Whole Servers, Hidden Compute: Taiwan and the New AI Export Problem

In the last week of February 2025, Singaporean police raided 22 locations, arrested nine people, and charged three men with conspiracy to defraud. The alleged crime was not drug trafficking or money laundering in the ordinary sense. Prosecutors said the men lied to computer suppliers about who would ultimately receive certain servers, machines reported to have come from Dell and Supermicro and to have traveled onward from Singapore to Malaysia. Singapore's home affairs minister, K. Shanmugam, told reporters the servers had arrived from the United States and that investigators were still determining whether any had reached China (Channel NewsAsia, March 3, 2025).

The case crystallized a question that has moved from trade-compliance departments to national-security councils: can American controls on advanced AI chips work when restricted compute no longer travels as chips at all, but inside finished servers, sealed racks, and third-country data centers that look like ordinary infrastructure?

Consider the machine itself. Nvidia's DGX H100 supercomputer contains eight H100 graphics processors, each of which cannot legally be exported to China. The whole system weighs 287.5 pounds, about as much as a household refrigerator, and it is one of the most widely purchased computers on earth, shipped in volume to customers in the United States, Europe, Asia, and the Gulf (Nvidia DGX H100 product documentation). Under the international tariff schedule, it clears customs as a data processing machine, the same broad category as an office server bound for a bank. Nothing about the crate says "supercomputer." The eight restricted chips inside it appear on no shipping manifest. The difference between a legal shipment and a multimillion-dollar federal crime can come down to a line of text declaring the end user.

How AI smuggling moved from suitcases to server racks

The first era of AI-chip smuggling was a chip business. After the U.S. Commerce Department restricted Nvidia's A100 and H100 processors to China in October 2022 (Federal Register, Oct. 13, 2022), reporters found the banned chips openly advertised in Shenzhen's Huaqiangbei electronics market, often at steep markups, with brokers describing stock carried across the border in luggage (Reuters, June 2023). Subsequent reporting by the New York Times and others through 2024 traced the same trade through Hong Kong brokers and small-volume couriers.

That pipeline was real, but it had a ceiling. Moving compute one GPU at a time is slow, conspicuous, and expensive. A cluster used to train a frontier model needs thousands of accelerators on an interconnect fabric, with power, cooling, and networking engineered as one machine. A chip in a suitcase is raw material. A server is a finished weapon.

The scale escalated accordingly. Where a DGX H100 concentrates eight restricted chips in one crate, Nvidia's newer GB200 NVL72 systems concentrate 72 Blackwell GPUs in a single rack weighing roughly a ton and a half, with industry analysts valuing a full rack in the millions of dollars. The unit of modern AI smuggling is no longer the die or the card. It is the machine, and increasingly the cluster.

What makes a finished server so hard to stop

American law, for the record, already covers whole machines. The Commerce rules classify controlled accelerators under export-control classification 3A090 and classify the computers containing them under 4A090. A server holding even one controlled-class GPU generally requires a license to be exported to China, and applications for this class of equipment are reviewed under a policy of denial. The legal wall is high. The problem is finding the boxes.

Several features of server commerce defeat chip-era enforcement habits:

The contents are invisible. A customs declaration for line 8471.50 of the tariff schedule, "processing units," describes a crate, not a bill of materials. No inspector counts the GPUs inside. Confirming that a particular machine contains a restricted accelerometer-class GPU requires opening it, identifying the silicon, and connecting it to its serial and origin documentation, which is forensic work, not inspection work.

Legitimate volume provides the camouflage. The same factories that would produce a diverted H100 server produce enormous numbers of perfectly legal ones for neighboring markets. A diverted machine does not look different from the thousand crates around it on the dock. It is different only on paper.

The paper is the vulnerability, and paper is cheap to forge. The February 2025 Singapore prosecution described the mechanism exactly: the alleged offense was false representation to the suppliers about the end user. Under U.S. rules, misdeclaring contents or end users is a crime. But enforcement depends on someone noticing, which usually requires a tip, an audit, or an anomaly someone decides to chase.

Buyers no longer need the metal at all. A crate can be delivered, entirely lawfully, to a data center in Johor or Sharjah, and the compute inside it can be rented by a customer in Beijing. Nothing crosses the Chinese border except encrypted network traffic. What leaves the country is capacity, not hardware, and capacity was barely covered by the rules at all.

