Technology to Secure the AI Chip Supply Chain: A Working Paper

Variants of HEMs are already widely used in defense products, but also in commercial contexts: On Apple’s iPhone, HEMs ensure that unauthorized applications cannot be installed. Google uses an HEM-based solution to remotely verify that chips running in their data centers have not been compromised. Many video games use a hardware device called a “trusted platform module” as an HEM-based approach to prevent in-game cheating. In the commercial AI space, HEMs are used to distribute training between different users while preserving privacy of code and data.

Well-designed HEMs for AI hardware could help detect and deter AI chip smuggling into China; allow more surgical applications of export restrictions, reducing the risk of a de-Americanization of chip supply chains; and create privacy-preserving, trustworthy, and commercially viable solutions to governance and security issues.

However, the category of HEMs covers a broad design space, with both desirable and undesirable possibilities. For example, the Apple Secure Enclave security module (found in iPhones and MacBooks) is a highly reliable HEM that prioritizes customer security and privacy.⁴ This module ensures that only legitimate firmware and operating systems can be used on the device, which in turn helps deter theft and prevent unauthorized applications from being installed. On the other hand, the National Security Agency’s infamous Clipper chip carried severe privacy and security vulnerabilities. While purportedly designed to increase security, the device contained a built-in back door that allowed government officials to access private data.⁵

To advance research, development, and debate around the potential of HEMs to advance AI safety and governance, the authors recommend that U.S. policymakers:

• Accelerate HEM and hardware security research and development (R&D) through direct funding and public-private partnerships. The National Semiconductor Technology Center (NSTC), relevant Defense Advanced Research Projects Agency (DARPA) projects, the Department of Defense’s Microelectronics Commons, and the National Institute of Standards and Technology (NIST) could serve as key funders and facilitators of public-private coordination to advance HEM development.
• Create commercial incentives for industry HEM R&D through conditional export licensing. The Department of Commerce should incentivize and derisk industry HEM R&D by defining a set of hardware security and governance features that would prevent new restrictions from applying to exported hardware, if those features were installed.
• Further develop AI hardware security standards to incentivize and harmonize security features across industry. NIST, in collaboration with industry, the NSTC, and standard-setting bodies like the Institute of Electrical and Electronics Engineers AI Standards Committee and the International Organization for Standardization, should build on existing technical standards to further improve data center AI hardware security, with input from leading semiconductor and security firms.

Introduction

Advanced artificial intelligence (AI) systems, built and deployed with specialized chips, show vast potential to drive economic growth and scientific progress. However, U.S. policymakers are increasingly concerned about the dual-use potential of AI capabilities. Irresponsible actors could use advanced AI systems to support cyberattacks, biological weapons design, and mass surveillance.⁶ Securing the supply chain for AI chips is therefore vital for mitigating risks to U.S. national security.

This logic has spurred moves to restrict foreign actors, especially China, from accessing American AI technology. In October 2022, the U.S. Department of Commerce imposed sweeping export restrictions on AI chips and associated hardware to China. These were tightened in October 2023 to address perceived shortcomings but added greater burdens on U.S. firms, including requiring permission to export certain consumer graphics processing units (GPUs) and extending an export license requirement to dozens of additional countries suspected of diverting AI chips to China.⁷ Recently, the controls were expanded again, this time affecting all chips using advanced high-bandwidth memory.⁸ Now, concerns about China’s rapid catch-up to U.S. AI capabilities are prompting U.S. policymakers to consider further export restrictions, such as:⁹

• Further expanding the use of the Foreign Direct Product Rule, a sweeping regulation to prevent companies abroad from selling products using American components, tools, and software to Chinese chipmaking companies¹⁰
• Limiting China’s access to U.S. cloud computing services through the bipartisan Remote Access Security Act¹¹
• Further expanding the applicable scope of “deemed exports,” which restrict the transfer of technology or source code to foreign nationals who are in the United States¹²

Beyond these measures, the coming months and years will very likely bring even more expansions of semiconductor export controls—encompassing new product categories and further tightening existing restrictions. These expansions will likely be based on sound national security reasoning. However, the United States’ fundamental approach to semiconductor export controls has flaws.

