Welcome, Australia, to the American culture wars.

With passage of the US National Defense Authorization Act a mere two and a half months late, we’ve seen the first significant legislative action since the AUKUS partnership was announced more than two years ago. This is not the end; it’s the beginning. Much work remains. And Australia now has an important stake in the annual US ritual in which global stability and security are held hostage to political partisanship and whim.

Don’t think you’ve seen the last of the drama. If Australians have learned anything from past efforts at closer partnership with the US, it’s that legislation is just the start of a long rulemaking process. Too often in that process, lofty ideals are buried in bureaucratic inertia and vested interests. We saw it in 2009 with the defence trade cooperation treaties. We saw it again in 2015 with expansion of the US national technology and industrial base. Both initiatives began with grand visions of deep and enduring defence-industry collaboration. Both foundered on the rocks of regulatory implementation.

First, the good news. The NDAA gives Australia and the broader AUKUS partnership some clear wins. Included in the act is authorisation to sell Australia up to three Virginia-class submarines, meeting the first test of the optimal pathway set out by AUKUS leaders in March. It acknowledges the long-term goal of increasing that number to five, subject to constraints in US industrial capacity. Nuclear-powered, conventionally armed submarines will be a transformative capability for a nation dependent on stability in the Indo-Pacific. They will provide the reach Australia needs to address threats to national security before they arrive on its shores.

Although its funding provisions remain subject to a subsequent appropriations bill, the NDAA authorises substantial infrastructure investment in the Royal Australian Air Force’s northern bases. RAAF Base Darwin has been allocated US$135 million for a new aircraft parking apron and squadron operations facility (on top of the US$72 million appropriated last year). RAAF Tindal will get a new bomber apron along with aircraft maintenance support and squadron operations facilities worth a total of US$130.5 million.

Other provisions have promise. Australia will be considered (nearly) equivalent to domestic sources under the US Defense Production Act, increasing the opportunities for Australian businesses to sell into US markets. The change comes with a proviso that any associated products must not be available from US sources. This second-best solution was likely necessary to win support from key US constituencies but is still a step in the right direction.

Acknowledging the importance of logistics to the vast Indo-Pacific theatre, the act creates a demonstration and prototyping program that will identify, develop and field allied capabilities to mitigate risks in a contested logistics environment.

It establishes an Indo-Pacific maritime domain awareness Initiative to enhance the ability of partners to monitor the region for emerging threats.

It makes important strides in information sharing, creating an administrative body to oversee modifications to US foreign disclosure policies. The plan would establish a new information-handling caveat specific to the AUKUS partnership. It would reduce use of the ‘not releasable to foreign nations’, or NOFORN, caveat that has been such a large obstacle to past cooperation.

The big question comes in the area of export control. After two previous attempts, can we finally break the logjam created by the US International Traffic in Arms Regulations (ITAR) and enable broad cooperation across partner-nation defence industrial bases?

In this regard, the NDAA makes all the right noises. It authorises expedited processing of approvals for foreign military and direct commercial sales to Australia and the UK (while remaining vague on associated resourcing). An anticipatory release policy would set up pre-approval mechanisms for foreign military and direct commercial sales related to AUKUS Pillar 1 and Pillar 2 technologies.

Following certification that partner nations have implemented export controls comparable to those in the US, it would exempt most technology transfers from licensing requirements. The scope would be broad, including re-exports, temporary imports and brokering activities. Australia would gain levels of US industrial-base access currently available only to Canada.

But as I’ve written before, the devil is in the details. What would it mean for Australia to create a ‘comparable’ export-control regime? Is it capable of doing so without creating the same problems as the US system? Would access to US markets make such a tightening of the rules worthwhile?

Many Australian businesses, offered such a bargain, would say, ‘No, thanks.’ They’ve seen the US system in action and want no part of it. But contrary to common perceptions, such an arrangement would not sacrifice Australian sovereignty over its defence exports. It would merely bring its rules up to a global standard on protection of sensitive technologies.

The problem with ITAR is not its overarching principles. Defence technologies must be protected, and it’s hard to argue that any one of ITAR’s broad regulatory provisions isn’t necessary to that end.

The problem is in the way the rules are implemented. Resourcing is inadequate and wait times are long. Misaligned incentives prevent sound analysis of risk and appropriate balancing of costs and benefits. The rules are a blunt instrument, ignoring existing alliances, varying levels of trust and the capacity of partners’ export-control systems. They freeze the US industrial base in a Cold War mindset and the antiquated assumption that little of value happens abroad.

Past debate has been illuminating. Businesses claim that the rules stifle their ability to collaborate internationally. Policymakers reply that there is no problem with the current system: all of the necessary rules are in place to enable that collaboration. Neither side is wrong. Yet everyone has been talking past each other for decades.

Many businesses have a hard time accepting that significant costs come with operating in defence markets. Zero progress in defence innovation is preferrable to a system in which new capabilities are readily obtainable by strategic competitors.

At the same time, export-control administrators have a hard time seeing that not everyone possesses their level of regulatory expertise. Not everyone has pockets deep enough to hire lawyers and cover the payroll while they wait months for faceless bureaucrats to approve a sale. Byzantine rules and draconian penalties kill collaboration in a world without perfect knowledge.

The key to a successful system is not zero risk, but careful risk management. What’s needed is not a feasible path to collaboration, but a clear path to collaboration.

Notwithstanding the significance of this legislation, we must be careful not to declare victory too soon. Significant obstacles remain. It gets the basics right, not least of which is advancing the narrative that the AUKUS partnership is serious. But it leaves implementation of critical provisions up to a bureaucracy that has historically been unable to solve such thorny problems. It relies not on removing bad rules, but on creating more rules.

What is it they say about trying the same thing over and over again, and each time expecting a different result?