Semiconductor Export Controls: The Chip War's Cybersecurity Dimension

The Architecture of Denial

In October 2022, the US Bureau of Industry and Security (BIS) issued the most sweeping semiconductor export controls since the Cold War. The regulations restricted China's access to advanced computing chips, the equipment needed to manufacture them, and the US-person expertise required to operate that equipment. Subsequent updates in October 2023 and 2024 closed loopholes, expanded entity lists, and pressured allies — the Netherlands, Japan, and South Korea — to implement complementary restrictions.

The policy objective is explicit: deny China access to the computational resources needed to develop advanced artificial intelligence capabilities with military and intelligence applications. The controls target a specific chokepoint: extreme ultraviolet (EUV) lithography, manufactured exclusively by Dutch firm ASML, is required for chips below 7nm. Without EUV access, Chinese foundries are constrained to older process nodes — capable but not cutting-edge.

China's Parallel Ecosystem

Export controls have not halted Chinese semiconductor development — they have redirected it. China's response has been massive investment in indigenous capabilities across the entire semiconductor value chain. The results, while not matching TSMC's leading edge, are producing functional alternatives at mature nodes that are increasingly appearing in commercial and industrial equipment.

Huawei's Mate 60 Pro smartphone, launched in August 2023, contained a SMIC-fabricated 7nm chip — demonstrating that Chinese manufacturers could achieve this node without EUV (through multi-patterning with older DUV lithography, at significantly lower yield). The Kirin 9010, which followed in 2024, showed further refinement. While these achievements don't match Apple's 3nm designs, they demonstrate a trajectory of accelerating indigenous capability.

The Trust Problem

For cybersecurity professionals, the emergence of a parallel Chinese semiconductor ecosystem creates a novel trust challenge. Chips manufactured in Chinese foundries are appearing in commercial equipment sold globally — routers, IoT devices, industrial controllers, telecommunications infrastructure. The question is not whether these chips perform their stated function (they do) but whether they perform only their stated function.

Hardware-level backdoors are extraordinarily difficult to detect. Unlike software, which can be decompiled and analyzed, a silicon backdoor can be as small as a few dozen transistors among billions — invisible to X-ray inspection and undetectable through functional testing that examines only expected behavior. The resources required for thorough hardware verification (destructive die analysis, formal verification against design specifications) are prohibitive at commercial scale.

“We spent 30 years building a globalized semiconductor supply chain optimized for efficiency. We are now discovering that efficiency and security were in tension the entire time — we just never had to choose before.”

— Chris Miller, author of Chip War, speaking at Aspen Security Forum 2025

The Taiwan Variable

No discussion of semiconductor geopolitics is complete without addressing the Taiwan Semiconductor Manufacturing Company (TSMC), which fabricates approximately 92% of the world's most advanced chips. A military conflict involving Taiwan — however unlikely in the near term — would constitute the most severe supply chain disruption in modern economic history, simultaneously affecting every major technology company, every military system, and every piece of advanced infrastructure globally.

The cybersecurity implications of a Taiwan contingency extend beyond supply disruption. TSMC fabricates chips for both Western and Chinese customers — a position that creates information access to both sides' design intellectual property. The factory-level data from advanced chip manufacturing (design files, test results, yield data) constitutes some of the most sensitive technical intelligence in existence.

TSMC's role as fabricator for both US weapons systems and Chinese commercial technology makes it a unique intelligence target. The integrity of its manufacturing systems — from design submission to finished wafer — is a matter of national security for every advanced economy.

Implications for Defenders

The semiconductor export control regime creates several operational considerations for security teams:

• Hardware provenance tracking: As chip sources diversify, organizations need visibility into the semiconductor supply chain of their equipment — not just the brand on the box, but the foundry that fabricated the silicon

• AI capability asymmetries: Export controls that successfully constrain Chinese AI development may create defensive advantages — or may simply redirect Chinese AI investment toward efficiency optimizations that extract more capability from available hardware

• Vulnerability research fragmentation: As hardware ecosystems diverge, vulnerability researchers will have less access to Chinese-manufactured chips, reducing the community's ability to identify and disclose hardware-level security issues

• Sanctions compliance: Security tools and services that operate globally must navigate export control regimes that restrict the transfer of certain cybersecurity capabilities alongside semiconductor technology

The Long Game

Export controls are a time-buying strategy, not a permanent solution. They create a window during which China's advanced AI capabilities are constrained — but China's investment in indigenous alternatives ensures that window is finite. The relevant question for policymakers is not whether China will achieve semiconductor self-sufficiency, but how long the gap persists and what strategic advantage can be built during that period.

For the cybersecurity community, the chip war's legacy will be a permanently bifurcated hardware ecosystem — two supply chains, two trust models, two sets of assumptions about what silicon can be trusted. Navigating this reality requires hardware security capabilities that most organizations have not yet developed, and a threat model that accounts for adversarial decisions made at the transistor level, years before a chip reaches a network.