Export Controls
Agencies Should Assess Vulnerabilities and Improve Guidance for Protecting Export-Controlled Information at Universities Gao ID: GAO-07-70 December 5, 2006Foreign students and scholars have made substantial contributions to U.S. research efforts and technology development. However, according to a federal government intelligence assessment, foreign access to sensitive U.S. technology has imposed a significant but unquantifiable cost to the United States. Given this risk, GAO was asked to (1) describe the nature of the research at universities and identify steps they take to comply with export controls and (2) assess efforts by the Departments of Commerce and State--the key export control agencies--to determine the risk of export violations in university research. GAO reviewed Commerce and State export control programs and met with officials from 13 universities, selected based on their foreign student populations, applications for export licenses, and federal grants and contracts.
The U.S. export control system requires export licensing for defense items and items that have both commercial and military applications, except where exclusions apply, such as those applicable to universities in some circumstances. The U.S. export control agencies place the onus on universities to understand and comply with the regulations. According to university officials we interviewed, their institutions focus almost exclusively on fundamental research--defined as basic and applied research in science and engineering, the results of which ordinarily are published and shared broadly within the scientific community. Such research is generally not subject to export controls. Universities we visited conduct research in such areas as nanotechnologies, computer security, and chemical engineering. To ensure their research remains in the public domain, university officials said they negotiate contract language to remove publication or other dissemination restrictions for research they consider to be fundamental. If export controls apply, university officials stated they sometimes involve only those students eligible to conduct the research under a license exclusion, to avoid the lengthy license application process. In other cases, they refer such work to off-campus associated facilities that can better regulate and control foreign national access to the research. Universities we visited indicated that government-provided training and guidance on export control regulations is limited in informing their efforts to manage and protect export-controlled information in the university environment. State and Commerce officials expressed concerns that universities may not correctly interpret and apply export regulations, given the large number of foreign students participating in research at universities and the relative lack of license applications from universities. Although federal internal control standards contain guidelines for agencies to conduct risk assessments, State and Commerce have not conducted an overall assessment of available trend data on technology development research and foreign participation in such research at U.S. universities to identify potential vulnerabilities. For example, U.S. government agencies collect data on foreign student nationality, school enrollment, and types of research conducted at universities for federal agencies, which could supplement information that State and Commerce receive from visa application processes and other sources. Although State and Commerce provide guidance through training seminars, agency Web sites, and telephone help desks to assist exporters in understanding and complying with regulations, officials stated that their focus is on processing export license applications--primarily from industry. Recently, Commerce established an advisory committee composed of industry and university representatives who are expected to discuss issues such as the nature of university research and its relation to export controls.
RecommendationsOur recommendations from this work are listed below with a Contact for more information. Status will change from "In process" to "Open," "Closed - implemented," or "Closed - not implemented" based on our follow up work.
Director: Team: Phone:GAO-07-70, Export Controls: Agencies Should Assess Vulnerabilities and Improve Guidance for Protecting Export-Controlled Information at Universities
This is the accessible text file for GAO report number GAO-07-70
entitled 'Export Controls: Agencies Should Assess Vulnerabilities and
Improve Guidance for Protecting Export-Controlled Information at
Universities' which was released on December 5, 2006.
This text file was formatted by the U.S. Government Accountability
Office (GAO) to be accessible to users with visual impairments, as part
of a longer term project to improve GAO products' accessibility. Every
attempt has been made to maintain the structural and data integrity of
the original printed product. Accessibility features, such as text
descriptions of tables, consecutively numbered footnotes placed at the
end of the file, and the text of agency comment letters, are provided
but may not exactly duplicate the presentation or format of the printed
version. The portable document format (PDF) file is an exact electronic
replica of the printed version. We welcome your feedback. Please E-mail
your comments regarding the contents or accessibility features of this
document to Webmaster@gao.gov.
This is a work of the U.S. government and is not subject to copyright
protection in the United States. It may be reproduced and distributed
in its entirety without further permission from GAO. Because this work
may contain copyrighted images or other material, permission from the
copyright holder may be necessary if you wish to reproduce this
material separately.
Report to the Committee on the Judiciary, House of Representatives:
United States Government Accountability Office:
GAO:
December 2006:
Export Controls:
Agencies Should Assess Vulnerabilities and Improve Guidance for
Protecting Export-Controlled Information at Universities:
GAO-07-70:
GAO Highlights:
Highlights of GAO-07-70, a report to the Chairman, Committee on the
Judiciary, House of Representatives
Why GAO Did This Study:
Foreign students and scholars have made substantial contributions to
U.S. research efforts and technology development. However, according to
a federal government intelligence assessment, foreign access to
sensitive U.S. technology has imposed a significant but unquantifiable
cost to the United States.
