AI and National Security

Learning Objectives

By the end of this lecture, you will be able to: (1) apply DOD Directive 3000.09 (Autonomy in Weapon Systems, updated January 25, 2023) principles on weapons with autonomous or semi-autonomous features, including the requirement for appropriate levels of human judgment; (2) read National Security Memorandum 25 (NSM-25) on national security AI (October 24, 2024) and its Framework for the Use of AI as a Tool of National Security; (3) apply Executive Order 14110 Section 11 exceptions for national security AI and Section 4 dual-use foundation model provisions; (4) understand the Chief Digital and AI Office (CDAO) structure created in 2022, the former Joint AI Center (JAIC) history, and DARPA AI Next program; (5) operate within the Intelligence Community's AI Ethics Framework and AI Ethics Principles (ODNI 2020, updated 2023); (6) interpret the National Security Commission on Artificial Intelligence (NSCAI) Final Report recommendations (March 2021); (7) apply export controls relevant to AI, the Export Administration Regulations under 15 CFR Parts 730-774, including the October 2022 and October 2023 advanced computing and semiconductor controls, and the January 2024 Diffusion controls; the International Traffic in Arms Regulations at 22 CFR Parts 120-130, with Bureau of Industry and Security coordination; (8) respect classification under EO 13526 and the Controlled Unclassified Information framework; and (9) understand the intersection of NIST AI RMF, OMB M-24-10, and national security practice, including CNSS Policy 25 and CNSSI 1253 controls for national security systems.

Key Topics Covered

Topic 1: DOD Directive 3000.09 - Autonomy in Weapon Systems. Updated January 25, 2023. Requires weapons with autonomous or semi-autonomous features to allow commanders and operators to exercise appropriate levels of human judgment over the use of force. Establishes the senior review process for systems employing autonomous lethal force.

Topic 2: National Security Memorandum 25 (October 24, 2024) and the 'Framework to Advance AI Governance and Risk Management in National Security.' Companion to EO 14110 and OMB M-24-10 but for national security systems.

Topic 3: EO 14110 Section 11 exceptions and Section 4 dual-use foundation model provisions. Section 11 allows appropriate national security alternatives to public transparency obligations, with ODNI and other national security agency leadership involvement. Section 4 addresses dual-use foundation models with 10^26 FLOPS and related criteria.

Topic 4: The CDAO structure. Established February 1, 2022. Consolidated the former JAIC, the Chief Data Officer, and the Defense Digital Service. Leads DOD AI governance, including Test and Evaluation (T&E) for AI systems.

Topic 5: Intelligence Community AI. The ODNI AI Ethics Framework and AI Ethics Principles. ODNI's Principles of AI Ethics for the IC. NGA, NSA, CIA, and DIA internal AI programs. The IC IG oversight role.

Topic 6: The NSCAI Final Report (March 2021). 16 chapters on organization, workforce, technical, and policy recommendations. Driver of much subsequent federal AI policy.

Topic 7: Export controls and AI. EAR October 7, 2022 controls on advanced computing items to China. October 17, 2023 expansion. January 13, 2025 Diffusion controls creating the three-tier country framework. The Commerce Bureau of Industry and Security enforcement. State Department ITAR for defense articles. Coordination with Treasury OFAC.

Topic 8: National security systems AI governance. CNSS Policy 25 and CNSSI 1253 security controls. Classified AI systems practices. The Special Access Program framework.

Topic 9: International security and AI. The Political Declaration on Responsible Military Use of AI and Autonomy (February 2023, updated November 2023). The UN Group of Governmental Experts on LAWS process. Bilateral consultations including US-UK AI and US-China managing-risks dialogue.

Why This Matters for Government

National security is the category of government activity where the stakes are the highest, the transparency constraints are the tightest, and the oversight mechanisms are the most specialized. AI in national security, from DOD weapons to intelligence analysis to homeland security, is governed by a framework that parallels but does not duplicate the civilian federal AI framework under OMB M-24-10.

The central document is DOD Directive 3000.09, Autonomy in Weapon Systems, last substantially updated January 25, 2023. The directive establishes the U.S. policy that autonomous and semi-autonomous weapons will be designed to allow commanders and operators to exercise appropriate levels of human judgment over the use of force. It requires senior review before systems employing autonomous lethal force can be developed or fielded. The directive is often misread as a ban on lethal autonomous weapons; it is not. It is a policy requiring meaningful human judgment, which is a design requirement more than a prohibition. The 2023 update clarified definitions and the senior review process after community concerns about the earlier 2012 version. DOD compliance with 3000.09 is coordinated by the CDAO, the Undersecretary of Defense for Policy, and the Joint Staff; community reviews by the Red Team and the Defense Innovation Unit inform the process.

National Security Memorandum 25 of October 24, 2024, with the accompanying Framework to Advance AI Governance and Risk Management in National Security, is the civilian-framework analog for classified and national-security-sensitive AI. NSM-25 implements EO 14110 Section 11, which allowed national security alternatives to some public transparency. The Framework sets out principles for prohibited uses, high-impact uses that require additional safeguards, and minimum practices for AI in national security. It also sets up the AI Safety Institute relationship with national security community oversight. Together, EO 14110, OMB M-24-10, and NSM-25 form the overlapping federal AI governance regime: M-24-10 for civilian rights-impacting and safety-impacting systems, NSM-25 for national security systems, with classified alternatives to public transparency preserving the underlying accountability principles where public transparency would compromise national security.