First, the controls are hard to enforce. Smuggling of controlled technology typically starts with a legitimate shipment to an approved buyer, after which the items enter a complex network of transactions, eventually leading to re-export to a prohibited end user or country. For example, in one reported smuggling case of 2,400 AI chips, the smuggler set up a shell company in Malaysia, ordered the chips from a reseller, and installed them in a local data center to fool inspectors before shipping them to China.¹³ The enforcement process for catching such cases relies on the Entity List, an official roster of blacklisted organizations maintained by the Bureau of Industry and Security (BIS) within the U.S. Department of Commerce. Exporters use the Entity List to determine U.S. government–approved foreign purchasers. However, evading this process is straightforward for actors who are comfortable with breaking the law; shell companies can typically be set up online for a few thousand dollars in a matter of hours or days, whereas it can take years of investigation to uncover a shell company’s illicit activities and add them to the list.¹⁴

Second, the controls are hard to target. Because chip exporters and Commerce Department officials currently have no reliable means of understanding who is in possession of AI chips after they have been exported, or how they are being used, the controls are applied in a blanket fashion. Licensing requirements apply to all shipments of AI chips above certain performance levels if they contain American components or were built with American tooling or software. This creates administrative burden for companies and the BIS while incentivizing foreign firms to remove American firms from their supply chains, hurting the United States’ longer-term supply chain leverage. It also results in an ecosystem where many benign users of American AI chips are captured by the controls. Compounding these issues, because AI chips and AI algorithms are improving rapidly, the quantity and quality of AI hardware required to develop a model with a particular set of concerning capabilities is decreasing rapidly.¹⁵ This means that to fulfill their goals of restricting access to specific capabilities, AI export controls must grow in scope over time, becoming ever more burdensome to U.S. firms.

Furthermore, even if U.S. export control policy is effective at its longer-term goals, there remains the broader challenge of AI governance: how to ensure that increasingly capable AI systems are not used to cause great harm. Advanced AI models at the frontier of AI research and development acquire new capabilities in ways that are difficult to predict. This complicates efforts to make them reliably safe even as they proliferate rapidly to illicit actors.¹⁶ Wide, unchecked availability of advanced AI models could destabilize international relations, for instance, by lowering the barrier for nonstate actors to wield them for malicious purposes.¹⁷ Adequately mitigating these risks could require a privacy-infringing system of monitoring and regulation that would create barriers to benign actors using AI systems to solve important societal problems.

Leaders in government and industry, however, do not have to settle for blanket export controls on the one hand, or privacy-invading oversight regimes on the other. A third path is possible: mechanisms leveraging modern hardware security technologies, built into data center AI hardware, could meet specific security and governance objectives in a targeted fashion without meaningfully compromising user privacy or security. A previous report from the Center for a New American Security provided a detailed analysis of policy opportunities and technical challenges for implementing such mechanisms.¹⁸ This working paper summarizes this previous work and outlines a set of recommendations for policymakers seeking to mature hardware-enabled mechanisms (HEMs) into a useful governance tool.

Hardware-Enabled Mechanisms

The problems described here are partly the result of narrow policy options bounded by the existing technologies on today’s AI hardware. Washington’s decision to impose a blanket export ban on advanced AI chips to China reflects the reality that there is currently no widely deployed technical solution to prevent an unauthorized actor from using an AI chip once it has been exported. One promising category of solutions is hardware-enabled mechanisms: secure components embedded in AI chips or related hardware to assist with AI governance policies, such as usage restrictions and compliance verification.¹⁹ HEMs are already widely used in defense products, but also in commercial contexts: On Apple’s iPhone, HEMs ensure that unauthorized applications cannot be installed.²⁰ Google uses an HEM-based solution to remotely verify that chips running in their data centers have not been compromised.²¹ Many video games use a hardware device called a trusted platform module as an HEM-based approach to prevent in-game cheating.²² In the commercial AI space, HEMs are used to distribute training between different users while preserving privacy of code and data.²³

Well-designed HEMs could allow for better enforcement of export controls (such as through country-level location verification for exported chips) and for more targeted approaches to controls (such as through enforced limitations on particular use cases, like large-scale training), helping to reduce commercial impacts on U.S. firms. They could also enable privacy-preserving, hardware-based reporting of the properties of AI systems (such as the quantity of compute consumed or the type of training data used), which would allow AI developers and users to rapidly and securely verify compliance with regulations without needing to directly reveal sensitive code or data or spend large amounts of time on manual reporting and verification requirements.