Given this risk, GAO was asked to (1) describe the nature of the
research at universities and identify steps they take to comply with
export controls and (2) assess efforts by the Departments of Commerce
and State”the key export control agencies”to determine the risk of
export violations in university research. GAO reviewed Commerce and
State export control programs and met with officials from 13
universities, selected based on their foreign student populations,
applications for export licenses, and federal grants and contracts.
What GAO Found:
The U.S. export control system requires export licensing for defense
items and items that have both commercial and military applications,
except where exclusions apply, such as those applicable to universities
in some circumstances. The U.S. export control agencies place the onus
on universities to understand and comply with the regulations.
According to university officials we interviewed, their institutions
focus almost exclusively on fundamental research”defined as basic and
applied research in science and engineering, the results of which
ordinarily are published and shared broadly within the scientific
community. Such research is generally not subject to export controls.
Universities we visited conduct research in such areas as
nanotechnologies, computer security, and chemical engineering. To
ensure their research remains in the public domain, university
officials said they negotiate contract language to remove publication
or other dissemination restrictions for research they consider to be
fundamental. If export controls apply, university officials stated they
sometimes involve only those students eligible to conduct the research
under a license exclusion, to avoid the lengthy license application
process. In other cases, they refer such work to off-campus associated
facilities that can better regulate and control foreign national access
to the research. Universities we visited indicated that government-
provided training and guidance on export control regulations is limited
in informing their efforts to manage and protect export-controlled
information in the university environment.
State and Commerce officials expressed concerns that universities may
not correctly interpret and apply export regulations, given the large
number of foreign students participating in research at universities
and the relative lack of license applications from universities.
Although federal internal control standards contain guidelines for
agencies to conduct risk assessments, State and Commerce have not
conducted an overall assessment of available trend data on technology
development research and foreign participation in such research at U.S.
universities to identify potential vulnerabilities. For example, U.S.
government agencies collect data on foreign student nationality, school
enrollment, and types of research conducted at universities for federal
agencies, which could supplement information that State and Commerce
receive from visa application processes and other sources. Although
State and Commerce provide guidance through training seminars, agency
Web sites, and telephone help desks to assist exporters in
understanding and complying with regulations, officials stated that
their focus is on processing export license applications”primarily from
industry. Recently, Commerce established an advisory committee composed
of industry and university representatives who are expected to discuss
issues such as the nature of university research and its relation to
export controls.
What GAO Recommends:
GAO recommends that Commerce and State use available information to
assess potential vulnerabilities and based on this assessment improve
outreach, guidance, and interagency coordination. The agencies
generally concurred, but State disagreed with our recommendation on
assessing vulnerabilities. Broader assessments would increase State‘s
knowledge of risks and help improve its guidance to universities.
[Hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-07-70].
To view the full product, including the scope and methodology, click on
the link above. For more information, contact John Hutton at (202) 512-
7773 or huttonj@gao.gov.
[End of Section]
Contents:
Letter:
Results in Brief:
Background:
Universities Focus on Fundamental Research to Comply with Export
Regulations:
State and Commerce Have Not Assessed the Potential Risk to Export-
Controlled Information at Universities:
Conclusions:
Recommendations for Executive Actions:
Agency Comments and our Evaluation:
Appendix I: Scope and Methodology:
Appendix II: Comments from the Department of Commerce:
Appendix III: Comments from the Department of State:
Appendix IV: Staff Contact and Acknowledgments:
Table:
Table 1: Examples of Research Areas Conducted at Universities Visited
by GAO:
Figure:
Figure 1: Basic and Applied U.S.-Based Research Funding Sources for
Universities and Colleges in Fiscal Year 2003:
Abbreviations:
BIS: Bureau of Industry and Security:
DDTC: Directorate of Defense Trade Controls:
DOD: Department of Defense:
EAR: Export Administration Regulations:
ITAR: International Traffic in Arms Regulations:
NASA: National Aeronautics and Space Administration:
SEVIS: Student and Exchange Visitor Information System:
United States Government Accountability Office:
Washington, DC 20548:
December 5, 2006:
The Honorable F. James Sensenbrenner, Jr.
Chairman:
Committee on the Judiciary:
House of Representatives:
Dear Mr. Chairman:
U.S. national security and economic interests are heavily dependent on
technological innovation and advantage. Many of the nation's leading-
edge technologies, including defense-related technologies, are being
discovered by American and foreign national students and scholars in
U.S. university research and university-affiliated laboratories. As the
Department of Defense (DOD) invests less and less of its funding on in-
house research and development, university-based discoveries are
becoming increasingly vital to national security and other U.S.
interests.
