No Keys for the Contractor

Before Gregory Kausner became an executive at Anduril Industries, he flew Navy fighter jets and worked in the Pentagon. Today he discusses foreign sales, yet he cannot sell to the highest bidder. A listener wrote in to ask what stops companies like Anduril, or Palantir, from handing advanced tech to adversaries like China or Russia, and whether hacking a contractor compromises every military operation. That speaks to commercial loyalty, and the challenge of containing the blast radius after an intrusion. The answer begins with the legal cage surrounding modern contractors.

Corporate structure creates no loophole here. While Palantir trades publicly and Anduril stays private, neither receives a pass to sell at will. Back in 1976, amid the Cold War, federal lawmakers created the Arms Export Control Act, which established the International Traffic in Arms Regulations, known as ITAR. For strategic adversaries, that barrier is absolute. In federal regulation 22 CFR section 126.1, the government enforces a strict policy of denial toward China and Russia. Any license request to transfer defense technology to them is turned down automatically.

That statutory wall covers code just as strictly as physical hardware. The State Department enforces ITAR for gear on the Munitions List—the federal government's official catalog of restricted military weapons and defense items. Meanwhile, Commerce tracks dual-use systems through the Export Administration Regulations, known as EAR, which govern commercial tech adapted for military use. Under federal law, defense software is treated like live ammunition. A contractor cannot hand sensitive engineering data to foreign citizens without explicit government clearance. Under the regulations, even letting a foreign employee view defense code across an internal company network qualifies as an illegal export.

The volume of hardware and code flowing through this pipeline is huge. In fiscal year 2024, approved Foreign Military Sales hit 118 billion dollars. As Kausner observed, private investment now finances nearly 90 percent of domestic research and development. Yet every foreign transfer stays locked behind federal gates. So what happens when a company or an employee actually tests that export ban?

When someone tests that export ban, the government does not treat it as a paperwork slip. Under federal rules, organizations and individuals face heavy fines for giving foreign persons unauthorized access to protected defense items or technical data. In 2007, defense contractor ITT Corporation was hit with a 100-million-dollar penalty for unauthorized night-vision technology transfers to China, leaving behind the hundred-million-dollar lesson that compliance is not optional. Enforcement reaches individuals, too. That same year, Chi Mak was prosecuted for attempting to export Munitions List defense items to China and sentenced to 24½ years in federal prison.

If adversaries cannot buy the technology, they cannot simply buy the company either. President Gerald Ford created CFIUS, the interagency committee vetting foreign purchases of American businesses, in 1975. In 1988, Congress added the Exon-Florio amendment, granting the president power to block foreign deals that threaten national security. In 1990, President George H.W. Bush used that power to void the sale of Seattle-based manufacturer MAMCO to a Chinese agency. In 2019, CFIUS intervened after Chinese gaming company Beijing Kunlun Tech acquired the dating app Grindr, forcing a divestment over concerns that a foreign government could access sensitive user data.

Even a minority stake triggers internal defense controls. The Defense Counterintelligence and Security Agency monitors Foreign Ownership, Control, or Influence, or FOCI—rules stopping foreign interests from directing management or compromising classified contracts. Cleared defense firms entering foreign merger or investment talks must notify the government with a mitigation plan and disclose foreign ties on Standard Form 328. To isolate that influence, the government mandates firewalls like voting trusts and proxy agreements that legally bar foreign investors from company decisions or classified secrets.

Those guardrails are expanding. On May 7th, 2026, the Defense Department proposed extending mandatory foreign influence reviews to contractors and subcontractors on unclassified defense contracts above 5 million dollars. By Pentagon estimates, that widens scrutiny from roughly 2,500 classified contractors to nearly 40,000 firms. Yet even if foreign adversaries cannot buy the technology or the boardroom, another door beckons. If they cannot buy commercial defense tools, they will try to steal them through cyber intrusions.

Breaking into a contractor does not hand over the military's keys. It is easy to assume that because a vendor writes the software and supplies the code, an intrusion into their systems compromises operational secrets. Under defense procurement rules, an intrusion into a supplier does not expose operational military systems as a whole. In defense procurement, contracts explicitly identify and isolate protected military information from the start. The armed forces keep their own data environments, while commercial vendors only provide the analytical tools. A breach at a software company hits corporate servers, not the operational vault of the military.

That wall becomes absolute when data is classified. The Pentagon organizes cloud security into strict tiers called Cloud Impact Levels. Level 6, or IL6, is the defense cloud environment reserved for storing and processing information classified up to Secret. Those files cannot sit on commercial hardware; they require dedicated federal cloud infrastructure, completely separated physically from non-government users. The environment runs as a closed enclave connected only to SIPRNet, the military's private Secret network, with no link to the open internet.