The Intelligence Community operates under the ODNI Principles of AI Ethics for the IC (2020) and AI Ethics Framework (with 2023 updates). NGA, NSA, CIA, DIA, and other IC elements implement these principles internally with oversight by the IC IG. The principles, respect the law and act with integrity, objectivity and transparency, human-centered development and use, security, accountability, and informed consent where applicable, track the OSTP Blueprint and NIST RMF at a high level but are adapted to classified operations.

Export controls deserve particular attention. The October 7, 2022 Bureau of Industry and Security rule introduced controls on advanced computing items to China, including semiconductors used in AI. The October 17, 2023 expansion broadened scope. The January 13, 2025 Framework for Artificial Intelligence Diffusion created a three-tier country classification governing AI model weight and training compute exports. State Department ITAR continues to govern defense articles including certain AI applications. Agency AI programs must coordinate with BIS on licensing, with State on ITAR questions, and with Treasury OFAC on sanctioned-person access. Missing these controls is both legally risky and strategically damaging.

The NSCAI Final Report of March 2021, led by Chair Eric Schmidt and Vice Chair Bob Work, with 15 commissioners including current federal officials, was the intellectual foundation for much of the post-2021 federal AI policy. Its 16 chapters addressed AI for warfighting, talent, R&D, hardware, international cooperation, ethics, and organizational structure. The CDAO, the NSCAI Chairman's Foreword on trustworthy AI, the recommendations on the Technology Modernization Fund, and much of EO 14110's structure trace to NSCAI recommendations.

Finally, the boundaries matter. A federal AI program that blurs the line between national security and civilian use, for example, a CBP facial-recognition system also used for general consumer identification, inherits obligations from both regimes. M-24-10 applies when the system is used for civilian purposes; NSM-25 and EO 14110 Section 11 apply when the system is used for national security. Agency AI leaders must understand both regimes and respect the boundary. The DHS CBP Traveler Verification Service, the DHS/CBP At-Entry systems, and the State Department biometric systems are real examples of this boundary problem and are managed by coordinated CAIO, CISO, Privacy, and Security Office review.

DOD and Autonomous Weapons: DODD 3000.09

DOD Directive 3000.09 was first issued November 21, 2012, and substantially updated January 25, 2023. The directive establishes DOD policy for autonomous and semi-autonomous weapon systems. The core requirement is that autonomous and semi-autonomous weapon systems be designed to allow commanders and operators to exercise appropriate levels of human judgment over the use of force. This is a design requirement and an operational posture, not a categorical prohibition.

Key definitions. Autonomous weapon system: once activated, can select and engage targets without further intervention by a human operator. Semi-autonomous weapon system: once activated, selects specific targets by the human operator for engagement (e.g., fire-and-forget missiles that home on operator-designated targets). Human-supervised autonomous: designed to provide human operators the ability to intervene and terminate engagements, but can operate independently if the human is unavailable.

Senior review. Systems employing autonomous lethal force, specifically, autonomous weapon systems using non-lethal weapons against materiel targets are one category, and autonomous lethal force is another, require senior review before development and before fielding. The review is conducted by the Under Secretaries of Defense for Policy and for Research and Engineering, with Vice Chairman of the Joint Chiefs input.

The 2023 update clarified definitions, added explicit reference to AI and machine learning, and strengthened the senior review process. The CDAO is the coordinating DOD body for 3000.09 compliance, working with the Joint Staff, the Defense Innovation Unit, the Office of the Under Secretary for Policy, and the Services.

International context. The United States participates in the UN Group of Governmental Experts on Lethal Autonomous Weapons Systems (LAWS) under the Convention on Certain Conventional Weapons. The Political Declaration on Responsible Military Use of AI and Autonomy (February 2023, updated November 2023) articulates U.S. and endorsing-state principles. The U.S. does not support an outright ban on lethal autonomous weapons; it supports responsible development consistent with 3000.09 and international humanitarian law.

Oversight. DOD IG, GAO, the Armed Services Committees (HASC and SASC), and the Intelligence Committees (HPSCI and SSCI) have oversight roles. The CDAO coordinates with the Office of the General Counsel, the Defense Counterintelligence and Security Agency, and the Executive Office of the President.

Operational practice. Combatant Command J5, J6, and J8 staff integrate 3000.09 considerations into operational planning. Service staffs train operators on the appropriate levels of human judgment required. The Defense Department Test and Evaluation community, led by the Director of Operational Test and Evaluation (DOT&E) and coordinated by CDAO, runs T&E for AI-enabled weapon systems with specific attention to 3000.09 compliance.

