We live in an age where anything can be tracked. Order a pizza, and you can watch it travel from the kitchen to your doorstep in real time. Hail an Uber, and you know where your driver is at every moment. Yet when it comes to our most strategically important technology, the advanced semiconductors that power frontier AI models, we have no idea where they go.
We manufacture these chips, export them around the world, and then lose sight of where they end up. This glaring oversight represents a dangerous gap in American national security policy.
Recommended Stories
The Chip Security Act offers a practical solution to close this gap.
In today’s artificial intelligence arms race, compute power determines the winners and losers. The nation that can deploy the most advanced processors can then train the most sophisticated AI models. Those models, in turn, largely determine who controls the rest of the AI stack.
China‘s aggressive pursuit of AI leadership, combined with its documented efforts to circumvent existing export controls, makes it clear that current enforcement mechanisms are insufficient. Jensen Huang, the CEO of Nvidia, may say there’s no evidence of export control circumvention, but the $2.5 billion made from smuggled chip sales suggests otherwise.
This disconnect between reality and corporate messaging should alarm every American who cares about national security.
The Chip Security Act takes a measured approach to the challenge of tracking these chips. The bill requires companies exporting the most advanced semiconductors to implement location verification mechanisms.
The bill’s definition of these mechanisms includes physical checks alongside approaches that use software. This allows companies to decide what method is most appropriate for them to verify the location of their chips. This gives the industry autonomy over process while ensuring accountability. The Department of Commerce retains authority to mandate secondary mechanisms if needed, but the primary responsibility lies with the companies themselves.
Additionally, the more technical versions of location verification mechanisms are already feasible. They would most likely rely on remote attestation capabilities, a security feature that allows hardware to cryptographically prove its identity to remote verifiers, which already exists on advanced chips.
For example, one of the most promising solutions is delay-based location verification mechanisms, which have been demoed using Nvidia H100s. These delay-based systems work by using the time it takes for a signal to travel between the chip and known reference points or servers to calculate an approximate location of the chip. This mechanism can achieve country-level precision without requiring hardware modifications and provides greater resistance to attacks compared to alternative approaches.
This system’s architecture also inherently limits potential attacks, as attackers can only add delays to signals and not reduce them. This would expand rather than contract the possible location of the chip. If the possible location was too large or was potentially in an adversarial location, this would be noticeable and indicate suspicious behavior, requiring companies to alert the authorities to possible circumvention.
Nvidia even offers its own opt-in location monitoring service to customers. What’s missing is a mandatory, standardized requirement to use it.
The bill also fundamentally preserves privacy by compelling companies only to detect and report potential diversions, not to surrender control of their proprietary information or consumer data. For example, location verification methods such as delay-based ones could protect end-user privacy by being able to confirm a chip’s location without sending any additional data. Through the use of a chip’s hardware root of trust, a security module built into the chip, it’s able to send a secure signal to a server while safeguarding critical information from being exposed.
The Chip Security Act doesn’t diminish the need for robust advanced semiconductor export controls, as U.S. companies should not be selling our most advanced technology to those that hope to use it against us. However, this act represents a crucial next step in building a more resilient defense against chip diversion.
STEPHEN COLBERT’S DEMISE BY THE NUMBERS
By establishing location verification as a standard practice, we create an additional layer of accountability that makes circumvention more difficult, more expensive, and more likely to be detected. Perfect security may be impossible, but that doesn’t excuse us from implementing practical improvements that raise the bar for bad actors.
If we can track pizzas and Ubers, we can track one of the most valuable technologies on earth. The U.S. Department of Justice has already confirmed that chip smuggling is actively threatening national security. The tools to stop it exist. The Chip Security Act would require that we use them.
Autumn Dorsey is a visiting research associate in the Center for Technology and the Human Person at the Heritage Foundation.