Why Taiwan sits in the middle of this trade

Every route in this story passes through, or starts in, Taiwan. Nvidia's H100 and Blackwell processors are fabricated by TSMC on the island, packaged there using its CoWoS process, and assembled into servers and racks by a cluster of Taiwanese original design manufacturers: Foxconn, Quanta and its QCT unit, Wistron and its Wiwynn unit, and Inventec. Market researchers including TrendForce and IDC have long described Taiwanese ODMs as building the great majority of the world's cloud servers, and Foxconn has told investors it alone supplies roughly 40 percent of the world's AI servers (company earnings briefings, 2024). This is the chokepoint where the machines are born, which makes Taiwan's enforcement posture as consequential as Washington's.

Taiwan has moved to align its legal regime with the American one. The Ministry of Economic Affairs revised its strategic high-tech commodities controls in April 2024 to cover advanced computing chips of the H100 class and computers containing them, mirroring Washington's October 2023 thresholds, as reported by the Taipei Times and other local outlets. In June 2025, Taiwan's International Trade Administration went further, adding Huawei and SMIC, China's flagship chip designer and chip foundry, to its entity list, meaning Taiwanese firms now need licenses to export controlled items to China's own semiconductor champions (Reuters, June 2025).

The island's most instructive enforcement episode concerned chips rather than servers. In October 2024, the analysis firm TechInsights found a TSMC-manufactured die inside Huawei's Ascend 910B accelerator. TSMC said it had halted shipments to the client in question mid-October, after discovering the problem, and notified authorities; Reuters reported the client was widely identified as the Chinese design house Sophgo, a Bitmain affiliate, and that the U.S. Commerce Department opened an investigation. The lesson generalizes: the deception happened at the order desk, years before any box reached a dock. A compliant foundry accepted a purchase order from an intermediary whose design matched a banned end user. End-use fraud begins at the front of the pipeline, not the back.

Public records of Taiwanese customs seizing whole restricted servers are sparse. Enforcement attention on the island has concentrated on chip-level orders, list alignment, and the TSMC pipeline, while the assembled machines flow outward to exactly the places investigators now watch most closely.

The third-country maze

Singapore: the billing address that is not a destination

Nvidia's own filings show why Singapore became the tell. The company has attributed roughly a fifth of its revenue to Singapore in recent periods, about 18 percent for fiscal 2025, while telling investors that most products associated with those billings are physically shipped to other locations, since multinationals centralize their invoicing there (Nvidia SEC filings). That is legal and common. It also means the world's largest concentration of Nvidia revenue sits in a city-state with no significant domestic demand for that much silicon, a structural anomaly that investigators study precisely because billing addresses and destinations diverge. The February 2025 raids turned that abstract anomaly into a criminal case: servers from U.S. suppliers, transshipped toward Malaysia, with the final destination, in the minister's words, still under investigation.

Malaysia: assembly lines and a new permit regime

Malaysia's rise is industrial, not shadowy. Nvidia and Malaysian conglomerate YTL Power announced a roughly $4.3 billion partnership in December 2023 to build AI data-center infrastructure in Johor. Wiwynn, the Wistron cloud-server unit, operates server assembly in Johor. Chinese buyers' interest in Malaysian compute has been documented repeatedly, and Bloomberg reported in late January 2025 that the Trump administration was investigating whether the Chinese lab DeepSeek had obtained advanced Nvidia chips through third parties there and in Singapore. In July 2025, Bloomberg reported that Washington was preparing rules restricting AI-chip shipments to Malaysia and Thailand over precisely this concern. Days later, Malaysia's Ministry of Investment, Trade and Industry announced an immediate permit requirement for the export and transshipment of U.S.-origin high-performance AI chips, stating the country would not let itself be used to circumvent other nations' controls (MITI statement, July 14, 2025).