To mitigate the risk of technology and knowledge falling into the wrong
hands, the U.S. government--primarily the Departments of State and
Commerce--controls the transfer of defense and "dual use"
information.[Footnote 1] However, controlling the transfer of such
information presents special challenges. U.S. export control
regulations allow foreign students and researchers without export
licenses to partake in fundamental research, defined to mean basic and
applied research in science and engineering, the results of which are
ordinarily published and shared broadly within the scientific
community.[Footnote 2] U.S. policymakers recognize that foreign
students and researchers have made substantial contributions to U.S.
research efforts, but the potential transfer of knowledge of controlled
defense-related technologies to their home countries could have
significant consequences for U.S. national interests. In a September
2005 testimony before Congress, the National Counterintelligence
Executive stated that while the vast majority of foreign students in
the United States are legitimately studying and advancing academic
pursuits, some seek to acquire sensitive U.S. technologies to advance
their own countries' economic and military interests. Additionally,
while not limited to foreign students, a 2005 federal report noted that
the technology lost as a result of foreign efforts to target sensitive
U.S. technologies has imposed a significant, but difficult to quantify,
cost on the United States.[Footnote 3]
On the basis of your interest in continuing to attract foreign students
and researchers to U.S. universities while protecting export-controlled
information, you asked us to look at how academic institutions and the
U.S. government protect against the illegal disclosure of such
information. In response, we (1) described the nature of the research
conducted at universities and identified the steps they have taken to
comply with government export control regulations and (2) assessed the
efforts of the Departments of Commerce and State to determine the risk
of export violations in university research.
To conduct our work, we met with officials from the Departments of
Commerce and State and analyzed their regulations, guidance, and
training. We also met with officials in the Department of Defense--
which participates in the export control regulatory process--and the
Department of Homeland Security--which has responsibility for tracking
foreign students and scholars during their course of study in the
United States. We visited 13 universities that were systematically
selected based on their international student populations, export
license applications, and federal grants and contracts. At the
universities, we spoke with officials in such positions as vice
chancellor for research, director of compliance, and general counsel,
among others. While our selection criteria included a range of
university experiences with export controls and foreign students and
scholars, the universities' views stated in this report do not
represent the entirety of the U.S. academic community. We also spoke
with officials from various research institutes and academic
associations. Additional details on the scope and methodology of our
review can be found in appendix I. We conducted our review from March
through November 2006 in accordance with generally accepted government
auditing standards.
Results in Brief:
According to university officials we interviewed, their institutions
focus almost exclusively on fundamental research, which is generally
not subject to export controls. By conducting fundamental research in
areas such as artificial intelligence, nanotechnology, and robotics,
universities can openly share and publish their research findings
within a broad community that includes international students and
scholars. To ensure their research remains in the public domain, most
university officials said they extensively screen and review potential
contracts and grants for fundamental research to ensure there are no
publication or other dissemination restrictions. If export controls
apply, university officials stated they sometimes reject the research
contract, involve only students and scholars who can conduct the
research under license exclusions, or refer such work to associated
facilities and laboratories located off-campus that can better regulate
and control foreign national access to such research. The U.S. export
control system relies on universities to understand and correctly
determine when export regulations apply and to follow the regulations
accordingly. To educate themselves on export control issues, academic
officials take training courses offered through Commerce, State, and
university associations; search government and other Web sites; request
guidance from knowledgeable officials at other universities; and hire
outside legal counsel and expertise on export controls. However, the
universities we visited indicated that government-provided training and
guidance on export regulations is limited in informing their efforts to
manage and protect export-controlled information, and it does not
clarify when fundamental research exclusions should apply.
Although State and Commerce provide some guidance and training to
assist exporters in understanding and complying with export
regulations, these agencies have not fully assessed the potential for
transfers of export-controlled information to foreign nationals in the
course of U.S. university research. State and Commerce target their
resources to processing license applications and provide assistance to
exporters through guidance, training, and other outreach. However, they
rarely coordinate these efforts or strategize their outreach on export
controls to the academic community. Furthermore, officials expressed
concerns that universities may not correctly interpret and apply export
regulations--a concern raised by the rarity of export license
applications from U.S. academic institutions, considering the large
foreign student and scholar populations studying and conducting
research in the United States. However, the agencies have not conducted
an overall assessment of available data on foreign participation in
research at U.S. universities to determine whether such research would
require export protections. For example, U.S. government agencies
collect data on foreign student nationality, school enrollment, and
federally-funded research conducted at universities, which could
supplement information that State and Commerce receive from visa
application processes and other leads. Furthermore, State and Commerce
outreach efforts have been largely reactive, and they have only
recently begun to engage with the affected research community in forums
to promote dialogue on issues such as fundamental research and its
relation to export controls.