AI in the Intelligence Community

The Office of the Director of National Intelligence issued Principles of Artificial Intelligence Ethics for the Intelligence Community in June 2020, and a supporting AI Ethics Framework. Updated guidance was released in 2023. The principles are: respect the law and act with integrity; be transparent and accountable; pursue objectivity and fairness; be scientifically rigorous; safeguard human dignity, rights, and liberties; and collaborate with domestic and international partners.

IC elements implementing the principles include: the National Security Agency (signals intelligence, cyber), the Central Intelligence Agency (human intelligence, covert action, analysis), the Defense Intelligence Agency (military intelligence), the National Geospatial-Intelligence Agency (geospatial intelligence), the National Reconnaissance Office (overhead reconnaissance), the FBI Intelligence Branch (domestic intelligence), and the State Department Bureau of Intelligence and Research. Each element has internal AI programs under ODNI coordination.

Oversight is exercised by the Intelligence Community Inspector General, the House Permanent Select Committee on Intelligence (HPSCI), the Senate Select Committee on Intelligence (SSCI), the Privacy and Civil Liberties Oversight Board (PCLOB), and the Foreign Intelligence Surveillance Court (FISC) for FISA-related activities. GAO has a more limited IC role under 50 U.S.C. 3091.

AI use cases in the IC span from routine analytic support (translation, entity extraction, summarization) to more sensitive applications (target development, cyber operations, counterintelligence). NSM-25 establishes the framework for high-impact uses, including those that would be rights-impacting if deployed in civilian contexts.

The Annual Threat Assessment of the U.S. Intelligence Community, published by ODNI, includes AI as a topic. Each administration's National Intelligence Strategy addresses AI's role in intelligence. Classified National Intelligence Directives (NIDs) and IC Directives provide additional guidance.

Key practical points for IC AI. First, classification is the default for many programs, but the NIST AI RMF principles are still applied under classified-alternative frameworks. Second, civil liberties and privacy protections apply even in classified contexts, enforced by the PCLOB and the ODNI Civil Liberties, Privacy, and Transparency office. Third, export controls apply to many IC technology partnerships; the BIS and State Department coordinate. Fourth, the IC cooperates with NIST AI Safety Institute under NSM-25-permitted arrangements. Fifth, procurement through the CIA's In-Q-Tel, DIA's DoDTechipedia, and the broader IC procurement ecosystem introduces AI technologies that must be governed coherently.

Export Controls for AI: EAR, ITAR, and BIS

The Export Administration Regulations (EAR) at 15 CFR Parts 730-774, administered by the Bureau of Industry and Security in the Department of Commerce, are the principal regime governing dual-use technology including much AI hardware and software. The International Traffic in Arms Regulations (ITAR) at 22 CFR Parts 120-130, administered by the State Department Directorate of Defense Trade Controls, govern defense articles and services. Treasury's Office of Foreign Assets Control (OFAC) governs country and person sanctions.

Key AI-relevant BIS actions: October 7, 2022 Advanced Computing and Semiconductor Manufacturing controls targeting advanced AI semiconductors and equipment bound for China. October 17, 2023 expansion broadening definitions and closing perceived loopholes. January 13, 2025 Framework for Artificial Intelligence Diffusion creating a three-tier country classification, Tier 1 close allies, Tier 2 controlled access, Tier 3 entities of concern, with quantitative thresholds for model weight and training-compute exports. These actions are the principal federal tool for AI-specific technology competition with China and other concerns.

Enforcement tools. BIS issues denials, conditions licenses, places entities on the Entity List, and pursues criminal referrals through DOJ. The October 2022 controls were followed by Entity List additions of companies including YMTC, SMIC (with limited carve-outs), and others. End-use and end-user controls require licensing for specified items destined for specified users.

Agency AI programs must coordinate on. First, vendor supply chains. Procurement of AI from non-Tier-1 vendors, or vendors with ties to Tier-3 entities, triggers both EAR and procurement integrity concerns (DFARS clauses, FAR clauses, Buy American Act). Second, data flows. Training data that includes controlled technical data is itself subject to EAR export controls. Third, model weights. The January 13, 2025 Diffusion controls treat model weights above specified thresholds as controlled items. Fourth, human collaboration. Foreign nationals accessing AI models or training data may constitute a deemed export under EAR 734.2(b)(2)(ii) or ITAR 120.17.

Interaction with other regimes. CFIUS (Committee on Foreign Investment in the United States) under Treasury review can block foreign investment in U.S. AI companies. FIRRMA-strengthened CFIUS jurisdiction covers much of the dual-use AI space. The Outbound Investment Security Program finalized by Treasury Rule in 2024 restricts U.S. investment in AI in countries of concern. BIS, State, Treasury, DOJ, and the intelligence community coordinate through the Federal Acquisition Security Council (FASC) and the Information and Communications Technology and Services (ICTS) Executive Order process.

Agency practical steps. First, name an EAR/ITAR point of contact. Second, train procurement and program staff. Third, obtain BIS advisory opinions when uncertain. Fourth, build entity-screening into vendor onboarding. Fifth, coordinate foreign national access with Security Officer. Sixth, maintain audit records. Seventh, update Technology Control Plans annually. Eighth, participate in BIS and State outreach programs.