6

Recommendations

Leadership in technological innovation advances the national security and economic interests of the United States. In an increasingly competitive and technology-dependent world, ensuring and protecting the nation’s ability to lead in technological innovation is more important than ever before, and requires a new approach. The current approach is based on outmoded assumptions about the context in which technologies are developed and used. The first such assumption is that the United States enjoys an overwhelming advantage in the development of new technologies, and that this advantage can be protected by “outinnovating” adversaries and competitors. The second assumption is that strategically important technologies are discrete, with well-defined purposes. The third assumption is that these technologies continue to originate from federal laboratories and government-sponsored academic research and are subsequently commercialized for broader use. The final assumption is that the management of technology-related risks can be achieved primarily by protecting specific “critical technologies” from unauthorized use, possession, or production.

In today’s extremely competitive global technology environment, these assumptions are no longer valid. In the committee’s view, a fundamental shift in framing—one that goes beyond technology controls—is needed to protect U.S. technology advantages, setting the foundation for a new approach that has the following key objectives:

• Maximization of strengths in science, research, and technology innovation. The United States’ greatest advantage over its competitors is rooted in an ability to be the first to develop and deploy new technologies, in cooperation with its allies, not in an ability to restrict access to technologies. Essential strategies for maximizing this advantage include promoting the scale and speed of the domestic research and technology innovation ecosystem; fostering a risk-taking environment to aid researchers and innovators; and attracting, retaining, and supporting the most talented science, engineering, and innovation workforce in the world. Recommendations 1 and 2 support these strategies.

• Risk management based on threat identification and coordinated actions addressing the risks to U.S. technology leadership posed by these threats. The current U.S. approach to managing the risks associated with technologies is based on restrictions on the possession, use, or manufacturing of these technologies, or restrictions on the knowledge or materials needed to develop them. Given the speed and scale of technology innovation and the growing trend of technologies originating in the private sector, the current risk management approach is of limited effectiveness and may in some cases be counterproductive. Instead, the U.S. government should focus on defining technology-related threats and vulnerabilities facing the United States, and then coordinate the implementation of effective strategies for responding to the resulting risks to U.S. technology leadership. Actions supporting these strategies might be taken in the public and private sectors; in multiple federal agencies; and if necessary, with international partners. Recommendation 3 addresses this issue.
• A new multisector, multiorganizational, multinational approach to protection and assurance for the unique vulnerabilities associated with shared platforms. Today’s technology systems depend on, and are in many cases necessary components of, platforms for their functionality, production, or use. Platforms introduce new and shared vulnerabilities that can be exploited to misuse any technology on the platform. The codependency inherent in a shared platform means that restrictions or controls on the platform may disrupt everything using the platform—including beneficial uses that may enhance U.S. national security and competitiveness—creating very large-scale unintended consequences. The decentralized, and often international, governance systems that manage or control a platform may require coordinated federal action among multiple agencies responsible for standards, trade, international agreements, regulation, and law enforcement, or with private-sector entities or international partners. Recommendation 4 addresses this issue.

The following recommendations do not represent a comprehensive response to this need for a new framework for evaluating technology vulnerabilities. Instead, they represent important first steps toward a more effective approach to protecting the U.S. technological advantage based on such a framework.

MAXIMIZATION OF STRENGTHS IN SCIENCE, RESEARCH, AND TECHNOLOGY INNOVATION

The overall objective of the United States should be to maximize its strategic advantages in innovation and technology. Because scientific discovery and innovation favor broad and open participation, a key element of achieving

this objective is to maximize the amount of work that can be performed appropriately in an open research environment, thereby promoting U.S. leadership in science and engineering, attracting top talent, and enhancing discoveries that lead to new technologies. For those specific cases in which an open environment is not suitable to protect U.S. interests, federal research and development (R&D) funders should make risk-informed decisions that clearly designate those specific cases requiring suitably restricted environments.