To improve their oversight of export-controlled information at
universities, we are recommending that the Secretaries of Commerce and
State direct their export control entities to strategically assess
potential vulnerabilities in the conduct and publication of academic
research through analyzing available information on technology
development and foreign student populations at universities. This could
help to determine the extent to which research at universities may be
subject to export controls. Furthermore, we recommend that, on the
basis of this assessment, Commerce and State further coordinate efforts
and improve guidance and outreach to ensure that universities
understand when to apply export controls.
The Department of Commerce generally agreed with our report and
indicated that it has undertaken efforts to increase its outreach to
the academic community and plans to further assess vulnerabilities and
more precisely target outreach and compliance efforts. The Department
of State agreed with our recommendation to improve interagency
coordination on training and guidance for universities and disagreed
with our report's finding that it does not assess the potential
vulnerabilities associated with export-controlled information at
academic institutions. However, we maintain that a trend analysis of
available data on foreign students and scholars and federal contracts
for research at academic institutions would be a valuable investment in
providing a proactive plan for targeting outreach and training for the
academic community. While State disagreed with our recommendation, in
its response it noted that it is considering conducting such an
assessment. In addition, the Departments of State and Homeland Security
provided technical comments that were incorporated as appropriate
throughout the report. The Department of Defense had no comments on
this report.
Background:
In November 2003, GAO reported that university research is a vital part
of the nation's research and development efforts, primarily funded by
the federal government because of the broad consensus that university
research is a long-term national investment in the future.[Footnote 4]
The federal investment in university research has yielded thousands of
inventions each year that have fostered the development of new
technologies, stimulated the creation of new jobs, and improved the
quality of life. These benefits come through open communication among
scientists and the sharing of research results. A National Academy of
Sciences official underscored the importance of this issue in September
2005 congressional testimony, stating that over 55 percent of the
engineering Ph.D. students in the United States are foreign-born and
that their research helps strengthen the United States in the fastest-
moving new technologies, some of which have potential defense-related
application.[Footnote 5]
Foreign students and scholars bring needed skills to our increasingly
knowledge-based economy, build bridges to other countries and
professional communities, and make other valuable contributions to our
society. These contributions are particularly important for maintaining
our competitiveness, fostering productivity and innovation, and
strengthening our workforce. While the United States has long been a
global leader in higher education and one of the most desired
destinations for foreign students, international competition for the
best and the brightest students and scholars is growing. Countries such
as China have improved their educational capacities, possibly
decreasing the incentives for students and scholars to study in the
United States. The recent slowing of foreign student enrollment in
United States universities and colleges has raised concerns about the
extent to which we will be able to continue attracting talented foreign
students and researchers to our universities and to our workforce after
they graduate while also maintaining our nation's security.
Recognizing the importance of balancing national security interests
with the need to allow the free exchange of information at U.S.
academic institutions of higher learning, the federal government is a
major funding source for research conducted at U.S. universities and
colleges. In fiscal year 2003, the federal government funded almost two-
thirds--approximately $29.6 billion--of all basic and applied research
funding provided to universities and colleges by external sources (see
fig. 1). Other sources of funding come from industry, nonprofit
organizations, as well as state and local governments.
Figure 1: Basic and Applied U.S.-Based Research Funding Sources for
Universities and Colleges in Fiscal Year 2003:
[See PDF for image]
Source: National Science Foundation data, GAO analysis.
[A] "Other" includes universities, colleges, and state and local
governments.
[End of figure]
According to National Science Foundation data for fiscal year 2003, the
National Institutes of Health of the Department of Health and Human
Services funded approximately 62 percent (about $14.1 billion) of all
federally funded science and technology research conducted by
universities and colleges. Other federal research funding sources
identified by university officials we spoke with include the National
Aeronautics and Space Administration (NASA); the National Science
Foundation; various Department of Defense agencies, including the Navy
and the Defense Advanced Research Projects Agency; and the Departments
of Energy, State, and Transportation. This level of government funding
was consistent with that of several of the universities we visited,
where officials stated that their research is primarily funded by
government grants and contracts, including contracts that are directed
toward industry and subsequently subcontracted, or "flowed through," to
universities.
Over the past several decades in which the current export control
system has been in effect, the global economy has changed
significantly. DOD continues to seek innovative technologies to meet
the needs of warfighters and to counter technologies developed by
potential U.S. adversaries. To achieve these ends, DOD has become more
willing to rely on the nondefense industry to supply its needs. DOD
increasingly relies on commercial research, for areas such as
information systems and telecommunications, where the cutting edge of
technological advancement lies. Such advances in communications
technology have been made possible to a large extent by basic research,
much of which was initially developed in universities and often
involved foreign students and scholars.
