The Permanent Emergency: How Security Exceptions Became the Norm in Digital Trade

Buried in virtually every trade agreement is a clause that says, in effect: none of this applies if national security is at stake. These security exceptions such as GATT art XXI, GATS art XIVbis, and their many regional equivalents, are the escape hatches of the international trading system. For decades they sat unused. Governments treated them the way nuclear powers treat their arsenals: too dangerous to deploy, too important to remove.^[1]

That restraint is loosening. In the space of a few years, “security” has become the go-to justification for an expanding range of trade measures, from semiconductor export controls to data localisation mandates to investment screening of tech acquisitions.^[2] The question is no longer whether states will invoke security to restrict digital trade, but how often, how broadly and with what consequences for the economies that depend on imported technology to function.

The last resort clause

For most of the GATT/WTO era, invoking the security exception was considered a step too far. The logic was that if one country starts claiming “security” to justify trade restrictions, others will follow, and the whole system unravels. So there was an unspoken understanding to leave art XXI alone.

That changed in 2019. When a WTO panel finally ruled on the security exception in Russia — Measures Concerning Traffic in Transit (DS512), it established that “emergency in international relations” is something a panel can actually review and it is not simply whatever the invoking state says it is.^[3] A few years later, panels rejected the U.S. invocation of security to justify steel and aluminium tariffs in the Section 232 disputes (DS556), reinforcing the principle.^[4]

But here is the paradox. The fact that panels started scrutinising security claims did not discourage states from making them. If anything, it accelerated the trend, because negotiators responded by writing their preferred version of the exception directly into new trade agreements, often in self-judging form that puts the clause beyond challenge.^[5] The most notable regional example is RCEP art 12.15.3(b), which renders a party’s essential-security measures immune from dispute by its own text.^[6] The result is a proliferation of security exceptions not despite adjudication, but in reaction to it.

The trend is quantifiable. The TAPED dataset at the University of Lucerne has coded the provisions of 495 preferential trade agreements.^[7] Of those, 170 now carry a security exception specifically applicable to digital trade. Among Asia-Pacific agreements, 116 of 248 include one. And among those signed since 2016, the number is 65 out of 96 — roughly two in every three.

Look at the red line. In the early 2000s, it barely registers. By 2018, the year the CPTPP was signed, it passes 40 per cent. By 2020, when RCEP entered the picture, it crosses 60. In recent years it hovers between 70 and 80 per cent. The security exception has gone from a clause nobody used to one that nobody leaves out.

Security is not the only escape hatch

An important caveat: security exceptions are not the only way governments justify restrictive digital trade measures, and in practice they are often not even the first. The general exceptions such as GATT art XX and GATS art XIV, provide broader and more frequently invoked cover for measures aimed at privacy, public order, consumer protection and compliance with domestic laws.^[8] A data localisation requirement, for instance, is far more likely to be defended as necessary for the protection of personal data under a general exception privacy limb than as a security measure under art XXI.

This matters for two reasons. First, it means the numbers in the chart above actually understate the total policy space available to restrict digital trade. The security exception is the most dramatic escape hatch, but the general exceptions are easier to invoke and they appear in virtually every trade agreement ever signed. Second, the two families of exceptions interact. The recent drafting trend of adding express security carve-outs to digital trade chapters gives governments a second, more deferential shelter on top of the general exceptions they already hold.^[9] A government defending a data measure now has the option of running two arguments in sequence: first, that the measure is a legitimate privacy or public-order regulation under the general exception; and if that fails, that it is necessary for essential security under the self-judging carve-out. The layering of exceptions widens the available policy space while the access commitments sitting underneath them remain thin.

The gap between restriction and access

The spread of security exceptions would be less concerning if the commitments they sit on top of had kept up. They have not, and the gap between the two tells a story worth paying attention to.

Consider what the data shows for Asia-Pacific agreements signed over the last decade. The security exception, the provision that lets a government override its digital trade promises, appears in 68 per cent of them. But a binding commitment to allow free cross-border data flows? That shows up in only 38 per cent. A binding ban on data localisation requirements? 36 per cent. Binding protection for source code? Just 26 per cent.

Put simply: if a government wants to restrict digital trade on security grounds, it can find legal cover in two out of three recent agreements. If a business or trading partner wants a binding guarantee of access, they will find one in fewer than two out of five.

This is not a pattern unique to one dataset. Independent coding from the World Bank’s Deep Trade Agreements database tells the same story from a different angle.^[10] Across 204 Asia-Pacific agreements, the provisions that protect, such as export controls, services liberalisation, intellectual property, are legally enforceable 93 to 98 per cent of the time. The provisions that promote technology sharing, such as research cooperation, innovation policy, data protection cooperation, are enforceable only 6 to 27 per cent of the time. That leaves us with the restrictions as law and the commitments to share as suggestions.

Why it matters

This gap between restriction and access has real consequences, and they fall hardest on the economies that can least afford them.

Think about what it means for developing and least developed countries in the Asia-Pacific region. Their government payroll, health records and disaster communications all run on a foreign cloud platform, and their sole submarine cable connects it to the internet. That country’s trade agreements guarantee the right to invoke security exceptions, and their technology suppliers are not even bound to provide the services they depend on. Therefore, trade agreements do not guarantee that country continued access to the services it depends on when the next cyclone hits or the next round of export controls tightens.

When the Hunga Tonga eruption severed Tonga’s submarine cable in January 2022, restoring connectivity required satellite capacity, network equipment and cloud migration — every one of which crosses a border governed by these agreements.^[11] At no point did any trade instrument give Tonga a right to expedited access. Everything was discretionary. The trade architecture, in other words, has plenty of tools for saying no and very few for guaranteeing yes.

The conceptual drift from territorial security toward economic security only deepens the problem.^[12] When semiconductor supply chains, cloud infrastructure and AI capabilities are all framed as essential security interests, the range of measures that can shelter under the exception expands to cover the subject matter of innovation trade itself. Whether “emergency in international relations” should stretch to encompass competitive technological rivalry is a question the jurisprudence has only begun to address^[13] — but negotiators are not waiting for the answer. They are writing it into treaty text.

I have written about this broader dynamic in the context of the 2025 US tariffs, and it connects to the questions about data governance and sovereignty that run through the digital trade space. A recent restriction on the availability of Anthropic’s latest model in restricted-tier jurisdictions further develops the point.^[14] This is a direct allocation of who may access a technology, justified on security grounds, with no sunset clause and no multilateral discipline. For any economy in the Asia-Pacific hoping to use frontier AI for public health, disaster preparedness or agricultural extension, the message is straightforward. Access depends on which tier you fall into, and you have no seat at the table where the tiers are drawn.

The normalisation of emergency in trade governance is more than a drafting trend. It is a structural reallocation of who gets access to technology and on what terms. And at the moment, the architecture is tilted decisively in favour of those who already have it.

References