In conducting technology innovation, the United States benefits from having both open and restricted R&D environments. An open research environment is one with relatively few restrictions on participation, information sharing, or publication, but it does include basic requirements to ensure the integrity of the research process. Research, training, and teaching conducted in an open environment benefit the United States because they attract research talent, foster creative and innovative conditions for discovery, and speed the development of new ideas and technologies. Conducting this work in an open environment does pose a risk that knowledge, know-how, or results may flow to adversaries from the movement of either information or people. But for an innovation leader, the benefits of openness outweigh the risks for most R&D efforts because the risk of information loss is mitigated by the ability to innovate even newer technologies. An innovation leader can “run faster” than its competitors (IOM, NAS, and NAE, 1982).¹

Most, though not all, research-related work is appropriate for an open environment. For certain specific uses, research, development, production, and related activities need to be confined to restricted environments that limit participation, collaboration, the sharing of information, and the dissemination of results to ensure that the knowledge, know-how, production, and use of a technology are limited to those entrusted to use the knowledge and information properly. In these cases, lowering the risk of disseminating a sensitive technology to adversaries outweighs the adverse impact of restrictions on the creativity and productivity of the work performed in such environments. U.S. policy should have the objective of striking the proper balance between these risks by designating the type of research environment most suitable for a given research activity.

It is the assessment of this committee that open research environments are not adequately defined in a way that protects the features most important to technology innovation and fundamental research. Generally, an open environment is one that is simply “not restricted”—for example, by classification or security clearance requirements. The key characteristics of an open research environment need to be defined specifically, in much the same way that a restricted research

___________________

¹ A 1982 National Academies report (commonly referred to as the Corson report) highlights that controls on scientific information “can be seen to weaken both military and economic capabilities by restricting the mutually beneficial interaction of scientific investigators, inhibiting the flow of research results into military and civilian technology, and lessening the capacity of universities to train advanced researchers” (IOM, NAS, and NAE, 1982, p. 3). The conclusion of the report is that open and free scientific communication is preferred because U.S. industry and military institutions will be able to “run faster” than U.S. adversaries (IOM, NAS, and NAE, 1982, p. 47).

environment is defined and protected. Thus defining these open research environments will clarify their importance and unique role in achieving the national objective of technological strength. Having this common definition will enable federal funding agencies to make an informed decision prior to an award as to whether the research they are funding is suitable for an open research environment or requires a restricted environment.

The proposed policy approach will put the federal government in the position of making an explicit risk acceptance decision on behalf of the nation. By designating certain research environments at universities or national laboratories as open, funding agencies will decide a priori what work can be performed in those environments despite the accompanying risks of disclosure. Similarly, research work that needs to be restricted, whether for commercial or national security reasons, will be explicitly designated for restricted environments, such as near-campus federally funded R&D centers, restricted government laboratories, commercial research facilities, or collaborative research centers between universities and companies. The committee notes that these policies are entirely consistent with those found in NSDD-189, which covers scientific, technical, and engineering information.²

___________________

² NSDD-189 states, “It is the policy of this Administration that, to the maximum extent possible, the products of fundamental research remain unrestricted. It is also the policy of this Administration that, where the national security requires control, the mechanism for control of information generated during federally-funded fundamental research in science, technology and engineering at colleges, universities and laboratories is classification. Each federal government agency is responsible for: a) determining whether classification is appropriate prior to the award of a research grant, contract, or cooperative agreement and, if so, controlling the research results through standard classification procedures; b) periodically reviewing all research grants, contracts, or cooperative agreements for potential classification. No restrictions may be placed upon the conduct or reporting of federally-funded fundamental research that has not received national security classification, except as provided in applicable U.S. Statutes” (White House, 1985, Section III).

In making determinations regarding protection, the burden of proof should be on the person or entity that wants to restrict, not on the group doing the work. The reason for restricting the work should be clearly stated, and the designation should be made as early as possible, ideally when proposals for funding are being solicited. The policy default should be that if no legitimate reason for restriction can be given, the work will be done in an open environment. This risk management approach is far preferable to generalized risk avoidance approaches, such as requiring background clearances for all researchers, “after-the-fact” restrictions applied when research has already been funded or performed, or pass-through restrictions from prime recipients to subcontractors.