The U.S. government has already signaled that chips with better security and governance features could become exempt from expanded export restrictions. As part of its October 2023 updated export controls on advanced AI chips, the BIS issued a request for comment, noting that it “seeks additional proposals for exemptions involving hardware-based technical solutions that create the ability to limit training of large dual-use AI foundation models with capabilities of concern,” adding that “such items could then be exempted from these ECCNs [Export Control Classification Numbers].”²⁴ U.S. lawmakers have also expressed interest in creating incentives for chip firms to develop secure HEMs.²⁵

HEMs encompass many possible ideas and designs—some valuable, some ill-advised. Here, the authors offer a primer for U.S. policymakers about the promises and pitfalls of adopting HEMs for AI security and governance.

Challenges and Opportunities

Well-designed HEMs could:

• Help detect and deter AI chip smuggling into China²⁶
• Allow more surgical applications of export restrictions, reducing the risk of a de-Americanization of chip supply chains²⁷
• Help enforce current regulations, such as the reporting requirements in Executive Order 14110, and verify compliance with future international agreements²⁸
• Create privacy-preserving, trustworthy, and commercially viable solutions to governance and security issues²⁹

The table below provides an overview of three specific HEMs. See the appendix for a more extensive overview.

Examples of HEMs and Relevant Policy Objectives

When seeking to promote the implementation of HEMs, U.S. policymakers should keep in mind several key principles:

Although HEMs are common in computing systems for defense, consumer electronics, and the financial industry, they remain underexplored in the context of high-performance AI hardware. The optimal implementation of HEMs into data center AI hardware will be through designs that are secure and preserve user privacy and performance. HEMs cover a broad design space with both commercially desirable and undesirable traits. For example, the Apple Secure Enclave security module (found on iPhones and MacBooks) is a highly reliable HEM that prioritizes customer security and privacy.³⁴ This module ensures that only legitimate firmware and operating systems can be used on a device, which in turn helps deter theft and prevent unauthorized applications from being installed. On the other hand, the National Security Agency’s infamous Clipper chip carried severe privacy and security vulnerabilities. While purportedly designed to increase security, the device contained a built-in back door that allowed government officials to access private data.³⁵

Some of the functionality to support privacy-preserving HEMs is already widely deployed on existing AI chips. This technology could be further developed to form the technical foundation for reliable hardware-based governance. Chips sold by leading firms such as Advanced Micro Devices (AMD), Apple, Intel, and NVIDIA have many of the features needed to support policies for restriction and verification. These features are used today in a wide variety of applications. Some firms offer “operating licenses” that allow remote deactivation of certain chip features.³⁶ Others use HEMs to ensure that only approved software has been loaded, or to remotely verify that a chip has not been compromised.³⁷

Good HEM design could proactively mitigate trade-offs between national security objectives, performance, and privacy. Despite the checkered history of government-imposed mechanisms on hardware, well-designed HEMs do not require secret monitoring of users or insecure “back doors.” For instance, HEM designs based on security features such as trusted execution environments (TEEs) could enable an external party to verify how the chip is being used without enabling secret surveillance or intellectual property (IP) theft.

Existing HEM technologies must be significantly hardened to defend against well-resourced attackers. Commercial HEMs are not typically designed to defend against a well-resourced attacker with physical access to the hardware. Government and industry investments in hardware and software security will be required for HEMs to function reliably despite physical attacks. The specific defenses required to adequately secure on-chip governance mechanisms depend on the context in which they are deployed.³⁸

HEM R&D will help AI security more broadly. Leading AI developers have expressed a need for higher security standards in areas such as physical security and confidential computing. While the main goal of AI developers is to protect their models and algorithms, research into these areas is also directly relevant for privacy-preserving HEMs, as much of the threat model is the same.³⁹ This means that fundamental research into HEM security can both help make HEMs more robust and trustworthy, even when chips are in the hands of motivated and well-resourced adversaries, as well as increase the security of U.S. AI labs, securing them against AI model weight theft.⁴⁰

Recommendations for Policymakers

HEMs constitute a broad design space with proposals varying in security, cost, ease of implementation, and commercial desirability. U.S. policymakers should focus on identifying promising HEMs that are implementable immediately (such as country-level location verification) while promoting R&D investment to further explore and develop viable and trustworthy HEMs for higher-stakes applications. Without prior research and testing, rushed implementations of HEMs may present acute trade-offs between security and usability.⁴¹

Given their technical knowledge and access to both talent and the core technology, leading U.S. chip firms such as NVIDIA, Intel, and AMD are uniquely positioned to conduct this research. The authors recommend that the U.S. government incentivize and support U.S. chipmakers to accelerate the development and adoption of HEMs.⁴² Government-funded research will play a useful complementary role to industry efforts through focusing on high-risk, high-reward R&D that could minimize trade-offs between national security objectives, performance, and privacy and by leveraging the U.S. intelligence community’s expertise in defending against sophisticated attacks on hardware.

