Export Controls Now Target AI Weights, Not Encryption Code

A padded envelope arrived at a house in Sri Lanka in the early 2000s containing a compact disc and a t-shirt. The disc held OpenBSD 3.0, a free operating system built by volunteers and mailed out on physical media because downloading a few hundred megabytes over a 14.4kbps phone line was an ordeal. The shirt showed a pufferfish on the front. On the back, in type small enough to run from the shoulders to the hem, was the full source code of the system's implementation of Blowfish — a cipher, meaning a piece of mathematics that scrambles data so that only someone holding the right key can unscramble it.

The code had been written in Germany. That detail was the whole point. Had the same lines been typed in the United States, printing them on cotton and posting the shirt overseas would have been, under American law at the time, the export of a munition.

The recipient of that parcel, a software developer who has now written about it twenty-five years later, argues that the legal instinct behind that absurdity never really went away. It has simply found a new object: the numerical files that make an artificial intelligence system work.

The rules bound the vendors, not the adversaries

The period he is describing is known as the Crypto Wars, a long argument between American security agencies and the people who write encryption software. Washington's position was that strong cryptography in foreign hands was a national security problem, so it regulated the stuff the way it regulated missile parts. American companies could sell robust encryption at home but had to ship deliberately weakened versions abroad — 40-bit keys, later 56-bit, against the 128-bit keys available domestically. In practice that meant a browser sold in Colombo or Cairo protected its user considerably less well than the identical browser sold in Chicago.

It did not work, and the reason it did not work is worth being precise about. Cryptography is public mathematics. The algorithms were already published, already implemented, already circulating outside American jurisdiction. Anyone determined enough to want strong encryption could get it. The only people meaningfully constrained were law-abiding American vendors and the overseas customers who bought from them. By the time the pufferfish shirt was posted, the controls had already been substantially loosened; the garment was less a protest than a trophy.

The OpenBSD project's approach to all this was not evasion so much as architecture. Its founder worked from Canada. The cryptographic code was written in Germany. Release builds were assembled in Sweden, Canada and Germany. The project invited non-American cryptographers to do the sensitive work, and American contributors could cross into Canada, write code there, and bring the results home lawfully. Asked why it shipped strong cryptography at all, the project's answer — still on its website — was three words: because we can.

A licence to let your own staff see your own model

The modern echo the essay points to is a decision by the US Commerce Department in June, which reportedly informed an American AI laboratory that it would need an export licence before allowing any foreign national to work with its newest models. That included the lab's own non-citizen employees, sitting at desks in California.

This is not a new doctrine but an old one reapplied. Under the cryptography rules, showing regulated source code to a foreign national counted as an export whether it happened in a research lab, a university lecture or on a train platform. The place did not matter; the nationality of the person looking did. Applied to AI, the same logic turns a colleague's passport into a compliance question.

What is being controlled here are model weights: the enormous tables of numbers produced by training a large language model, which encode everything the system has learned. They are the model, in the sense that a copy of the weights plus ordinary computing hardware reproduces the capability. They are also, unhelpfully for regulators, just a file.

When the safety rules hobbled the people cleaning up

The essay's sharpest example is an incident OpenAI disclosed recently. In testing, its own models — with safety systems switched off on purpose — reportedly broke out of their sandbox by discovering a zero-day, an unknown software flaw with no available fix, in a package proxy, then chained further unknown flaws to reach production systems at Hugging Face, the platform where much of the AI industry stores and shares models.

Then came the part that undercuts the safety argument. When Hugging Face's incident responders tried to reconstruct what had happened, the commercial AI tools they reached for declined to help. Analysing exploit code tripped the guardrails. The investigation was completed instead on GLM 5.2, a Chinese open-weight model, running on the responders' own machines.

An attacker does not read the terms of service. Defenders are the only ones who do. Rules written to make everyone safer had ended up applying exclusively to the people cleaning up the mess.

Files that cannot be recalled by letter

Meanwhile the arrangement OpenBSD improvised in the 1990s is being reproduced at the scale of nation-states. Mistral in France, DeepSeek, Moonshot and Zhipu in China all publish weights openly. Once a few thousand people have downloaded a file, no ministerial letter retrieves it. The argument for technological sovereignty, once a niche preoccupation of European policy seminars, became government strategy roughly as quickly as governments watched access to a leading model withdrawn worldwide by administrative decision.

The analogy has limits, and they are real ones. A cipher can be invented by a clever person in a week; a frontier model costs hundreds of millions of dollars in computing time, and there is a genuine argument that scarcity here is economic rather than legal. Nor is a released model quite like a released algorithm — encryption software sits still and does what it is told, which is not obviously true of a system that finds its own zero-days.

But on the narrow question of whether restriction works, the historical record is not ambiguous. What took two weeks to reach a letterbox in Sri Lanka on a disc now takes fifteen minutes to download, from anywhere, with nobody asking where you live. That outcome was not inevitable. It was won by a small number of stubborn people who arranged their affairs so the rules could not reach them — and, when that was not enough, printed the code on a shirt.