The U.S. export control system relies on the ability of exporters to
recognize when certain goods and services meet the criteria for
requiring an export license. The system is primarily divided between
two regulatory regimes, one managed by the Department of State and
another managed by the Department of Commerce. The regimes require
export licensing for defense-related items and information, including
data, except where exclusions apply. Both regulatory regimes include
exclusions applicable in some circumstances to universities and other
academic institutions of higher learning. The U.S. export control
system places the onus on universities and other exporters to
understand and comply with the export control regulations.
The Department of State Directorate of Defense Trade Controls (DDTC)
manages defense items through the International Traffic in Arms
Regulations (ITAR).[Footnote 6] State issues export licenses based on
the U.S. Munitions List, which identifies defense articles, services,
and related technical data that are controlled for export. Moreover,
the regulations state that unless otherwise expressly exempted or
excluded, an export license is required for the oral, visual, or
documentary transmission of technical data by U.S. persons to foreign
persons,[Footnote 7] by such means as in-person or telephone
discussions and written correspondence including electronic messages,
even when they are in the United States. The U.S. Munitions List
contains 21 categories, covering items such as weapons, chemical and
biological agents, missiles, and both commercial and military
satellites.
The Department of Commerce's Bureau of Industry and Security (BIS)
manages dual-use items, having both military and commercial
applications, through the Export Administration Regulations
(EAR).[Footnote 8] Under these regulations, exporters are to obtain
prior government authorization in the form of a license from BIS, or
determine that a license is not needed, before exporting dual-use
items. Commerce requires an export license for the release of
technology or software source code to a foreign national[Footnote 9]
because such a release is deemed to be an export[Footnote 10] to the
home country or countries of the foreign national, even if the person
is in the United States. Commerce regulates the dual-use items
specified in the EAR's Commerce Control List, which are controlled for
a variety of reasons, including restricting exports that could
significantly enhance a country's military potential, preventing
exports to countries that sponsor terrorism, and limiting the
proliferation of chemical, biological, and nuclear weapons and their
delivery systems. The Commerce Control List has 10 categories covering
items such as electronics, computers, telecommunications, and avionics.
Universities Focus on Fundamental Research to Comply with Export
Regulations:
Most of the universities we visited aim to ensure that their research
remains unrestricted and in the public domain by conducting fundamental
research, which is generally excluded from export controls. To ensure
that most of the research conducted on their campuses does not require
an export license, these universities negotiate to exclude any
restrictions on publishing and disseminating the results of the
research they consider to be fundamental. For research that may be
subject to export control regulations, the universities we visited have
taken steps to ensure that their personnel are informed about and
comply with these regulations.
Universities Focus on Conducting Fundamental Research:
According to most university officials, their institutions conduct
basic and applied science and engineering research in a wide variety of
areas, producing findings that are conducted, shared, and published
openly within a broad community that includes international students
and scholars. Table 1 lists examples of research areas conducted at
universities that we visited.
Table 1: Examples of Research Areas Conducted at Universities Visited
by GAO:
* Artificial intelligence;
* Atmospheric research;
* Biological sciences;
* Chemical engineering;
* Computational science and computer architecture;
* Computer security;
* Integrated circuit design and fabrication;
* Internet communications and advanced networking;
* Nanotechnologies;
* Physics;
* Remote sensing of Earth;
* Robotics.
Source: GAO analysis of universities' Web sites.
[End of table]
Most officials we spoke with stated that their universities
specifically seek out research contracts and grants that do not
restrict their ability to conduct fundamental research by extensively
screening and reviewing the terms of potential contracts and grants. If
a contract includes restrictions on fundamental research, some
universities attempt to negotiate the restrictive language out of the
contract. Some university officials noted that such negotiations have
become more frequent because government and industry contracting
officials are increasingly inserting restrictive language in contracts
for research that universities consider to be fundamental. For example,
according to university officials, DOD agencies sometimes insert
standard acquisition regulations language that prohibits the contractor
from releasing information, even unclassified information, outside of
the contractor's organization.[Footnote 11] According to university
officials, a rule proposed by DOD would have restricted universities
from sharing information with other academic institutions and
publishing research or otherwise making such information available in
the public domain.[Footnote 12] DOD revised the rule to minimize the
impact on fundamental research conducted at universities and
acknowledged that the free exchange of ideas is a foundational concept
of U.S. research and educational institutions.[Footnote 13] Several
universities we interviewed stated that if they are unsuccessful in
negotiating the restrictive language out of those research contracts
they consider to be fundamental, they sometimes reject the opportunity
to participate in the research.