The Gulf: restricted compute by treaty

The United Arab Emirates and Saudi Arabia obtained their access not by evasion but by negotiation. Microsoft's $1.5 billion investment in Abu Dhabi's G42 in April 2024 was conditioned on intergovernmental assurances, including the removal of Huawei equipment from G42 systems. In May 2025, the administration announced a U.S.-UAE AI partnership including a five-gigawatt data-center campus in Abu Dhabi, with reported terms allowing the UAE to import large annual volumes of advanced chips, and a parallel arrangement supplying Nvidia silicon to Saudi Arabia's new national AI company, Humain, beginning with 18,000 GB300 systems. Lawmakers and analysts have questioned whether Gulf data centers can be made leak-proof; the administration's answer, in effect, is that negotiated access with verified-end-user conditions is safer than black-market demand. The critics' counter is equally documented: a data center in the Gulf is, for a remote customer in China, computationally indistinguishable from one in Shenzhen.

Mexico: the new assembly floor

Mexico's role is manufacturing migration. In October 2024, Foxconn's chairman said the company was building the world's largest assembly plant for Nvidia's GB200 in Mexico (Reuters, Oct. 8, 2024), and Quanta has expanded server production in Monterrey. No major public diversion case has centered on Mexico to date. But under the rescinded AI diffusion framework, Mexico sat in the capped tier, and U.S. officials have watched the geography with open concern: the same nearshoring that serves the American market also multiplies the number of jurisdictions through which a finished restricted machine can legally move before it becomes untraceable.

The cases that exposed the pattern

Read together, the public record of enforcement actions describes a consistent anatomy of diversion:

• Singapore, February 2025. Raids at 22 locations; three men charged with conspiring to misrepresent end users to server suppliers; Dell and Supermicro reportedly the manufacturers; onward movement to Malaysia; China destination unresolved as of the last public statements. The prosecution framed supplier-side fraud as the crime, which is telling: the paperwork lie is now the battlefield.
• Dell and Supermicro, United States. Bloomberg reported in February 2025 that Commerce's export-enforcement arm was examining whether servers containing Nvidia chips sold through third parties were diverted to China. Both companies said they comply with U.S. export rules; Supermicro was separately reported by the Wall Street Journal in September 2024 to face a Justice Department probe following short-seller allegations. No charge has established that either company knowingly exported restricted systems to China.
• DeepSeek inquiries, 2025. Bloomberg and Reuters reported that U.S. investigators were examining whether the Chinese AI lab's reported capabilities rested on restricted chips obtained through third countries. DeepSeek's own technical report for its V3 model says the training run used 2,048 H800 GPUs, a China-market variant that was lawful when sold before the October 2023 rule change (DeepSeek-V3 Technical Report, arXiv). Nvidia has said the work appeared consistent with export-control compliance. The claims of something larger remain allegations and estimates, examined in the scale section below.
• TSMC and the intermediary buyer. The 2024 discovery of TSMC silicon in Huawei's accelerator shows the end-user deception model operating at the chip-design stage, with purchase orders rather than crates as the contraband vector.

The pattern these cases share is not smuggling as Hollywood imagines it. No one is tunneling under a border. The recurring elements are front companies, freight forwarders, vague end-user statements, and third countries with booming legitimate demand that makes the odd shipment unremarkable.

Why customs cannot see inside the box

Detection runs on declarations. Freight forwarders inherit shipper documentation; customs agencies sample a fraction of containers; and export-enforcement officers conduct end-use checks that are necessarily a small, prioritized slice of a global trade in servers measured in the hundreds of thousands of units. The Bureau of Industry and Security tells industry what to look for: customers with no meaningful web presence, purchasers offering cash or paying above list price, distributors unable to name an end use, delivery addresses at warehouses or forwarders rather than operating companies. These red-flag indicators appear in BIS compliance guidance attached to the advanced-computing rules (October 2023 interim final rule). But a red flag is only useful if a human being reads the file, and front companies are cheap and disposable. Investigations of Russia-bound electronics pipelines have documented brokers cycling through fresh Hong Kong and Turkish shells within weeks of a name being burned.

There is also an asymmetry built into the economics. The seller's incentive is to believe the paperwork; a compliance officer who kills a sale on suspicion loses revenue for the firm. The government's incentive arrives later, after a teardown finding or a rival nation's model announcement makes the missing chips visible in retrospect.

