Photo: Oleksii Samsonov/Global Images Ukraine/Getty Images
Informed by more than a decade of documenting recovered weapons systems in conflicts, a 2023 investigation in Ukraine encountered one of the first Russian-produced copies of the Iranian-designed Shahed-136 one-way attack drone. Inside its Russian-produced satellite navigation unit was a foreign-developed Global Navigation Satellite System (GNSS) chip. The investigation followed a familiar path: Identify the technology, reconstruct its procurement pathway, and understand how it had came to be part of a Russian weapon despite export controls and sanctions.
The component could be identified, the manufacturer engaged, and the diversion pathway reconstructed. Those steps remain fundamental to technical exploitation. They support attribution, strengthen export-control enforcement, inform sanctions, and help manufacturers protect their technologies from future diversion.
But the discovery raised a different question.
Once the critical component had been identified and its diversion pathway reconstructed, that procurement pathway was revealed to the manufacturer and relevant authorities. Whether through export controls, sanctions, enhanced corporate due diligence, or law enforcement action, it was reasonable to assume that the pathway would not remain equally effective indefinitely. If Russia intended to manufacture these drones at scale, it would eventually have to adapt.
Working with the manufacturer made it possible to anticipate not only how Russia would adapt, but when that adaptation would become necessary. Knowing how many navigation modules had reached the diversion network made it possible to estimate when existing stocks would likely be exhausted and when a new procurement solution would become necessary.
The investigation therefore shifted from reconstructing a past procurement network to anticipating its successor.
Which commercially available navigation modules could perform the same function with minimal engineering changes? Who manufactures those alternatives? Which new procurement networks might emerge? What purchasing patterns would signal that procurement agents had begun seeking substitutes? And how could manufacturers, investigators, and policymakers identify those efforts before those components appeared in future battlefield recoveries?
The value of asking those questions extended well beyond a single investigation. They pointed toward a different way of using battlefield evidence to curtail the future flow of U.S. and allied technologies to adversaries. Instead of reacting to each newly discovered procurement pathway, investigators and policymakers could begin anticipating the next one before it matured.
That experience exposed a broader limitation in prevailing thinking about battlefield technical exploitation.
Technical exploitation has improved understanding of how components reached the battlefield. What is largely missing is an equally systematic effort to ask what those components reveal about an adversary’s next procurement decision.
This distinction offers a way beyond what CSIS analysts have described as a reactive “whack-a-mole” approach to export-control enforcement. Rather than waiting for adversaries to establish new procurement pathways before attempting to disrupt them, technical exploitation can help anticipate how those pathways are likely to evolve once existing ones have been identified. In doing so, it enables policymakers to shift from reacting to adaptations toward preparing for them in advance.
Tracing and attribution should no longer mark the end of technical exploitation. They should mark the beginning of anticipation.
Modern sanctions, export controls, and enforcement measures increasingly confront a common challenge: adaptive adversaries. Every successful disruption—whether a sanctions designation, a criminal prosecution, an export-control action, or a corporate compliance decision—changes the procurement environment. Procurement networks respond by finding new suppliers, creating replacement intermediaries, and moving transactions through different jurisdictions. After the Ostec Group was sanctioned, for example, suppliers redirected equipment to a replacement Russian recipient while a Kazakhstan-based company made hundreds of shipments into the same network. They also adapt by substituting commercially available technologies and redesigning systems to reduce their exposure to sanctions and supply chain disruption. Yet despite this predictable pattern, policymaking remains largely reactive. Governments typically respond only after those new procurement pathways have already emerged.
Adaptive adversaries require adaptive policymaking.
Closing this gap does not necessarily require new authorities, institutions, or investigative capabilities. Rather, it requires extracting greater policy value from information governments already possess. Every recovered weapons system contains evidence not only of how an adversary acquired yesterday’s technology, but also of the engineering constraints, procurement dependencies, and commercial realities that will shape its next acquisition decisions. The question is whether investigators are asked to produce those insights, and whether policymakers are prepared to use them.
For more than two decades, U.S. technical-exploitation programs have used recovered devices to connect incidents, identify their makers, support criminal investigations, and anticipate future threats. More recently, components recovered from missiles and drones have informed export-control priorities and industry compliance warnings. The limitation of technical exploitation is not analytical, but temporal. By the time a new procurement pathway appears in a recovered weapon, the adversary has already adapted. Policymakers are once again responding to yesterday’s procurement decisions rather than preparing for tomorrow’s.
Technical exploitation is uniquely positioned to change that dynamic.
Recovered materiel reveals far more than past procurement pathways. It reveals engineering dependencies, component criticality, production choices, manufacturing constraints, commercial availability, and substitution opportunities. Properly analyzed, those observations provide policymakers with decision advantage. They allow investigators to assess not only how an adversary acquired a critical technology, but how it is likely to adapt once that pathway has been identified and subjected to greater scrutiny.
Traditional technical exploitation and anticipatory technical exploitation therefore answer different, but complementary, questions.
