What Happened to Export Controls on Dual-Use Technologies: The Cases of PGP and Advanced AI Models?

The concept of export controls on technologies that didn't stop anyone traces its roots to the Cold War era, when the U.S. and its allies sought to prevent critical Western technology, including cryptography, from reaching adversaries. Cryptography was initially classified as a munition, requiring strict export licenses. However, the advent of personal computers and the internet in the 1990s fundamentally challenged this paradigm, leading to what became known as the 'Crypto Wars.'

A key turning point was the release of Pretty Good Privacy (PGP) encryption software by Phil Zimmermann in 1991. PGP offered strong, publicly available encryption, directly circumventing government attempts to restrict such technology. The U.S. government launched a criminal investigation against Zimmermann in 1993 for alleged export control violations, treating encryption code as a weapon. This period also saw the controversial 'Clipper Chip' proposal by the NSA in 1993, which aimed to embed a backdoor for government access into encryption devices, but it faced strong public opposition and technical vulnerabilities, ultimately failing by 1996.

The widespread adoption of the internet and the growth of e-commerce created immense pressure to loosen these restrictions. Companies argued that export controls on strong encryption hurt their sales and hindered global digital security. By 1996, President Clinton signed an executive order that began to liberalize encryption export controls, moving most commercial encryption tools from the U.S. Munitions List to the Commerce Control List. Further relaxations occurred in 1999 and 2000, greatly simplifying the export of commercial and open-source cryptographic software, effectively ending the most intense phase of the Crypto Wars by acknowledging the futility of trying to contain widely available software.

As of 2026, while some restrictions still exist for military-grade encryption and exports to 'rogue states,' mass-market cryptographic products are largely unrestricted. However, the debate has resurfaced with the emergence of advanced artificial intelligence. In June 2026, the U.S. Commerce Department's Bureau of Industry and Security (BIS) issued an export control directive against Anthropic's Fable 5 and Mythos 5 AI models. Citing national security concerns, the directive compelled Anthropic to disable access to these models for all foreign nationals globally, leading to their temporary shutdown. This action has drawn immediate parallels to the PGP era, with cybersecurity experts arguing that such controls are unlikely to be effective and could push developers towards non-U.S. AI models, undermining American technological leadership.

Simultaneously, the landscape of digital security is being reshaped by quantum computing. The threat of 'harvest now, decrypt later' attacks, where encrypted data is collected today to be decrypted by future quantum computers, has become a present concern. In response, the National Institute of Standards and Technology (NIST) finalized post-quantum cryptographic standards in August 2024, and major tech companies like Google have set aggressive timelines (e.g., 2029) for migrating to quantum-resistant encryption. By April 2026, over 50% of human web traffic through Cloudflare was already protected by quantum-resistant key agreement, demonstrating rapid adoption in the face of new threats. This ongoing evolution underscores the dynamic and often reactive nature of export controls in the face of rapidly advancing, globally accessible technologies.