Originally Published: 04 JAN 23 06:00 ET

Updated: 04 JAN 23 13:51 ET

By Natasha Bertrand

(CNN) -- Parts made by more than a dozen US and Western companies were found inside a single Iranian drone downed in Ukraine last fall, according to a Ukrainian intelligence assessment obtained exclusively by CNN.

The assessment, which was shared with US government officials late last year, illustrates the extent of the problem facing the Biden administration, which has vowed to shut down Iran's production of drones that Russia is launching by the hundreds into Ukraine.

CNN reported last month that the White House has created an administration-wide task force to investigate how US and Western-made technology -- ranging from smaller equipment like semiconductors and GPS modules to larger parts like engines -- has ended up in Iranian drones.

Of the 52 components Ukrainians removed from the Iranian Shahed-136 drone, 40 appear to have been manufactured by 13 different American companies, according to the assessment.

The remaining 12 components were manufactured by companies in Canada, Switzerland, Japan, Taiwan, and China, according to the assessment.

The options for combating the issue are limited. The US has for years imposed tough export control restrictions and sanctions to prevent Iran from obtaining high-end materials. Now US officials are looking at enhanced enforcement of those sanctions, encouraging companies to better monitor their own supply chains and, perhaps most importantly, trying to identify the third-party distributors taking these products and re-selling them to bad actors.

NSC spokesperson Adrienne Watson told CNN in a statement that "We are looking at ways to target Iranian UAV production through sanctions, export controls, and talking to private companies whose parts have been used in the production. We are assessing further steps we can take in terms of export controls to restrict Iran's access to technologies used in drones."

There is no evidence suggesting that any of those companies are running afoul of US sanctions laws and knowingly exporting their technology to be used in the drones. Even with many companies promising increased monitoring, controlling where these highly ubiquitous parts end up in the global market is often very difficult for manufacturers, experts told CNN. Companies may also not know what they are looking for if the US government has not caught up with and sanctioned the actors buying and selling the products for illicit purposes.

And the Ukrainian intelligence assessment is further proof that despite sanctions, Iran is still finding an abundance of commercially available technology. For example, the company that built the downed drone, Iran Aircraft Manufacturing Industries Corporation (HESA), has been under US sanctions since 2008.

A game of whack a mole worth playing

One major issue is that it is far easier for Russian and Iranian officials to set up shell companies to use to purchase the equipment and evade sanctions than it is for Western governments to uncover those front companies, which can sometimes take years, experts said.

"This is a game of Whack-a-Mole. And the United States government needs to get incredibly good at Whack-a- Mole, period," said former Pentagon official Gregory Allen, who now serves as Director of the Artificial Intelligence Governance Project at the Center for Strategic and International Studies. "This is a core competency of the US national security establishment -- or it had better become one."

Allen, who recently co-authored an investigation into the efficacy of US export controls, said ultimately, "there is no substitute for robust, in-house capabilities in the US government."

He cautioned that it is not an easy job. The microelectronics industry relies heavily on third party distributors and resellers that are difficult to track, and the microchips and other small devices ending up in so many of the Iranian and Russian drones are not only inexpensive and widely available, they are also easily hidden.

"Why do smugglers like diamonds?" Allen said. "Because they're small, lightweight, and worth a ton of money. And unfortunately, computer chips have similar properties." Success won't necessarily be measured in stopping 100% of transactions, he added, but rather in making it more difficult and expensive for bad actors to get what they need.

'A prolonged attack' with Iranian drones

The rush to stop Iran from manufacturing the drones is growing more urgent as Russia continues to deploy them across Ukraine with relentless ferocity, targeting both civilian areas and key infrastructure. Russia is also preparing to establish its own factory to produce them with Iran's help, according to US officials. On Monday, Ukrainian President Volodymyr Zelensky said that Ukrainian forces had shot down more than 80 Iranian drones in just two days.