Recommendation 1: Accelerate HEM and hardware security R&D through direct funding and public-private partnerships.

The National Semiconductor Technology Center (NSTC), relevant Defense Advanced Research Projects Agency (DARPA) projects, the Department of Defense’s Microelectronics Commons (the Commons), and the National Institute of Standards and Technology (NIST) could serve as key funders and facilitators of public-private coordination to advance HEM development.⁴³

• DARPA could conduct HEM R&D as high-risk, high-reward projects in the early stages of development. DARPA’s Next-Generation Microelectronics Manufacturing or System Security Integration Through Hardware and Firmware projects are particularly relevant, though DARPA could consider launching new projects specific to HEM development.⁴⁴
• The NSTC should (1) leverage its whole-of-government approach to coordinate between leading chipmakers, the Commons, NIST, and the CHIPS Program Office; and (2) support HEM technologies emerging from the Commons until they are reliable and viable enough to be taken up by the Manufacturing USA network or private industry.⁴⁵ Specifically, Natcast (the nonprofit that operates the NSTC consortium) should announce an HEM program and a corresponding call for proposals, similar to the Artificial Intelligence Driven Radio Frequency Integrated Circuit Design Enablement and Test Vehicle Innovation Pipeline programs.⁴⁶ This could take the form of an HEM “grand challenge” to develop secure HEMs, including the requisite hardware security, or more targeted programs to develop HEMs for location verification or offline licensing.
• The Commons is especially well-suited for early HEM prototyping, given its defense-specific priorities and focus on bridging the high-risk “lab-to-fab” transition.⁴⁷ The development of HEMs aligns with three of the Commons’ key technical areas: secure edge computing, AI hardware, and commercial leap-ahead technologies.
• To scope and support R&D beyond leading chip companies for later integration, NIST should increase coordination with relevant industry and government funding bodies.⁴⁸ For example:
  • The National Advanced Packaging Manufacturing Program could spearhead the creation of tamper-proof encasing (see the appendix).⁴⁹
  • The Cybersecurity and Infrastructure Security Agency should explore bug bounty incentives and red teaming to identify and patch vulnerabilities in current and future AI chips to make HEMs highly tamper resistant.
  • International collaboration—for example, with the United Kingdom’s Advanced Research and Invention Agency—could also accelerate HEM R&D and vulnerability discovery in existing and future chips.

Recommendation 2: Create commercial incentives through conditional export licensing.

The Department of Commerce should incentivize and derisk industry HEM R&D by defining the set of hardware security and governance measures that would prevent new restrictions from applying to exports.⁵⁰ U.S. policymakers are continuously expanding export controls, but have signaled the possibility of excluding chips with HEMs that restrict their misuse potential.⁵¹ U.S. lawmakers have also expressed interest in HEMs for export control purposes.⁵² To facilitate and incentivize the gradual implementation of HEMs, the Commerce Department could create flexible export licensing regimes, such that export licenses can be granted for different geographies or end users depending on the security features and HEMs of specific chips. For example, the Commerce Department could specify that chips with secure location verification require a license with presumption of approval to sell to the United Arab Emirates, Vietnam, and other countries of concern (as is currently the case), and a license with presumption of denial for chips lacking location verification capabilities. Location verification could show whether the country or specific actors within it facilitate smuggling into China, in which case targeted export bans and sanctions could be applied. This scheme could later be extended with HEMs like tamper-resistant offline licensing and bandwidth bottlenecking, which could be used to reduce the value of the smuggled chips.

Recommendation 3: Further develop AI hardware security standards to incentivize and harmonize security features across industry.

Technical standards play an important role as a common foundation for HEM development and usage. NIST already has security standards for computer hardware, most notably Federal Information Processing Standard (FIPS) 140-3, which defines four increasing levels of security for secure processors, intended to cover many applications and environments with security requirements in areas such as physical security, resistance to side-channel attacks, and software/firmware security.⁵³ Industry consortia are also active in defining security requirements for data center hardware. The Open Compute Project, whose membership includes almost every large semiconductor and computing firm, runs several standardization projects, including the Security Appraisal Framework and Enablement (S.A.F.E.) Program, which seeks to standardize security processes and interfaces across the data center technology stack, and Caliptra, which is an open-source specification for hardware-level protection for chips.⁵⁴ NIST, in collaboration with industry, should collate existing standards and identify and address gaps when applying them to HEMs in different operating environments.⁵⁵ This would provide a common reference point to use in regulation and to harmonize security features across industry.

