Cloud ID checks

What it does

Cloud companies must check the identity of any customer renting enough computing power to train a frontier model.

Applies to: Compute providers serving customers at frontier scale.

• Collect identity, payment and contact information from any customer using enough compute to train a covered model; assess intent; retain records (SB 1047 § 22604).
• Implement the ability to shut down a customer's resources.

Where things stand

The 2024 Commerce Department proposed KYC rules for infrastructure-as-a-service providers. Major clouds already do sanctions screening. SB 1047 would have required it in California.

Why it gains ~5 days

It costs U.S. labs almost nothing and closes a route for Chinese labs to rent Western chips, worth about 2 days of lead.

Biggest unknown: How much Chinese frontier training currently runs on rented Western compute.

Why it lowers p(doom) by ~0.05%

Stops bad actors and banned foreign labs from secretly renting U.S. computing power.

Knowing who rents large amounts of computing power makes it harder to secretly train dangerous models.

The strongest case that it costs more

KYC on compute is an export control in disguise and shares its weakness: it only works if the covered providers are the only providers. A higher U.S. price would come from pushing customers to non-U.S. clouds, which is a commercial cost and not a lead cost.

The debate

For

• Commerce Department proposed know-your-customer rules for U.S. cloud providers, 2024.
• Janet Egan and Lennart Heim, GovAI argued compute providers should run KYC schemes, 2023.
• CSET, Georgetown called customer identification an important step for national security, 2024.

Against

• U.S. Chamber of Commerce called cloud KYC costly, burdensome and ineffective, 2024.

Sources

• SB 1047 enrolled text, § 22604: compute cluster operator duties
• Commerce/BIS proposed rule: KYC for IaaS providers (Jan 2024)