Zelensky also said that Ukraine had intelligence that Russia "is planning a prolonged attack with Shaheds," betting that it will lead to the "exhaustion of our people, our air defense, our energy sector."

A separate probe of Iranian drones downed in Ukraine, conducted by the UK-based investigative firm Conflict Armament Research, found that 82% of the components had been manufactured by companies based in the US.

Damien Spleeters, the Deputy Director of Operations at Conflict Armament Research, told CNN that sanctions will only be effective if governments continue to monitor what parts are being used and how they got there.

"Iran and Russia are going to try to go around those sanctions and will try to change their acquisition channels," Spleeters said. "And that's precisely what we want to focus on: getting in the field and opening up those systems, tracing the components, and monitoring for changes."

Experts also told CNN that if the US government wants to beef up enforcement of the sanctions, it will need to devote more resources and hire more employees who can be on the ground to track the vendors and resellers of these products.

"Nobody has really thought about investing more in agencies like the Bureau of Industry Security, which were really sleepy parts of the DC national security establishment for a few decades," Allen, of CSIS, said, referring to a branch of the Commerce Department that deals primarily with export controls enforcement. "And now, suddenly, they're at the forefront of national security technology competition, and they're not being resourced remotely in that vein."

US companies say they are complying with US law

According to the Ukrainian assessment, among the US-made components found in the drone were nearly two dozen parts built by Texas Instruments, including microcontrollers, voltage regulators, and digital signal controllers; a GPS module by Hemisphere GNSS; a microprocessor by NXP USA Inc.; and circuit board components by Analog Devices and Onsemi. Also discovered were components built by International Rectifier -- now owned by the German company Infineon -- and the Swiss company U-Blox.

CNN sent emailed requests for comment last month to all the companies identified by the Ukrainians. The six that responded emphasized that they condemn any unauthorized use of their products, while noting that combating the diversion and misuse of their semiconductors and other microelectronics is an industry-wide challenge that they are working to confront.

"TI is not selling any products into Russia, Belarus or Iran," Texas Instruments said in a statement. " TI complies with applicable laws and regulations in the countries where we operate, and partners with law enforcement organizations as necessary and appropriate. Additionally, we do not support or condone the use of our products in applications they weren't designed for."

Gregor Rodehuser, a spokesperson for the German semiconductor manufacturer Infineon, told CNN that "our position is very clear: Infineon condemns the Russian aggression against Ukraine. It is a blatant violation of international law and an attack on the values of humanity." He added that "apart from the direct business it proves difficult to control consecutive sales throughout the entire lifetime of a product. Nevertheless, we instruct our customers including distributors to only conduct consecutive sales in line with applicable rules."

Analog Devices, a semiconductor company headquartered in Massachusetts, said in a statement that they are intensifying efforts "to identify and counter this activity, including implementing enhanced monitoring and audit processes, and taking enforcement action where appropriate...to help to reduce unauthorized resale, diversion, and unintended misuse of our products."

Jacey Zuniga, director of corporate communications for the Austin, Texas-based semiconductor company NXP USA, said that the company "complies with all applicable export control restrictions and sanctions imposed by the countries in which we operate. Military applications are not a focus area for NXP. As a company, we are vehemently opposed to our products being used for human rights violations."

Phoenix, Arizona-based semiconductor manufacturing company Onsemi also said it complies with "applicable export control and economic sanctions laws and regulations and does not sell directly or indirectly to Russia, Belarus or Iran nor to any foreign military organizations. We cooperate with law enforcement and government agencies as necessary and appropriate to demonstrate how Onsemi conducts business in accordance with all legal requirements and that we hold ourselves to the highest standards of ethical conduct."

Swiss semiconductor manufacturer U-Blox also said in a statement that its products are for commercial use only, and that the use of its products for Russian military equipment "is in clear breach of u-blox's conditions of sale applicable to customers and distributors alike."

This story has been updated with a comment from the National Security Counsel