Dual-use technology

Working Definition

Dual-use technology refers to any tangible item, software, scientific knowledge, or technical capability developed for legitimate civilian and commercial purposes that can also be applied—with little or no modification—to military weapons systems, intelligence operations, or mass harm. In its narrow legal-administrative sense, “dual-use” is a statutory customs classification: a precision milling machine, chemical precursor, or high-performance semiconductor requires an export license because its parameters appear on an export-control annex. In its broad ethical and scientific sense (dual-use research of concern), it describes a dilemma where the same experiment or computer model that advances medical treatment or cybersecurity generates actionable instructions for building a bioweapon or executing a cyberattack. Across both registers, “dual use” is never an intrinsic physical property of an object in isolation, but a relational property linking a capability to the intent and capacity of its user.

Genesis and Global Lineage

As a formal legal category, dual-use technology is a child of the Cold War. In 1949, the US and its Western allies established the Coordinating Committee for Multilateral Export Controls (COCOM), a Paris-based body maintaining secret embargo lists of industrial goods, machine tools, and computers forbidden for export to the Soviet bloc and China. For forty-five years, allies bargained (Michael Mastanduno, Economic Containment, 1992) over where to draw the line between civilian trade and items enhancing Soviet military potential. After the Soviet collapse, COCOM was dissolved on March 31, 1994 and replaced in July 1996 by the Wassenaar Arrangement on Export Controls for Conventional Arms and Dual-Use Goods and Technologies, headquartered in Vienna, canonizing the term alongside non-proliferation treaties and UN Security Council Resolution 1540 (2004). A second life began after the 2001 U.S. anthrax letters: the National Research Council’s 2004 Fink Report (Biotechnology Research in an Age of Terrorism) transplanted “dual use” to university biology labs, coining Dual Use Research of Concern (DURC). A third wave arrived in 2018 with The Malicious Use of Artificial Intelligence (Miles Brundage et al.), importing biosecurity vocabulary into deep learning—culminating in the October 2023 U.S. Executive Order defining “dual-use foundation models.” Throughout, philosophers like John Forge (2010) have warned that because almost any tool can be used for harm, “dual use” is vacuous unless anchored to specific severity thresholds.

Central European Lineage

Central and Eastern Europe did not coin the concept, but for nearly half a century the region was the primary historical target against which Western dual-use rules were defined—before undergoing an institutional reversal after 1989. From 1949 to 1994, COCOM’s control lists were designed to deny Warsaw Pact and COMECON (RWPG) economies—including Poland, Czechoslovakia, and Hungary—access to Western precision machine tools, telecommunications switches, semiconductors, and mainframes, directly shaping the trajectory of socialist-bloc computing. When COCOM members agreed on November 16, 1993 that “COCOM’s East–West focus was no longer the appropriate basis for export controls” and terminated the body in March 1994, the former embargo targets were invited inside: in September 1995, Poland, Czechia, Slovakia, and Hungary joined the negotiations, becoming founding Participating States of the 33-member Wassenaar Arrangement in July 1996, with its permanent secretariat in Vienna. Three decades later, Central Europe became a focal point of the European debate over dual-use cyber-surveillance exports: following 2021–2022 revelations that Hungarian and Polish governments had deployed NSO Group’s Pegasus spyware against opposition politicians, prosecutors, and journalists, the European Parliament’s PEGA Committee investigation (2023) turned the region’s experience into the primary test case for enforcing human-rights conditionality under the EU’s recast Dual-Use Regulation (2021/821).

Why Now

Three developments between 2018 and 2026 returned dual-use technology to the front pages of global politics. First, generative AI and computational biology blurred the boundary between software and weapons proliferation: following the 2018 Malicious Use of AI report and OpenAI’s staged release of GPT-2 in 2019, whether open-weight foundation models or protein-design algorithms lower the barrier for synthesizing pathogens or automating cyberattacks became a central preoccupation of AI governance, codified in “dual-use foundation models.” Second, hardware export controls returned as the master weapon of great-power rivalry: beginning in October 2022 (and tightened through 2023–2025), the U.S. Bureau of Industry and Security imposed sweeping controls on exporting advanced AI accelerator chips (Nvidia’s A100/H100 series) and extreme ultraviolet (EUV) lithography equipment to China—reviving Cold War COCOM choke points, now calibrated in FLOPS and interconnect bandwidth. Third, the EU’s recast Dual-Use Regulation (2021/821) expanded export controls to cyber-surveillance items capable of covertly intercepting mobile communications, thrusting dual-use licensing into European rule-of-law battles after the Pegasus and Predator scandals.

Explanatory Power

The concept shows that “technological safety” is never a self-contained property of a machine, and that governance must choose whether to regulate physical choke points, intangible information, or end users. First, the 2011–2012 controversy over gain-of-function experiments by Ron Fouchier and Yoshihiro Kawaoka—who modified H5N1 avian influenza to transmit through the air between mammals—exposed the limits of controlling dual-use knowledge: when the U.S. National Science Advisory Board for Biosecurity recommended publishing the papers with methods redacted, researchers realized no international mechanism existed for sharing redacted details only with “legitimate” labs worldwide. Second, post-2022 semiconductor export controls show why regulators gravitate toward hardware even when the risk is software: once neural weights are trained, copying a 100-gigabyte file across borders is nearly impossible to police, whereas EUV lithography machines and high-bandwidth memory fabs are concentrated in fewer than five companies globally. Third, the debate over releasing “open-weight” frontier AI models reveals that in digital technology, scientific publication and global export are the same act: uploading weights to the internet exports the capability into every jurisdiction and removes any ability to revoke the license later.

Axes of Debate

Underappreciated Angle

The least appreciated flaw of dual-use regimes is their built-in temporal lag. Statutory control lists (Wassenaar annexes or EU Dual-Use lists) require years of diplomatic consensus, codifying the technologies of the previous decade while leaving emerging capabilities untouched. During the five-to-ten-year window when CRISPR, commercial spyware, or frontier language models first become viable, state bureaucracies lack the legal definitions and expertise to evaluate them—leaving governance to journal editors, cloud providers, and corporate launch committees. Central Europe’s trajectory adds an ironic lesson about the mutability of dual-use categories: an apparatus built in 1949 to keep high technology out of Warsaw, Prague, and Budapest saw those capitals become co-authors of the Wassenaar rulebook by 1996—and a quarter-century later saw the European Parliament invoke EU dual-use rules to investigate how member-state governments used imported spyware against their own citizens. Every dual-use list is written as if the world were neatly divided into trusted insiders and dangerous outsiders, only for history to prove the line moves faster than the law.