DEVELOPING AND ATTRACTING TALENT

To compete effectively, the United States must lead in developing, attracting, and retaining top talent for research and innovation. World-class technology development and commercialization require the contributions of the best talent in the world. Since the end of World War II, the United States has enjoyed a comparative advantage over other countries by being the “go-to” destination for top foreign students and research talent. Talented scientists, engineers, and innovators are attracted to key features of America’s open and democratic society: open and risk-embracing environments where they can pursue promising ideas; well-funded, world-leading academic and research institutions and technology companies; and the opportunity to be recognized or rewarded for their achievements. The readily available pool of international talent, however, has masked issues in training top domestic scientific and engineering talent, leaving the nation unprepared for efforts by other countries to reverse the flow of international talent to the United States.

The development of domestic talent will continue to be essential if the United States is to maintain its leadership in science and technology. As discussed in Chapter 3, the United States still lags other countries in preparing its citizens for participation in technology-intensive areas. Correcting this deficiency in domestic STEM (science, technology, engineering, and mathematics) education remains an urgent public policy objective if the United States is to continue to reap the benefits of being a leader in technology development.

At the same time, however, if the United States is to continue generating more than 20 percent of global gross domestic product (GDP) with only about 4 percent of the world’s population, relying on talent from other countries will continue to be essential. The United States can no longer be complacent in assuming that it is the “default” choice for top global science and engineering talent. Other countries are aggressively competing for top students and STEM professionals, often by emulating the approaches that led to U.S. success in the past. Imposing excessive restrictions on foreign talent in research environments benefits U.S. competitors by dissuading talented people from coming to the United States, leading them to find other places to live and work. Therefore, in concert with efforts to expand domestic talent, the United States needs to

aggressively expand the advantages it offers for international talent, including top academic research universities; open, well-funded, high-reputation, and innovative research environments; a venture-backed, entrepreneurial innovation system; and public–private R&D partnerships. China and other countries cannot match these advantages within the constraints of their systems.

Today, the United States faces growing competition for talent from other countries, including specific programs aimed at retaining or attracting away from the United States foreign or expatriate scientists or engineers. The current U.S. response to this competition is fragmented, defensive, and focused largely on restricting participation in foreign talent programs by U.S. citizens or institutions instead of encouraging recruitment of foreign talent. No coherent federal policy links efforts to strengthen domestic STEM education and training opportunities for U.S. citizens with efforts to attract top foreign talent as students or workers. The current policy approach does not adequately consider the need to strengthen or defend the features of the U.S. innovation system that have given it such longstanding advantages in attracting talent. While this committee was not asked to make recommendations in that area, it views this issue as so central to its charge that it advocates continued urgent attention to the issue at the highest levels of government.

Domestically, the same forces that attract students to finance, law, or medicine—a combination of personal fulfillment, contributing to the common good, a positive work environment, and a sustainable lifestyle—will attract students to STEM careers. Internationally, the United States needs to find new and better ways to encourage scientists, engineers, and their families to come to this country to work and live. Options include further aligning work visa levels with student visa levels and clearing pathways to citizenship for top international researchers.

IDENTIFICATION OF STRATEGIC TECHNOLOGIES AND COORDINATED RISK MANAGEMENT

U.S. policy should shift from an approach based on listing “critical” technologies, with associated restrictions, to one based on coordinated risk management. As explained in Chapter 2, the protection of technologies is complicated by the changing nature of modern technology. Technologies today are rarely isolated in a manner that allows for well-defined descriptions of a technology and its scope of use. Rather, technologies tend to be combined and interdependent, with emergent properties and uses as the component technologies evolve. The current technology landscape includes a more diverse set of users and uses of technology, including more multipurpose/multiuse technologies; a more diverse set of developers (including commercial and non-U.S. actors); and a more intertwined nature of technologies, markets, and applications. (Technology development and commercialization today are also different because of the rise of platforms, discussed in the next section.) The features of modern technology highlight the need to employ a comprehensive approach to managing the risks associated with strategically important classes of technology development or use.