The rental loophole: GPUs as a service

The most thoroughly documented gap requires no crate at all. The Information reported in November 2024 that ByteDance planned to spend roughly $7 billion on Nvidia chips in 2025, including through data centers outside China, and financial and wire reporting through 2024 described Chinese AI developers training models on restricted-class GPUs installed in Southeast Asia. Renting a GPU in Johor from a desk in Beijing involves no export of a controlled item to China. The Commerce Department recognized the hole early: in January 2024 it proposed a rule requiring U.S. cloud providers to verify the identities of foreign customers and report when they train large AI models on American infrastructure. The Biden administration's January 2025 diffusion framework built further provisions for data-center operators and validated end users. With that framework rescinded in May 2025, the durable legal status of the rental channel remains unsettled. The chips stay where the law allows them to be; the capability goes wherever the customer is. No customs regime anywhere inspects a training run.

The playbook is old; the payload is new

None of the mechanics are novel. In 1984, California businessman Charles McVey was convicted of shipping semiconductor manufacturing equipment to the Soviet bloc through front companies and misdeclared shipments. In 1987, the Toshiba-Kongsberg affair exposed precision milling machines sold to the Soviet Union via a Norwegian intermediary, machines that quieted Soviet submarine propellers and provoked sanctions debate in Washington. The CIA's declassified 1985 assessment, "Soviet Acquisition of Militarily Significant Western Technology," described the same architecture seen today: cutouts, transshipment points, and paperwork deceit. In October 2023, the Justice Department charged two Brooklyn residents with running a pipeline that moved American electronic components, including dual-use chips, to sanctioned Russian buyers through front companies in Turkey, Hong Kong, and elsewhere (DOJ, Eastern District of New York, Oct. 31, 2023). What has changed is not the method but the payload's concentration: a single crate in 1984 moved equipment worth keeping secret; a single crate today can move the compute capacity of a small country's research sector.

What Washington has tried, and then untried

The policy record is best read as a rapid alternation between closure and reopening.

October 2022 imposed the first performance-based controls on advanced computing chips and the computers containing them, with a presumption of denial for China. October 2023 closed the workaround, banning the A800 and H800 derivatives Nvidia had built specifically for the Chinese market, expanding license requirements to more than 40 additional countries, and adding end-user red-flag obligations. December 2024 added controls on high-bandwidth memory, an input as essential to Chinese accelerators as the GPUs themselves, and listed 140 more Chinese entities. January 2025 produced the Framework for Artificial Intelligence Diffusion, which divided the world into three tiers, capped compute available to roughly 140 middle-tier countries, and created validated end-user programs for allied and compliant operators (Federal Register, Jan. 15, 2025).

Then the direction reversed. In April 2025, Nvidia disclosed in an SEC filing that the government would require licenses even for the deliberately degraded H20 chip to China, taking a charge of about $5.5 billion. In May 2025, BIS rescinded the diffusion framework days before its effective date, saying it would burden allies, and pivoted to bilateral agreements with the UAE and Saudi Arabia instead. In July 2025, Nvidia announced it intended to resume H20 sales after receiving government assurances licenses would be granted. In August 2025, the president publicly described an arrangement under which 15 percent of H20 revenue would go to the U.S. government, a structure without clear precedent in export-control law and one critics in both parties questioned. China answered in kind: its cyberspace regulator summoned Nvidia in late July over alleged vulnerabilities in the H20, Reuters reported authorities advising domestic firms to avoid the chip in August, and Nvidia's chief security officer published an unusual public statement: "no backdoors, no kill switches" exist in its products (Nvidia, Aug. 5, 2025).

Meanwhile, the enforcement-minded pieces keep circulating: a Chip Security Act introduced in the Senate in May 2025 would require location-verification features in controlled chips, and the reported draft rules aimed at Malaysia and Thailand would close the most obvious transshipment lanes. The toolset exists. Its consistency does not.

How big is the leak, really?

Here the evidence divides, and honesty requires holding both halves.

On one side: Scale AI's chief executive, Alexandr Wang, said during a Davos interview in January 2025 that DeepSeek possessed "about 50,000 H100s they can't talk about," a claim offered without publicly documented evidence (CNBC, Jan. 22, 2025). The consultancy SemiAnalysis estimated that DeepSeek's broader operations draw on a fleet of tens of thousands of Hopper-class GPUs, mixing lawful and potentially unlawful provenance (SemiAnalysis, Jan. 24, 2025). The Shenzhen retail market, the Singapore prosecutions, and the reported third-country probes all demonstrate that restricted silicon moves.