For research subject to export control restrictions, universities may
modify the way the research is conducted to avoid the export license
application process--a process some officials characterized as time-
consuming and complicated. For example, officials at one university
said that instead of applying for an export license for one project,
they opted to use only researchers who are excluded from export license
requirements, such as U.S. citizens or foreign nationals with permanent
residency status. In other cases, university officials stated they move
export-controlled work to off-campus facilities and laboratories
administered by the universities or the entity sponsoring the contract,
where such research can be better segregated and controlled. At the six
university-administered laboratories that we visited, each used access
control systems such as badges and computer passwords. Such
restrictions limiting access to information at laboratories are not as
common on the main campuses we visited, where research information is
more openly available.
Efforts Undertaken by Universities to Understand and Comply with Export
Control Regulations:
According to a State official, U.S. export control regulations are
designed for "self-compliance." For the academic community
specifically, State officials said that it is the universities'
responsibility to conduct due diligence to determine whether their
research activities are subject to export laws, and to identify whether
an export license is required for foreign nationals within their
purview. University officials we spoke with have taken actions to
become educated on complex export control regulations--an undertaking
that several officials indicated requires an extensive time commitment
because the government does not provide sufficient guidance. Some
universities have also dedicated other resources to ensure they comply
with U.S. export control laws, such as hiring legal counsel.
To understand export control regulations, universities we visited
frequently rely on agency training and guidance. Several university
officials stated that they had attended training seminars sponsored by
Commerce, as well as conferences sponsored by the Society for
International Affairs, a nonprofit defense trade industry association
that sponsors events such as conferences and workshops to educate and
instruct the export community on all aspects of defense and commercial
exports and technology transfers.[Footnote 14] Most university
officials indicated that they also accessed Commerce and State Web
sites or their respective telephone help desks.
However, several university officials indicated that the agency
training and guidance have limited utility for academic institutions.
For example, according to some university officials, training provided
by Commerce and State does not discuss how export regulations apply to
universities that have fundamental research exclusions. One university
official characterized the Commerce-sponsored session that he attended
as being "entry level" training directed at the corporate community.
Commerce officials have acknowledged that about 95 percent of the
attendees at their seminars are repeat attendees, primarily from
industry. Some university officials stated that the training was too
narrowly focused on topics that do not pertain to universities.
University officials also raised concerns with State's and Commerce's
Web-based guidance. Some university officials characterized the Web-
based information provided by Commerce and State as being unclear or
only providing a general introduction to a topic without providing
sufficient details to fully answer questions concerning export
controls. For example, a university official stated that the Commerce
and State Web sites do not identify which forms universities need to
submit in seeking export licenses to involve foreign researchers in
certain research. Also, although some university officials indicated
that Commerce and State officials provide very useful information via
the telephone help desks, they stated that getting immediate help was
difficult at times and that return messages were untimely.
To further their understanding of export control regulations, several
universities have sought out other sources of information, specifically
sources tailored to universities. Several university officials
indicated that they rely on best practices by other universities that
have shared and developed approaches for addressing different export
control issues, including the Massachusetts Institute of Technology,
Stanford University, and the Universities of Oklahoma and Maryland. For
example, officials from one university said that they have relied on
other universities for guidance on applying for export licenses.
Universities and academic associations exchange best practice
information through seminars and workshops sponsored by nongovernmental
organizations, such as the Association of American Universities, the
Council on Governmental Relations, and the National Council of
University Research Administrators.
Many of the universities that we visited have also developed written
guidance and training to help educate university personnel on their
responsibility to comply with the export control regulations. For
example, officials from one university we visited have developed a Web-
based decision tree to assist university personnel in determining the
applicability of export controls to their research projects. Officials
from another university stated that their research institution requires
that all staff take training--available on the university's intranet
site--related to the handling of controlled information. Another
university adopted a targeted strategy of export control education for
its researchers, reaching out to the researchers and programs most
likely to be affected by export controls, such as those in engineering.
A number of universities we visited have invested in other resources to
ensure they comply with export control regulations. Some hire outside
legal counsel who specialize in export controls. For example, one
university routinely employs outside counsel to mitigate the risk of
committing violations, because of the severity of the penalties for
noncompliance.[Footnote 15] According to officials at another
university, thousands of dollars are spent each year for legal services
addressing export controls. Finally, two universities we visited use a
software program to help determine if a proposed research project grant
or contract is subject to export license requirements. According to
officials at these two universities, the software program helps to
facilitate a process that is very difficult, time-consuming, and costly
because of the length and complexity of U.S. export control
regulations.
