Encryption, spyware, and now Mythos: History shows why cyber export control doesn’t work

In a significant move last Friday, the White House mandated that Anthropic halt the export of its advanced AI models, Fable and Mythos, citing national security concerns. This directive has left the models inaccessible for anyone, including foreign nationals within the U.S., for over a week now. This situation marks a pivotal moment to assess the U.S. government's ability to regulate frontier AI through export controls, reminiscent of past attempts to manage encryption and spyware technologies with mixed results. Since its launch in April, Anthropic has promoted Mythos as a potentially hazardous cyber tool, capable of significant disruption if widely released. Prior to the ban, access was limited to around 150 vetted firms and government organizations, aimed at enhancing defenses against malicious actors before they could exploit similar capabilities. So, what prompted this abrupt ban? Reports indicate that two key incidents triggered alarms. First, Anthropic granted access to Mythos to a South Korean telecom—suspected of having ties to China—leading to U.S. officials' concerns. Although SK Telecom has denied such connections, the alarm bells were already ringing. Additionally, Amazon CEO Andy Jassy reportedly informed the administration about a security breach in Fable 5’s safeguards, although Anthropic deemed this a minor, already-resolved issue rather than a significant flaw. Faced with this pressure, the Commerce Department swiftly issued an export control directive, forcing Anthropic to restrict access within approximately 90 minutes of notification. This episode echoes a historical pattern where governments have attempted, often unsuccessfully, to limit the spread of technologies seen as dangerous. One notable example dates back to the 1990s, when the U.S. government viewed the encryption software Pretty Good Privacy (PGP) as a threat to national security, leading to legal challenges that ultimately fostered advancements in encryption technology. Fast forward to the 2010s, when Western-made spyware was discovered targeting dissidents, prompting governments to modify the Wassenaar Arrangement—a treaty aimed at regulating the export of dual-use technologies. Despite these efforts, enforcement has been inconsistent, with countries like Israel and Italy permitting certain spyware exports despite their potential misuse. The ongoing struggle to regulate dual-use technologies highlights the challenges faced by governments. While there have been some successes, such as the shutdown of the Germany-based spyware firm FinFisher following investigations, many companies have found ways to circumvent regulations by relocating to jurisdictions with looser controls. As the standoff between Anthropic and the current administration continues, the likelihood of the U.S. lifting these restrictions looms large. Such a decision could reflect a recognition that AI capabilities will proliferate globally, regardless of U.S. restrictions. Alternatively, American AI firms may face new compliance burdens that could impact their competitiveness in the global market. Given the historical context, it remains uncertain whether government-imposed export controls are the most effective means of preventing the misuse of advanced cyber technologies.