On the other side: DeepSeek's own published engineering says its flagship V3 training run used 2,048 lawfully purchased H800s, less than 2.8 million GPU-hours, a figure that, if accurate, proves sophistication with compliant hardware rather than evasion. Nvidia has publicly assessed that DeepSeek's work appeared export-control compliant. Nvidia's China revenue share, which approached a quarter of data-center sales before the controls, fell to single digits by 2024, evidence that the legal channel was genuinely constricted. Policy researchers at CSIS, including Gregory Allen, have argued that smuggling at the scale documented plausibly raised costs and slowed Chinese scaling without amounting to a wholesale defeat of the regime, while SemiAnalysis's analysts argue the opposite emphasis, that leakage is systemic. There is no authoritative count of smuggled GPUs. No government has published one; no investigation has produced one.

The defensible reading: diversion is real, materially documented in specific cases, and organized around supplier fraud and transshipment rather than container-scale cargo crime. Whether it is a tributary or a river, the public record cannot yet establish, and every confident number in circulation belongs to the disputed or unverifiable category.

Could server-level controls actually work?

The strongest case that they could comes from the same features that make servers attractive to smugglers. Whole machines are large, valuable, and manufactured by about a dozen firms on earth. Unlike a GPU, a server cannot be split into fifty envelopes. The supply side is an oligopoly with serial numbers, service contracts, warranty registrations, and firmware update relationships that create durable records of where machines live. Open-source analysts already track hyperscale AI data centers through power consumption and satellite imagery; a 72-GPU rack cluster draws megawatts and sits in a big building, which is a strange kind of hiding place. The January 2025 framework's validated-end-user programs, and the negotiated guardrails attached to the Gulf deals, are attempts to convert that visibility into verification: know where the clusters are, and the paperwork matters because the metal can be checked against it.

The technical layer adds hooks. H100-class GPUs carry hardware roots of trust and remote attestation features designed for confidential computing, which cryptographically vouch for a chip's identity and firmware state. The CNAS and Institute for Progress report "Secure, Governable Chips" (January 2024) laid out how such on-chip mechanisms could be extended to location and licensure verification, and the proposed Chip Security Act would mandate versions of them. The allied record shows the approach can bite: Singapore prosecuted, Malaysia imposed permits, Taiwan aligned its lists. When a jurisdiction decides the seam matters, it closes visible traffic.

The strongest case that they cannot is equally documented. Attestation vouches for identity, not geography, and location claims can be spoofed by sophisticated actors. Verification regimes collide with sovereignty and privacy concerns, as China's regulator demonstrated the moment Washington floated chip-level controls. OEMs and distributors face commercial incentives to accept paperwork at face value. The cloud-rental channel sits largely outside hardware controls. And policy itself toggles: the H20 was compliant, then banned, then licensed for a 15 percent share within four months, and a machine that one administration restricts the next may sell by treaty. Controls that change quarterly cannot accumulate the institutional muscle that decades of chemical-weapons or missile-technology regimes required.

The verdict the evidence supports is narrower than either camp's rhetoric. Server-level controls can work as friction: they can raise the price, risk, and lead time of evasion, compress the legal channel, and make large-scale diversion detectable afterward, which changes the economics of trying. They cannot function as a hermetic seal, and they fail outright where allied enforcement is absent or policy reopens the lane it just closed. Whether the post-2025 settlement, permits at transshipment hubs, verification hardware, bilateral compute treaties, and whatever licensing status the H20 ultimately retains, adds up to durable friction is the open experiment. As of the latest public record, the cases that matter are still being litigated and the replacement rules that matter are still being drafted.

What a refrigerator-sized machine reveals

Return to the crate on the dock. The Singapore raids began with an anomaly someone noticed in paperwork that billions of dollars of legitimate commerce makes easy to ignore, and they ended, so far, with fraud charges against three men and an unresolved question about where the machines actually stopped. That arc contains the whole answer to the central question. Western controls were built to police silicon, and silicon now travels inside machines, racks, treaties, and invoices. The unit of smuggling has outgrown the unit of control. The system that can work is the one that follows the compute wherever it assembles, bills, and powers on: serial-number registries at the Taiwanese plants where these machines are born, permit regimens in the transshipment states, verified end users in the data centers, and technical verification inside the chips themselves. Each element exists in prototype somewhere in the record. None exists everywhere at once, and the world's AI servers will keep rolling off the assembly lines while the paperwork catches up.

