Chip location verification is the new export control battleground
The Chip Security Act proposes a way to tackle chip smuggling. Semiconductor companies don’t seem to like it.
“There’s no evidence of any AI chip diversion,” Nvidia CEO Jensen Huang said earlier this year on a trip to Taiwan, seeking to quash rumors that Chinese companies were smuggling advanced AI chips in an effort to get around US export controls.
All the evidence in fact suggests that Huang is wrong. The global pursuit of advanced semiconductors — and their designation as a strategically important resource — has ignited a shadow economy worth billions, where many of Nvidia’s top chips find their way abroad through elaborate smuggling networks.
At a market in Shenzhen, vendors openly sell controlled Nvidia H100 chips, according to the New York Times. Authorities in Singapore recently charged three men with fraud, reportedly due to evidence that chips were being smuggled from the country to DeepSeek in China. And a recent Financial Times investigation found that in just three months, Nvidia chips worth $1b secretly made their way to China after a brief stop in Southeast Asian ports. Investigations have concluded that chip smuggling typically occurs in transit on established trade routes, which mask the true destination of restricted semiconductors.
According to Erich Grunewald, a researcher in compute governance at the Institute for AI Policy and Strategy (IAPS), the level of coordination involved is significant. “Smuggling usually involves re-export from a shell company or distributor in Malaysia or some other third country where GPUs were legally imported,” Grunewald explains to Transformer. The chips “are then relabeled and shipped to China,” as the shell companies simply disappear.
The scale can vary dramatically. “This can be small quantities, just a handful of GPUs, but it can also be large shipments of 10,000 GPUs that go right into a data center rack,” Grunewald notes. Sam Winter-Levy, a fellow at the Carnegie Endowment for International Peace, emphasises the persistent nature of the illicit trade: “Chip smuggling continues to be a serious problem,” he tells Transformer.
Catching such smuggling attempts is tricky, involving monitoring a complex trail through a supply chain that spans many different countries and companies. Given the extremely constrained resources of the Bureau of Industry and Security (BIS), the department tasked with enforcing export controls, cracking down on smuggling has proved almost impossible.
Location verification
Enter “location verification” — a solution to chip smuggling proposed in the Chip Security Act (CSA). Among other measures, the bill calls for geolocation tracking of GPUs to ensure American chips do not end up in unauthorised regions. The Act was introduced in May by Senate Intelligence Chairman Tom Cotton, with a corresponding bill introduced in the House by Reps. Bill Huizenga, Bill Foster, and a range of other prominent congresspeople from both parties, including Rep. John Moolenaar, chairman of the House Select Committee on the Chinese Communist Party (CCP). It received a boost in July, when the White House AI Action Plan called for the government to “explore leveraging new and existing location verification features on advanced AI compute to ensure that the chips are not in countries of concern.”
The CSA does not specify exactly how manufacturers should track their chips. One popular method, delay-based location verification, employs a “feature that modern GPUs have which allows them to cryptographically attest to their identity,” Grunewald says. The technology has already been used for commercial applications and successfully demoed for AI security purposes with Nvidia’s H100 chips.
The strategy, as Grunewald describes it, relies on trusted “landmark servers”. Say a chip is supposed to be in Malaysia. A server at a known location sends a signal to the chip, which responds with its authenticated identity. By measuring the delay in how long that “ping” takes to be returned based on the speed of light, officials “can rule out that the chip is further away” than its intended buyer, says Grunewald.
It sounds a lot like GPS technology, but those signals are not strong enough to bypass the walls of data centers, and GPS can also be easily spoofed. Meanwhile, the hardware-enabled mechanism (HEM) of delay-based tracking does not reveal exact locations, and would keep data processed by the chips from being exposed.
Not so fast
Nvidia says its GPUs can already gather this telemetry data, and research by Grunewald’s colleagues suggests the firmware update required might cost less than a million dollars to roll out. Despite this, Nvidia has resisted endorsing the CSA. (The company did not respond to a request for comment for this article.)
The export tracking legislation appears to have fueled concerns from Chinese authorities, who recently raised questions about the security of Nvidia’s microprocessors. In response, the company released a statement saying its chips contain no “kill switches” or encrypted backdoors, and explaining why, in its view, both are bad ideas for GPUs. But delay-based location tracking requires neither of these features, and nor does the CSA. To Nvidia, worries about technical backdoors and semiconductor tracking more generally are the same problem: a lack of trust from overseas customers, which could threaten its market share.
Nvidia (and the Chinese government) aren’t alone in their opposition to measures such as location verification contained in the CSA. In July, industry bodies including the Semiconductor Industry Association and the TechNet wrote to the House Foreign Affairs Committee urging it to reconsider the act’s “burdensome” tracking requirements. Their letter called for a “comprehensive technical feasibility and standardization review process” before introducing legislation they said could “come at too great a cost and without achieving its stated goals.”
Another argument against the CSA is that the measures risk creating a self-defeating prophecy. The administration wants to cement global reliance on American AI infrastructure, yet a mandate for surveillance features could trigger an international exodus from US technology. If foreign governments view tracked chips as dubious, technical safeguards become superfluous. An insistence on chip oversight in the US could allow Chinese competitors such as Huawei to become the more viable option, though so far they remain far behind their US counterparts in terms of quality and scale.
In terms of practical hurdles, the CSA has an implementation timeline of 180 days after enactment. Some have argued this timeline is unrealistic given that major chip architectural changes typically require 2-3 years. But according to James Petrie, a compute security expert at the Future of Life Institute, Nvidia’s own documentation reveals the encryption key to enable location tracking is already embedded directly into the processors themselves. It is unclear how long a systematic implementation of these dormant tracking features would take in practice, one estimate by IAPS suggests it could take as little as six months. (Disclosure: FLI is a donor to the Tarbell Center for AI Journalism, Transformer’s publisher.)
And if the firmware update were implemented, trusted verification landmarks would need to be established near major global data centers. IAPS estimates this would require 100-500 new servers priced at roughly $25,000 annually each. However, the demo run on H100 chips used servers provided by Google Cloud Run, which suggests landmarks could be arranged using existing infrastructure, saving both time and money.
Most crucially, though, “The location verification strategy only makes sense as a policy lever in a context where the U.S. government cares about restricting China’s chip access,” Winter-Levy argues. “That context may not exist for much longer.”
The future of smuggling
As Chris Miller, the author of Chip War: The Fight for the World’s Most Critical Technology, told Transformer, “there’s been a shift in White House policy toward prioritising US chip firms’ market share.” The shift in thinking has been borne out by policy decisions such as relaxing export controls on certain Nvidia chips — a move which will likely reduce demand for smuggled ones.
At the same time, China is increasing efforts to improve its own chip manufacturing, with reported efforts to triple AI chip production next year. Paired with the recent momentum of Cambricon, a Chinese AI chip designer, China is evidently trying to become less reliant on foreign chips in the future, smuggled or otherwise.
But these are unlikely to end smuggling demand altogether. Miller observes that “Nvidia’s newest Blackwell chips are still banned for sale and still far better than anything that China can produce domestically”. Even the rumored Nvidia B30A, while better than anything currently available in China, will still only offer about half the performance of the flagship B300. And given the huge demands for compute in the country, alongside China’s constrained manufacturing capacity, demand for smuggled chips is likely to continue.
Right now, the competitive advantage still favours the US. Keeping it that way will likely require more commitment to export controls than the Trump administration has shown so far. It will also need tools such as location verification to stop smugglers making a mockery of the entire system. Both will take political will that has so far been lacking.
 | A guest post by
|