State and Commerce Have Not Assessed the Potential Risk to Export-
Controlled Information at Universities:
State and Commerce officials indicated that their top priority is
processing the thousands of license applications received annually--the
vast majority of which are from industry--leaving few resources for
guidance and outreach to exporters. However, they expressed concerns
that universities may be misinterpreting their responsibilities under
export regulations and that the potential may exist for foreign
nationals to access sensitive information on U.S. campuses. Despite
these concerns, neither agency has analyzed available information on
university research and foreign student populations to determine the
potential risk of the illegal transfer of controlled information.
Commerce and State Prioritize Processing of License Applications and
Target Their Resources to Industry:
According to Commerce officials, BIS receives approximately 1,000
deemed export license applications per year. Officials confirmed that
most of these applications are received from industry. For example,
Commerce officials stated that of the 865 deemed export licenses
processed by Commerce in fiscal year 2006, 99.7 percent were from
industry. These same officials noted that over the last few years, only
two universities have submitted deemed export license applications. A
2004 Commerce Inspector General report stated that license application
data suggest that many industries (including chemical and biotechnology
industries), academic institutions, and federal research facilities
that may employ or host foreign nationals are not applying for deemed
export licenses.
State and Commerce officials stated that beyond processing export
licenses, few resources remain for providing outreach and guidance to
the export community. While both agencies provide guidance and outreach
through conferences cosponsored with other organizations and agency-
sponsored training, much of their outreach is directed at industry, and
not the academic community. Commerce cosponsors approximately 45 formal
seminars annually, along with specialty seminars on deemed exports
ranging from basic to advanced. As its principal training activity,
State provides speakers for export licensing conferences that are
organized by the Society for International Affairs and tailored to the
needs of industry and government participants. An official acknowledged
that State is unable to fill all of the speaking requests that it
receives, which number in the hundreds each year. Instead, State
responds to requests based on the availability of personnel and travel
funds. From January 2004 through June 2006, State officials approved
their personnel to participate in approximately 135 outreach activities
and events.
Officials at both agencies indicated that their visits to or staffing
of training seminars for the academic community are often in response
to specific invitations from universities. A State official who is
responsible for export outreach reported that since 2003, only one
event has been held that was specifically targeted to the academic
community. While State policy officials have indicated that they would
like to conduct more conferences for universities in the future, the
official responsible for these conferences stated that none are
currently scheduled because of limited resources. For Commerce, one
official has noted that more universities have recently begun attending
its training seminars. However, while Commerce stated it has increased
its outreach to universities in the last few years, GAO analysis of its
outreach records indicated that several events that Commerce
categorized as targeted at universities were provided to government
research entities instead.
In addition to conferences and agency-provided training, both State and
Commerce maintain telephone help desks and Web sites for exporters to
obtain guidance on export controls. State employs a three-person
response team to answer telephone inquiries and provide informal advice
on export control issues in response to the thousands of calls received
monthly from industry and academic institutions. Officials have
indicated that they have improved help desk response times. Commerce's
and State's Web sites provide exporters with guidance on when a license
is needed and how a license can be procured. However, information is
aimed at a more general audience, although a Commerce official stated
that the agency has posted more background information on the
fundamental research exclusion on its Web site. State officials noted
that they have made their Web site more user-friendly and taken steps
to expand the Web site to provide additional guidance to exporters.
Although State and Commerce have separate export control jurisdictions,
the 2004 interagency Offices of Inspector General report stated that
Commerce and State could improve their outreach by providing joint
training that explains the differences between the two agencies'
licensing requirements and procedures--a recommendation that, according
to the report, was supported by company and academic
officials.[Footnote 16] Furthermore, previous GAO reports have
recommended that Commerce and State should better coordinate their
efforts on analysis and export oversight.[Footnote 17] However, State
and Commerce have taken few actions to coordinate their outreach
efforts to universities. Though State engaged in six outreach events
with Commerce between November 2003 and April 2004, a State official
explained that staffing such joint events with Commerce remains
difficult because State must use personnel from its licensing staff to
participate in these events. With a backlog in license applications,
the processing of applications is a priority, and the agency is
reluctant to divert those personnel to outreach efforts.
Commerce and State Have Not Conducted Analysis to Identify whether Any
Risk Exists to Export-Controlled Information at Universities:
State and Commerce officials expressed concerns that despite the export
control exclusions for university research, the potential may exist for
foreign nationals to access controlled defense and dual-use
technologies and information on U.S. campuses. However, neither State
nor Commerce has analyzed available data on university research
contracts or student fields of study to identify any potential risk to
export-controlled information at universities. According to federal
internal control standards, agencies need to conduct risk assessments
that generally include estimating the risk's significance and
likelihood of occurrence, deciding how to manage the risk and
determining what actions should be taken.[Footnote 18]
In the absence of an assessment of export control vulnerabilities at
universities, State officials and a Commerce Inspector General report
stated they were concerned that academic officials may be
misinterpreting export control regulations and guidance. According to
State officials, universities are unaware of the nuances of export
control regulations. Specifically, they said universities have
difficulty distinguishing and tracking export regulations when a
specific project develops from basic to fundamental or applied
research. For example, one State official questioned whether
universities devote sufficient resources to export compliance and apply
for export licenses with State and Commerce to the extent their
research activities warrant. This official believes that academic
institutions should designate individuals responsible for understanding
export control regulations and tracking exports, just as companies do.
