Encryption, spyware, and now Mythos: History shows why cyber export control doesn’t work

The U.S. government recently ordered an AI company to restrict export of its powerful AI models, citing national security concerns, marking the first major test of using export controls to limit access to frontier AI technology. Governments have a long history of attempting to control the spread of dangerous cyber technologies through export restrictions, including efforts to limit encryption software in the 1990s and surveillance software in the 2010s, but these efforts have had mixed results. Past cases show that export control approaches often fail because some countries do not participate in international agreements, enforcement depends on individual countries' discretion, and companies can relocate to jurisdictions with weaker controls. The outcome of this situation could either lead the U.S. government to lift restrictions to keep American AI companies competitive, or require companies to obtain government approval before serving foreign customers, with neither approach necessarily preventing similar capabilities from being developed elsewhere.