A related consideration is how to respond to other countries, particularly those that may be geopolitical adversaries, when they identify specific technologies or technology areas for which they are seeking an advantage over the United States. Presently, the United States lacks a systematic policy approach to defining a suitable response strategy for this type of competition. In some cases, the strategies adopted by other countries, including China, pose risks to U.S. technology leadership that cannot be addressed effectively by the traditional approach of limited, laissez-faire government policy with regard to specific technology areas.

Historically, the U.S. approach to managing technology-related risks has focused on specifying “critical” technologies, generally based on their features or capabilities or on the consequences of their misuse, and then restricting access to those technologies or the means to produce them. Today, technology is ubiquitous, shared, and multipurpose; thus, the task of distinguishing technologies that pose a specific risk is very difficult and may result in identifying overly broad technology areas, further complicating efforts to manage risk because of unintended effects on innovation itself.

Alternatively, one could define a risk management approach that begins with identifying which actors using what means are attempting to use a particular technology against U.S. interests or technology leadership, and then defining strategies for addressing resultant risks. That approach requires expertise that goes beyond the nature of the technology to encompass the plans, actions, capabilities, and intentions of U.S. adversaries and other bad actors, thus involving experts from the intelligence, law enforcement, and national defense communities in addition to agency experts in the technology.

It is vital to U.S. economic and national security for the federal government to base its risk management strategy on specific, identified threats to

U.S. interests and leadership in technology innovation. Vital as well is that the actions resulting from any risk management strategy address the risks posed by these threats without having a deleterious effect on future scientific discovery, beneficial applications of a technology, and the nation’s economic security.

Given the ubiquitous nature of today’s technologies, the committee believes the process of identifying and coordinating federal strategies for managing technology-related risks must be coordinated across the federal government. The committee does not believe that this responsibility is presently well defined in any existing agency or at the interagency level within the White House. Just as many technologies are multidisciplinary in nature, government technology policy must be multiagency. As a starting point for action, the committee proposes using existing interagency mechanisms to begin an effort to define specific threat-informed considerations, to identify strategically important areas of technology-related risk, and to coordinate the development of strategies that can be deployed and coordinated by federal agencies to manage the identified risks to U.S. interests and technology leadership. Because the threats are to both economic and national security, the committee proposes a joint effort of the appropriate Cabinet-level councils within the White House. Given the scale of these technology and global competition issues, the committee believes it likely that an effective response may also require coordination of efforts with allies and other international partners. This approach would work best for a specific and limited number of strategically important technology areas, and would not replace other, routine forms of protection employed by government agencies or commercial enterprises.

• proactive, in that they define technology-related threats with national or economic security implications as early in the research and development process as possible;
• strategic, in that they are based on global realities, including the plans, actions, intentions, and capabilities of adversaries, and on reasoned risk acceptance decisions about which technologies must, should, or cannot be protected;

• timely, in that they are based on current understanding of the associated threats and vulnerabilities and are adjusted as required;
• integrated, so that different mechanisms for technology protection, such as export controls, information classification, or decisions by the Committee on Foreign Investment in the United States, are directed and coordinated in such a manner as to effectively reduce or mitigate the risk;
• adaptive, with mechanisms for subjecting identified technology areas to regular reviews by integrated expertise in science, technology, and national security;
• dynamic/repeating, with a scheduled review to ensure that there have been no changes to the technology, the environment, or the actor(s) that would warrant a change in the threat status; and
• assessed for adverse effects, to ensure that they do not result in unnecessary and unintended barriers to U.S. innovation leadership.

The committee is aware that responsibility for risk management of technology-related threats belongs not solely to the federal government but also to the private sector and other actors in the national technology innovation system. Because the committee’s charge was focused on actions for the federal government and for federally funded research, this report offers no specific recommendations on actions to enhance risk identification and management in the private sector. Nonetheless, the interagency process proposed in Recommendation 3 could be used to identify potential ways for the government to work with the private sector to improve risk management, including both collaborative efforts and consultation with industry before rules and regulations are passed.

