The Day America Forgot How It Won

Within five years, I believe historians will view AI export controls the same way we now view the cryptography export controls of the 1990s: as a well-intentioned policy that fundamentally misunderstood who benefited most from the technology.

That prediction may seem provocative today. It will likely seem obvious in retrospect.

In the early years of the commercial internet, strong cryptography was treated as a strategic threat. Policymakers worried that encryption would empower criminals, terrorists, and foreign adversaries. Export controls were imposed because the technology was viewed primarily through the lens of how it could be misused. The concerns were not irrational. Encryption is a powerful capability. It can conceal communications. It can frustrate intelligence collection. It can be used by both good actors and bad ones.

What policymakers struggled to foresee was that the overwhelming beneficiaries of strong cryptography would not be criminals.

They would be everyone else.

The modern internet was built on cryptographic foundations. Online banking, e-commerce, software updates, cloud computing, digital identity, and secure communications all emerged because encryption made trust possible at global scale. Had policymakers focused exclusively on the risks, many of the technologies we now take for granted would have been delayed, weakened, or perhaps never emerged in the form we know today.

The lesson is not that the risks were imaginary. The lesson is that the future proved larger than anyone anticipated.

Governments are often asked to make decisions about technologies whose ultimate impact cannot yet be known. That is an extraordinarily difficult task. The challenge is not a lack of intelligence or good intentions. It is that bureaucracies, by necessity, evaluate risk based upon what is visible today, while technological progress is driven by possibilities that have not yet been imagined.

No government agency predicted the modern cloud computing industry when cryptography became the subject of export controls. No regulatory framework anticipated the emergence of global digital marketplaces, app ecosystems, open-source software communities, or the countless businesses built atop secure internet infrastructure. Those outcomes were discovered by entrepreneurs, engineers, researchers, and builders who found opportunities that no central authority could have forecast.

This dynamic is not a flaw in government. It is simply the reality of innovation.

The entrepreneurial process is an engine of discovery. It reveals possibilities that cannot be known in advance. It transforms tools into industries, ideas into companies, and scientific breakthroughs into entirely new forms of economic activity. The strength of the American system has never been our ability to predict the future with precision. Our strength has been our willingness to create the conditions that allow the future to emerge.

That is why recent restrictions on frontier AI systems concern me.

The argument behind many of these policies is familiar. Advanced AI systems may help identify software vulnerabilities. Therefore access should be constrained. The technology may create risks. Therefore the safest course is limitation.

As someone who has spent more than two decades in cybersecurity, I believe this reasoning captures only half of the equation.

Advanced AI can help identify vulnerabilities. It can also help eliminate them.

Every day, millions of software developers, security researchers, application security engineers, and incident responders work to make software more secure. They review code, identify weaknesses, discover vulnerabilities, develop mitigations, and strengthen systems that billions of people rely upon. Increasingly, advanced AI systems are becoming indispensable tools in that effort.

The public conversation frequently focuses on the possibility that attackers may use AI to discover vulnerabilities. Much less attention is paid to the vastly larger population of defenders who are already using these capabilities to secure software before attackers ever have the opportunity.

This distinction matters because security is not the opposite of innovation.

Security is often what enables innovation.

The internet scaled because cryptography created trust. Commercial aviation scaled because safety engineering created confidence. Modern cities grew because building standards reduced risk. Throughout history, safety and security have repeatedly served as accelerants for progress rather than obstacles to it.

I believe AI will prove no different.

The greatest impact of advanced AI on cybersecurity may not be that it helps attackers find vulnerabilities. It may be that it helps defenders eliminate them faster than ever before. Every vulnerability discovered by a security engineer is one less vulnerability available to an adversary. Every code review accelerated by AI strengthens the systems upon which modern society depends.

Yet my deepest concern is not cybersecurity. It is competitiveness.

Throughout my career, I have had the privilege of building teams composed of extraordinary people from around the world. Some came from Europe. Others came from Australia, Canada, the United Kingdom, and countless other countries. They did not relocate because of geography. They came because the United States represented the frontier. They wanted to work on the hardest problems alongside the most ambitious people in the industry.

Nobody cared where they were born when they helped stop nation-state intrusions. Nobody cared where they were born when they discovered critical vulnerabilities or protected critical infrastructure. What mattered was their ability to contribute.

For generations, this has been one of America’s greatest strengths.

Following the Second World War, the United States became the center of scientific and technological progress not by isolating itself from global talent, but by attracting it. We built universities, laboratories, research institutions, and companies that drew the world’s best minds. We concentrated talent. We accelerated discovery. We created ecosystems where breakthroughs became industries.

The lesson of the Space Race was not that knowledge should be contained. The lesson was that talent should be attracted.

Today, artificial intelligence is advancing at a pace unlike anything I have witnessed during my career. The frontier moves in months, sometimes weeks. Under these conditions, leadership cannot be preserved through restriction alone. Leadership depends upon attracting the best researchers, empowering them to do their best work, and creating an environment where innovation compounds.

Researchers can move. Capital can move. Innovation can move.

History suggests that if the frontier shifts elsewhere, talented people will follow it.

The capabilities underlying artificial intelligence will not remain confined to a single country. The mathematics will spread. The research will spread. The talent will spread. The only question is where the most ambitious people in the world choose to build.

For more than half a century, the answer to that question has overwhelmingly been the United States.

That outcome was not inevitable. It was earned.

America’s greatest strategic asset has never been our ability to predict the future. It has been our ability to build it.

At this moment, as artificial intelligence begins to reshape the global economy, we should remember the lesson that cryptography taught us a generation ago. Technologies are often judged by who might misuse them. History ultimately judges them by who benefits from them.

My fear is that we are once again underestimating the builders.