains.

The structural insight: FDP converts technological ubiquity into legal jurisdiction. Its power is proportional to how embedded a country's technology is in global production, and it spends that embeddedness: every use gives foreign firms a new reason to engineer the controlling country's inputs out of future toolchains, a trade-off visible in "de-Americanization" efforts at equipment makers.

A simplified version of the screening logic every exporter in the chain now runs: item parameters, destination, counterparty, US-content and direct-product tests, and end-use knowledge, any one of which can trigger a license requirement.

Two design problems dominate the semiconductor controls in practice.

Where to draw the line. Rules must define "advanced" in testable parameters: logic below a stated node class (the regulations approximate the 14/16-nanometer boundary and below for logic, with analogous thresholds for memory), chips above stated performance-density lines, equipment capable of specified feats. Sharp thresholds are administrable, but they invite threshold engineering: designing products just under the line (chips tuned to sit below performance caps are the canonical example), which forces periodic rule revisions, which in turn creates uncertainty the industry prices in.

Getting other jurisdictions aligned. The chokepoints span several countries, so unilateral rules leak by construction: a tool denied by one government could be supplied by another's national champion. Alignment has been pursued through negotiated parallel measures, the United States, the Netherlands, and Japan each adopting their own domestic restrictions on advanced lithography and other equipment, rather than through a formal treaty. Parallel measures preserve sovereignty but create seams: definitions differ, timing differs, service-and-parts rules differ, and each government answers to domestic firms bearing revenue losses. The durable lesson: a chokepoint is only as controlled as its least-restrictive jurisdiction, so the diplomacy is as load-bearing as the law.

Every control system carries predictable failure modes; the semiconductor regime exhibits all of them, and honest analysis prices them in:

• Smuggling and diversion. Chips are small, valuable, and generic-looking, near-ideal contraband. Shell companies, transshipment hubs, and gray markets move restricted items at a markup; enforcement agencies answer with sting operations, shipment tracking, and penalties on intermediaries. Neither side wins outright; the control acts as a tax and a throttle, not a wall.
• Stockpiling ahead of rules. Restrictions are announced, then implemented; the gap produces buying surges that pre-load restricted buyers with years of inventory, a standard critique of phased rollouts.
• The mature-node pivot. Blocked at the leading edge, affected producers redirect capital toward uncontrolled mature nodes, where volume and pricing power can still be built, shifting rather than eliminating competitive pressure.
• Indigenization pressure. The strongest documented effect: restrictions convert a market incentive (buy the best tools) into a survival incentive (build domestic substitutes at any cost), with heavy state subsidy. Whether substitutes can cross the deepest moats (EUV-class lithography) on policy-relevant timescales is the regime's central open question, and the honest answer is that the moats from lesson 2 cut both ways: hard to replicate, but the incentive to try is now maximal.

None of these erase the controls' effect at the leading edge; they define its shape: delay and cost imposition rather than absolute denial.

Strip the case study to its transferable mechanics and you have a template for analyzing any technology-control regime:

1. Controls require chokepoints. They work where production runs through few, identifiable, jurisdictionally reachable nodes. Diffuse technologies (most software, most algorithms) resist this machinery almost completely.
2. The mechanism menu is short. Item lists with thresholds; counterparty lists; extraterritorial tests (direct-product, de-minimis); end-use rules; licensing with presumptions. Every regime you will read about recombines these five pieces.
3. Every mechanism has a conjugate evasion. Thresholds beget threshold engineering; entity lists beget shell entities; extraterritoriality begets design-out; leading-edge denial begets mature-node pivots and indigenization. Assessing a control means netting the rule against its conjugate.
4. The instrument spends what it uses. Leverage came from being embedded in everyone's supply chain; exercising it teaches the world to reduce that embeddedness. Controls are therefore time-limited assets, strongest at first use, and the strategic question is always what the leverage is being spent on.

What this lesson deliberately does not do is score the policy: whether the costs (market losses, alliance friction, accelerated indigenization) are worth the aims (delaying specific capabilities) is a judgment resting on values and classified facts, outside a mechanism course. What the mechanisms do tell you is where to look next: at the resilience of the chain itself, the subject of the final lesson.