The second column does not replace the first. Accurate identification, documentation, tracing, and attribution remain indispensable. Anticipatory technical exploitation depends upon them. Without a robust understanding of yesterday’s procurement decisions, there is no reliable basis for anticipating tomorrow’s.
The difference lies in what happens after tracing and attribution have been completed.
Tracing and attribution should no longer mark the end of technical exploitation. They should mark the beginning of anticipation.
That transition begins with a substitution assessment.
The proposal is not that every underlying technique is new. Investigators, governments, and manufacturers already compare alternative parts and monitor successor intermediaries in different contexts. What is new is assembling those practices into a repeatable follow-on product: a substitution assessment. Prepared once a critical component or procurement pathway has been identified, it evaluates how an adversary will adapt once that procurement pathway becomes less effective. It identifies technically compatible alternatives, likely procurement pathways, engineering implications, and observable indicators that could reveal emerging acquisition efforts before substitute components appear on the battlefield.
For investigators, substitution assessments extend technical exploitation from reconstruction to anticipation. For policymakers, they provide decision advantage by identifying where future procurement efforts are most likely to emerge, allowing governments to prepare sanctions, export controls, law enforcement actions, customs targeting, and industry engagement before those pathways mature.
Traditional technical exploitation explains how adversaries acquired yesterday’s technology. Anticipatory technical exploitation helps policymakers influence how they acquire tomorrow’s.
Anticipating adaptation creates value only if policymakers act on it.
This is where anticipatory smart friction begins. If anticipatory technical exploitation provides policymakers with earlier insight into how adversaries are likely to adapt, anticipatory smart friction provides the framework for acting on that insight.
The objective is not to stop the flow of technology entirely. Adaptive adversaries will continue to establish new procurement networks, identify substitute technologies, and exploit global supply chains. Rather, the objective is to introduce targeted frictions that make acquiring, integrating, and sustaining those technologies slower, more expensive, less reliable, more visible, and ultimately less effective.
Sanctions and export controls are commonly assessed in terms of whether they constrain an adversary’s access to critical technologies. But the Government Accountability Office has found that U.S. agencies lack clearly defined objectives linked to measurable outcomes for assessing their broader effectiveness. For adaptive adversaries, a single denied acquisition is therefore an incomplete measure of success. The more useful policy question is not whether adaptation occurs, but whether governments can influence how that adaptation occurs.
The objective is not to prevent adaptation—but to shape it. In other words, policymakers should seek to influence not only whether adversaries procure technology, but how they procure it.
Every successful disruption should therefore trigger a forward-looking assessment of how the adversary is most likely to respond and where the next opportunity to introduce friction lies. Rather than waiting for new procurement pathways to emerge, policymakers can use anticipatory technical exploitation to prepare sanctions, export controls, law enforcement actions, customs targeting, and anticipatory industry engagement before those pathways mature.
In practice, this means deliberately channeling adversaries toward increasingly poor procurement choices. A preferred component may be replaced only by alternatives requiring engineering modifications. Procurement may shift toward gray market suppliers with greater exposure to counterfeit products. Newly established intermediaries may be more visible to financial institutions and customs authorities. Technology may continue to flow, but at greater cost, greater uncertainty, longer timelines, and higher operational risk.
Success should therefore be measured not only by what has been denied, but by how adversaries are forced to adapt. If adaptation becomes slower, more expensive, less reliable, more visible, or more vulnerable to future disruption, policy has introduced meaningful friction—even when procurement continues.
Operationalizing anticipatory smart friction does not require new institutions. It requires integrating anticipation into the existing relationship between investigators, policymakers, law enforcement, and industry. Five practical changes would help governments make that shift:
Adaptive adversaries require adaptive policymaking. Governments that systematically anticipate adaptation, engage tomorrow’s diversion targets before they become today’s, and deliberately shape the conditions under which procurement occurs will be better positioned to sustain pressure on adversaries over the long term.
Technical exploitation has transformed how governments understand illicit procurement. It has strengthened attribution, informed sanctions and export controls, supported criminal investigations, and helped manufacturers protect their technologies from diversion. Those contributions remain indispensable.
But adaptive adversaries demand more than retrospective analysis. Every successful disruption changes the procurement environment, creating an opportunity not simply to understand how an adversary acquired today’s technology, but to anticipate how it will acquire tomorrow’s.
Tracing and attribution should no longer mark the end of technical exploitation. They should mark the beginning of anticipation.
Sanctions and export controls are often dismissed as an endless game of cat and mouse. They need not be. The objective is no longer to chase the next procurement pathway after it emerges, but to anticipate it before it does.
Adaptive adversaries require adaptive policymaking. Anticipatory technical exploitation provides the analytical foundation for that shift. Anticipatory smart friction translates that analysis into policy.
Damien Spleeters is a non-resident senior associate of the Economics Program and Scholl Chair in International Business at the Center for Strategic and International Studies in Washington, D.C.