Sources and references

Primary and official sources

• U.S. Bureau of Industry and Security, "Implementation of Additional Export Controls: Certain Advanced Computing and Semiconductor Manufacturing Items; Supercomputer and Semiconductor End Use," Federal Register, Oct. 13, 2022
• U.S. Bureau of Industry and Security, "Implementation of Additional Export Controls: Certain Advanced Computing Items; Supercomputer and Semiconductor End Use; Updates and Corrections," Federal Register, Oct. 25, 2023
• U.S. Bureau of Industry and Security, "Framework for Artificial Intelligence Diffusion," Federal Register, Jan. 2025
• U.S. Bureau of Industry and Security, press release rescinding the AI diffusion rule, May 13, 2025
• Nvidia Corp., Form 8-K disclosure on H20 license requirement, April 15, 2025, and fiscal 2025 Form 10-K, via SEC EDGAR
• Nvidia Corp., DGX H100 product documentation and datasheet
• Nvidia Corp., "NVIDIA to Resume H20 Sales," corporate statement, July 2025
• Nvidia Corp., Office of the Chief Security Officer, "No backdoors. No kill switches.," Aug. 5, 2025
• DeepSeek AI, DeepSeek-V3 Technical Report, arXiv:2412.19437, December 2024
• Malaysia Ministry of Investment, Trade and Industry, statement on permit requirements for U.S.-origin high-performance AI chips, July 14, 2025
• Microsoft Corp., announcement of strategic investment in G42 with binding assurances, April 16, 2024
• U.S. Department of Justice, Eastern District of New York, charges against Nikolay Goltsev and Salimdzhon Nasriddinov for electronics smuggling to Russia, Oct. 31, 2023
• U.S. Department of Commerce, proposed rule on cloud provider customer identification, January 2024
• Office of Sen. Tom Cotton, Chip Security Act introduction, May 2025
• CIA, "Soviet Acquisition of Militarily Significant Western Technology: An Update," declassified assessment, 1985
• Center for a New American Security and Institute for Progress, Aarne, Fist, and Withers, "Secure, Governable Chips," January 2024

Reporting and analysis

• Reuters, reporting on the underground market for restricted Nvidia chips in Shenzhen, June 2023
• New York Times, reporting on H100 smuggling routes into China, 2024
• Reuters, "Foxconn building world's largest GB200 plant in Mexico," Oct. 8, 2024
• Reuters, reporting on the TSMC die found in Huawei's Ascend 910B and the Commerce Department inquiry, October 2024
• Wall Street Journal, reporting on the Justice Department probe of Supermicro, Sept. 26, 2024
• The Information, reporting on ByteDance's planned Nvidia spending including overseas data centers, November 2024
• CNBC, interview with Scale AI CEO Alexandr Wang, Jan. 22, 2025
• SemiAnalysis, "DeepSeek Debates," Jan. 24, 2025
• Bloomberg, reporting on U.S. inquiries into DeepSeek's chip sourcing through third countries, January 2025
• Channel NewsAsia and The Straits Times, coverage of the February 26-27, 2025 raids and charges, and Minister K. Shanmugam's March 2025 statements
• Bloomberg, reporting on Commerce scrutiny of Dell and Supermicro servers, Feb. 28, 2025
• Taipei Times, reporting on Taiwan's April 2024 strategic high-tech commodities list revision
• Foxconn investor briefings on AI-server market share, 2024; TrendForce and IDC server ODM market analyses, 2023-2025
• Reuters, "Taiwan adds Huawei, SMIC to export control list," June 2025
• Bloomberg, reporting on draft U.S. restrictions on AI-chip shipments to Malaysia and Thailand, July 2025
• Reuters and Financial Times, reporting on the August 2025 H20 licensing arrangement and Chinese guidance discouraging H20 purchases
• CSIS, Gregory Allen and colleagues, analyses of AI chip export-control enforcement, 2023-2025