Technologies are not static, and thus the means of protecting them cannot be static. A technology protection system must allow for continuing evaluation of the technology elements that need to be protected, with the mechanisms for managing overall risk being updated as necessary. While other risk management activities involving sensitive or critical technologies already occur at the agency level, it is important to define a whole-of-government risk management mechanism for those technologies that warrant it, either because of their nature or their potential applications, or because of the actions of U.S. adversaries. That mechanism should be managed in a manner that allows effective coordination across all affected agencies, including those involved with national security, law enforcement, trade, regulatory matters, international agreements, finance, science and technology, and standards setting.

TAILORED APPROACHES TO THE UNIQUE VULNERABILITIES RESULTING FROM SHARED PLATFORMS

The changing technological landscape has introduced new challenges to management of the risks posed by shared platforms and their supporting

ecosystems. Current approaches to risk management assume that each technology is essentially independent of other technologies (regardless of whether they are in fact discrete or separable) and has a single purpose or small set of defined purposes. That assumption has been challenged by the emergence of what this report terms “platforms”—underlying technology systems that are foundational to the design, development, or use of other technologies. These platforms typically are highly shared, have multiple purposes and uses, and offer tremendous benefits through their scalability and adaptability. The most pressing omissions in current approaches to technology risk management in the United States involve these platforms.

Approaches to protecting diffuse multipurpose platforms differ from those for discrete, defined-purpose technologies. Sharing a common platform brings shared benefits as well as shared vulnerabilities and risks. At the country level, these shared vulnerabilities and risks affect the national interests of any country sharing the platform. Protecting these national interests typically requires governmental technology policies, such as government involvement in setting standards, regulations, or trade policies.

The committee does not believe that, at present, responsibility for identifying and managing the unique risks posed by these shared and powerful platforms is clearly established within the U.S. federal government, at either the federal agency level or the interagency level of the White House. Certain components of risk management suitable for application to platforms do exist in various agencies, but no agency has overall responsibility for coordination of these efforts. For example, the U.S. Department of Commerce contains separate bureaus and agencies for standards, protection of intellectual property, security of technology exports, telecommunications, and trade. These many efforts are subject to no coordination in accordance with a risk management strategy (i.e., one that identifies the risks, weighs those risks against the opportunities, and appropriately balances the two), either within the department or between the department and other federal agencies. This is but one example of the lack of ownership and cohesion that hampers U.S. efforts to engage with other global partners that share a platform and to address the shared vulnerabilities and risks.

The committee believes that the appropriate first steps in identifying strategically important platforms, defining the roles and responsibilities of federal agencies that pertain to those platforms, and developing coordinated risk management strategies covering their development, control, and use should be taken as part of a Cabinet-level interagency process. There are several reasons for this starting point: (1) at present, responsibilities in these areas are broadly spread across multiple departments; (2) input from the private sector and other key actors will be essential to gain a full understanding of how these shared platforms are managed, used, and changed; and (3) working with other countries and international bodies that share in these platforms will require the ability to engage at the international level.

• defining and designating specific technology platforms that are essential to U.S. interests;
• involving the private sector in specifying the technical features and requirements that should be included in platform development, such as performance standards for security, integrity, interoperability, control features, and user controls;
• developing a coherent, whole-of-government strategy for establishing and managing trust relationships among platform developers or users, including international governance mechanisms, use agreements, regulatory approaches, trade agreements, content requirements, and law enforcement cooperation agreements; and
• establishing a range of responses to security or trust problems related to the use of shared platforms, with participating agencies planning for and preparing appropriate “incident response” capabilities.

In today’s interdependent, global innovation system, the greatest threat is that the United States will inadvertently weaken its innovation ecosystem while other countries continue to emulate the actions that have historically yielded U.S. advantages in technology development and commercialization. To counter this threat, the United States needs to protect and extend its ability to develop new technologies and apply those technologies to problems in both the military and commercial spheres. Protecting and strengthening this ability is vitally more important than protecting specific technologies.

This page intentionally left blank.