Appendix: Hardware Security and HEM Proposals

The development of secure, reliable, and privacy-preserving hardware-enabled mechanisms (HEMs) relies on the implementation of key hardware security features on chips and associated hardware.⁵⁶ This appendix provides a list of these security features and the HEMs they would enable.

Relevant hardware security features include:

• Security modules: These dedicated processors on chips are responsible for basic security-related functions, such as ensuring that the chip is running uncompromised and up-to-date firmware. This feature allows security vulnerabilities in HEMs to be patched remotely via updates and ensures that chips aren’t running compromised software.⁵⁷ NVIDIA’s latest data center graphics processing units (GPUs) already include similar features (firmware verification and rollback protection), although this is likely not robust against adversaries with physical access to the chips.⁵⁸
• Trusted execution environments (TEEs): These secure regions of the main processor of a device protect the confidentiality and integrity of data while they are being processed. In the context of HEMs, TEEs can prevent spoofing (falsifying the data being transmitted from a chip) and allow the owner of a chip to make trustworthy, verifiable claims to another party.⁵⁹ NVIDIA has already implemented chip-level TEEs into their H100 and upcoming Blackwell series GPUs to enable confidential computing (using hardware-level technologies to isolate data being processed), as have other leading U.S. chipmakers.⁶⁰ Extending chip-level TEEs to the cluster level and protecting them with much greater security (including tamper protection) are two promising directions to both enhance end-user privacy and security, and enable TEEs to be used to support governance objectives, such as making a verifiable claim to a third party about the firmware running on the chip, or the amount of computation consumed by a workload.⁶¹
• Tamper-resistant enclosures: Physical housing for chips and/or servers can present useful obstacles to physical attacks. Tamper-resistant and tamper-respondent enclosures can curtail and detect attempts to physically disable security hardware, interfere with chip operation, or steal data such as cryptographic keys. Tamper-resistant enclosures don’t need to be completely tamper-proof to be useful. Enclosures can still act as strong deterrents if the tampering is expensive enough or risks the destruction of the chip.⁶² The tamper resistance of chip security features will be a crucial consideration for U.S. government officials when deciding whether chips with HEMs may be exempt from certain blanket export restrictions (e.g., expansions of harsher export restrictions to new countries like Vietnam, Singapore, or the United Arab Emirates) or appropriate for sale to untrusted or semitrusted buyers.
• Other hardware security measures: Leading chipmakers already try to protect end-user intellectual property (IP) by incorporating confidential computing (CC) capabilities enabled by TEEs into their chips.⁶³ However, current implementations, such as in current state-of-the-art NVIDIA H100 GPUs, cannot protect against attacks by adversaries with physical access to the AI chips (including insider threats at U.S. AI labs or data centers and foreign adversaries in possession of smuggled chips).⁶⁴ To address this, chips could be hardened to protect against side-channel attacks, as well as more invasive tampering using enclosures or other measures.⁶⁵ Chipmakers could also further protect AI labs’ model weights by limiting the bandwidth of communications between devices that hold AI model weights and the outside world.⁶⁶ The precise technical path to achieving greater security will require further public-private coordination.

Relevant HEMs include:

• Location verification: “Delay-based” location verification is a specific type of geolocation that is both highly privacy-preserving and hard to circumvent by design.⁶⁷ It could be implemented to detect and deter AI chip smuggling, while not revealing any sensitive or precise location data from legitimate end users. This technique involves placing secure landmark servers in key positions around the globe, which would send and receive “pings” to exported AI chips to calculate the maximum possible distance between the chips and the servers (see an example in the endnote).⁶⁸ The core functionality for this could already be available in NVIDIA’s early-access device attestation application programming interface for H100 GPUs, which helps applications verify that a device has not been compromised.⁶⁹ Researchers have estimated that pure-software delay-based location verification could be implemented with less than $1 million of investment, adding that this implementation “seems both feasible and relatively cheap.”⁷⁰
• Bandwidth bottlenecking: This HEM would limit high-bandwidth communication to a certain number of devices. (This HEM has also been called “fixed set”.)⁷¹ This would enable the use of high-end chips for most applications but limit their use in the large supercomputing clusters needed to execute large-scale AI training runs. This may enable the sale of high-end chips to semitrusted buyers for non-dual-use applications; for example, by preventing blanket export restrictions from spreading to countries like Vietnam and the United Arab Emirates.
• Offline licensing: AI chips with this HEM would require an active license to operate. This license could either be time-based or meter-based, where the license is “used up” as the chips perform operations (see “metering” below).⁷² This does not imply an at-will remote shutdown capability, nor do the authors advocate for one.⁷³ Creating licenses could require the agreement of multiple parties, including both governments and companies.⁷⁴ Combined with a form of verification to underly the licensing decision (e.g., location verification), offline licensing, if implemented well, could allow chips to be sold to countries with an otherwise high risk of illegal re-export with greatly reduced chance of those chips being smuggled and misused. Without such an assurance mechanism in place, countries where smuggling has been found to occur may be next in line for stricter export restrictions.⁷⁵
• Metering: This HEM would measure elapsed real time, arithmetic operations, power consumption, data transfer to memory, and other data to enable privacy-preserving workload classification. This could more easily enable cloud compute providers and regulators to know if end users are executing large AI training runs and if these exceed compute thresholds (for example, the thresholds in Executive Order 14110).⁷⁶ If the meter values are robust to tampering and available to the chip’s TEE, end users could make verifiable claims about high-level properties of their workload to external verifiers or regulators without revealing other sensitive data, enabling privacy-preserving oversight of sensitive applications like large AI training runs. Much of the hardware functionality for metering is already in place in high-end AI chips.⁷⁷ Tamper-resistant metering would also allow for more robust delay-based location verification and offline licensing.
• Robust product differentiation: This is not a specific HEM but a family of related HEMs and hardware security features used to create clear distinctions between different categories of products in order to more neatly separate out national security–relevant products from other kinds of products. For example, tamper-resistant bandwidth bottlenecking on consumer-grade GPUs would allow clear differentiation between GPUs used for gaming and GPUs used for data center AI applications, thus permitting the unimpeded export of GPUs for uses such as gaming while continuing to regulate dual-use applications, like large-scale AI training runs.

The CNAS Technology and National Security Program produces cutting-edge research and recommendations to help U.S. and allied policymakers responsibly win and manage the great power competition with China over critical and emerging technologies. The escalating U.S.-China competition in artificial intelligence (AI), biotechnologies, next-generation information and communications technologies, digital infrastructure, and quantum information sciences will have far-reaching implications for U.S. foreign policy and national and economic security. The Technology and National Security Program focuses on high-impact technology areas with in-depth, evidence-based analysis to assess U.S. leadership vis-à-vis China, anticipate technology-related risks to security and democratic values, and outline bold but actionable steps for policymakers to lead the way in responsible technology development, adoption, and governance. A key focus of the Tech Program is to bring together the technology and policy communities to better understand these challenges and together develop solutions.

Acknowledgments

This report would not have been possible without invaluable contributions from our CNAS colleagues, including Maura McCarthy and Emma Swislow. The authors also thank Paul Scharre, Onni Aarne, Jamie Bernardi, Christian Chung, Christopher Covino, Oscar Delaney, Erich Grunewald, Lennart Heim, Gabriel Kulp, Sumaya Nur Adan, Joe O’Brien, Aidan O’Gara, and Caleb Withers for their invaluable feedback during the research for and writing of this working paper. Tao Burga’s work on this piece was conducted as part of the Institute for AI Policy & Strategy (IAPS) fellowship. This report was made possible with the generous support of Fathom and DALHAP Investments Ltd (via The RAND Corporation). The views expressed in this document are those of the authors and do not necessarily reflect RAND opinion.

As a research and policy institution committed to the highest standards of organizational, intellectual, and personal integrity, CNAS maintains strict intellectual independence and sole editorial direction and control over its ideas, projects, publications, events, and other research activities. CNAS does not take institutional positions on policy issues and the content of CNAS publications reflects the views of their authors alone. In keeping with its mission and values, CNAS does not engage in lobbying activity and complies fully with all applicable federal, state, and local laws. CNAS will not engage in any representational activities or advocacy on behalf of any entities or interests and, to the extent that the Center accepts funding from non-U.S. sources, its activities will be limited to bona fide scholastic, academic, and research-related activities, consistent with applicable federal law. The Center publicly acknowledges on its website annually all donors who contribute.