To deploy software inside those enclaves, commercial tech firms must pass demanding federal baselines. Industry analysts point to Palantir Federal Cloud Service, which earned High Class D certification under FedRAMP—the government program that evaluates commercial cloud security—backed by six authorizations in late 2024. That high-level federal benchmark, paired with extra military controls, is used to assess cloud platforms toward an IL6 authorization. Palantir has used those approved environments to support defense workloads ranging through Level 5 and, for some tasks, Level 6.

Alongside physical isolation, the armed forces apply zero trust—the security architecture where no user or device is trusted by default. Federal regulations can mandate electronic communications plans to establish clear digital boundaries between a contractor and foreign affiliates. Proponents and the National Security Agency highlight how tools like software-defined perimeters and granular data tags partition networks, preventing lateral movement during a breach. That containment sharply limits that blast radius from earlier, stopping an intrusion into a supplier from exposing classified operations. Yet whether that immaculate architecture holds up against the messy reality of day-to-day defense procurement is where the framework is put to the test.

Supporters argue commercial software improves resilience by replacing the waterfall model—the Cold War habit of drafting rigid specifications on paper and coding for years without user feedback. Systems engineer Matt Jaffe, who worked on Aegis, the Navy's automated shipboard combat and radar system, remembered drafting requirements and receiving only one brief meeting: "It's hard to do human-machine interface that way." Advocates say that frozen design turned fatal. In 1988, the cruiser Vincennes downed Iran Air Flight 655, killing 290 civilians. During the Iraq War, automated Patriot batteries hit friendly aircraft, destroying a British Tornado and killing its 2 crew members. Analyst John Hawley blamed those tragedies on choices locked in years prior by planners and coders.

Commercial software relies instead on agile development, rolling out fixes in hours based on immediate frontline requests. During the Kabul evacuation, which flew out over 120,000 people across 2,627 flights, programmers in Kessel Run, the Air Force's software development unit, resolved recurring flight-planning crashes in just 12 hours. Lieutenant General Greg Guillot commended the software, observing that it "served as a reliable, adaptable tool as we planned and executed this complex, historic operation." Tech proponents insist this rapid turnaround keeps networks resilient, directly supporting the Pentagon's push to deploy zero-trust defenses across defense networks by fiscal year 2027.

Yet critics push back, arguing that private software widens the military's attack surface. A Defense Department Inspector General audit revealed that contractors consistently missed mandatory baselines for passwords, user authentication, and system patching. In one audited incident, classified military files leaked onto an unclassified commercial server and webmail account, remaining exposed for nearly 2 years. Government watchdogs warned that contractor lapses directly compromise intelligence gathering and combat operations.

Those vulnerabilities reach straight into supply-chain visibility—the military's capacity to trace every part and supplier back to where it began. During a multi-year audit, defense contractors logged 248 cyber incidents. Meanwhile, investigators found the Pentagon could verify fewer than 10 percent of sub-tier suppliers building components for critical jets. Even commercial software proponents concede a dilemma: vendors shield their code as proprietary secrets, giving government evaluators only simplified testing summaries. Congressional researchers warn that if uninspected software gets copied across thousands of platforms, a single hidden vulnerability could paralyze the entire military fleet at once. That unresolved tension between rapid software innovation and grave operational exposure is what finally forced defense leaders to put mandatory security guardrails into law.

Confronting contractor security lapses, officials abandoned the honor system. Federal rules require contractor networks handling sensitive defense details to meet NIST standards. Starting October 1, 2025, that mandate applied across covered bids, including commercial software. Contracting officers cannot award work to any bidder lacking an active credential under Cybersecurity Maturity Model Certification, the mandatory third-party verification standard confirming cyber safeguards before work begins.

If an intrusion occurs, a vendor cannot quietly move on. Regulations force contractors to report cyber incidents to the Pentagon's Cyber Crime Center within 72 hours of discovery. The center immediately forwards an encrypted alert to military contracting officers to preserve forensic evidence and halt any fallout.

Still, tighter boundaries do not erase commercial friction. Kausner warns that export red tape pushes buyers toward foreign competitors lacking American restrictions. Both Kausner and defense expert Dr. William Greenwalt argue that export rules need retooling so allies can access modern software quickly. Yet former commerce official Nazak Nikakhtar cautions that commercial firms answer primarily to revenue, which can collide with national security. That is the hundred-million-dollar lesson: crossing adversary red lines brings existential penalties.

That gives a direct answer to the listener's questions. Defense contractors cannot sell combat capabilities to Russia or China. Statutory export restrictions and economic sanctions classify unauthorized defense transfers as federal crimes, alongside procurement curbs barring acquisitions from Chinese military enterprises, designed to prevent adversaries from accessing sensitive tools that could harm the country. Nor does a vendor breach compromise the military. Defense leaders stress that evolving threats demand Zero Trust safeguards rather than simple perimeters, isolating classified operations within federal enclaves. Ultimately, commercial loyalty is not a voluntary pledge; it is anchored in federal statutes and hardwired into the cloud.

There is plenty more to learn about ITAR. And follow security; we have more stories there, so you will be ready when the next shift comes. Thanks for listening. We'll catch you next time on Angle.