However, most of the academic institutions we visited had designated
officials who were responsible for export control issues.
Despite these concerns, Commerce and State have not fully assessed
university compliance information to identify the potential for export
control vulnerabilities in university research. Commerce and State are
tasked with export control oversight, including administering policy,
processing licenses, and reviewing compliance by exporters. According
to State officials, the department lacks the personnel to conduct
extensive compliance audits. Instead, State relies on voluntary
disclosure of possible export control violations--primarily by
companies. When a company notifies State of a possible export
violation, State may visit the company to discuss the problem and offer
advice on weaknesses in the company's export control program. According
to State officials, State does not target universities for compliance
and has not visited a university because universities make up a small
percentage of all exporters. Officials stated that Commerce's formal
compliance review program is focused on deemed export license holders,
the majority of which are from industry. Commerce does not conduct
analyses to determine whether academic institutions that have not
applied for licenses are in compliance with export control regulations.
Instead, Commerce uses leads generated by intelligence agencies,
internal Commerce sources, or the public via a hotline to investigate
possible cases of export control violations.
Furthermore, although Commerce gathers information about certain
universities' research activities on case-by-case basis, neither
Commerce nor State analyzes available federal agency data on university
research subjects to identify trends or determine the potential for
such research to be subject to export control regulations. Given that
much of the research conducted at U.S. universities is federally
funded, data from other government agencies on the subjects of research
conducted at academic institutions could supplement data from Commerce
and State. For example, DOD and NASA fund research at universities,
some of which involves technologies that could become export
controlled. General information on federal contracts available through
the Federal Procurement Data System could also provide information on
universities doing high volumes of research for other federal agencies.
However, neither Commerce nor State makes use of these data sources to
analyze trends in university research. Commerce, instead, relies on
Internet searches or publicly available data on university research
when preparing to meet with academic officials.
Other data could help Commerce and State identify potential risks of
export control violations at academic institutions. Commerce officials
stated that some foreign nationals on U.S. campuses are from countries
that have historically tried to unlawfully obtain information about
American technologies. However, while Commerce uses visa application
data to generate leads for specific cases of deemed export violations,
it does not use other data on foreign students' and scholars' majors or
fields of study to identify potential areas of risk. For example, the
Department of Homeland Security administers the Student and Exchange
Visitor Information System--a database that tracks student nationality,
school enrollment, and changes to major or field of study--but within
the past 3 years neither State nor Commerce has requested these data
from Homeland Security for the purposes of assessing export control
risks. While a Commerce official indicated that the department would
like to work with Homeland Security in the future, there is currently
no information sharing between the two agencies for the purpose of
identifying trends in student populations. Similarly, State does not
use its Visas Mantis program--a security review procedure that aims to
identify visa applicants who may pose a threat to U.S. national
security by illegally transferring sensitive technology--to identify
trends of foreign students and scholars and their fields of study,
although it occasionally receives alerts about individuals who might
pose an export control risk.
To improve controls at universities, in 2005 Commerce solicited
information on the impact of a proposed rule change that would have
modified the definition of the use of export-controlled equipment by
foreign nationals, which was recommended by the Commerce Office of
Inspector General.[Footnote 19] Commerce received more than 300
comments in which many cited the potential impact on university
research, including numerous comments that the modified definition
would capture too many routine operations carried out by students and
employees and would thus create a large and generally unnecessary
compliance, financial, and administrative burden for universities, and
an increased licensing burden on Commerce. Subsequently, Commerce
withdrew the advanced notice of proposed rule change in May 2006.
Recently, U.S. export regulatory, oversight, and law enforcement
agencies have taken some steps to engage the academic community on
export issues. For example, in September 2006, Commerce established the
Deemed Export Advisory Committee to address broad export control
issues. Specifically, the committee's charter is to review and provide
recommendations to Commerce on deemed export policy. Thus, this
committee will be responsible for ensuring that the deemed export
licensing policy protects national security while ensuring that the
United States continues to be at the leading edge of technological
innovations. Its membership includes high-ranking university officials
and chief executive officers of companies. According to Commerce
officials, the committee members will serve for approximately one year.
Commerce officials stated that they plan to address the issue of
fundamental research in the committee's work and to include
participation by a number of export control agencies in committee
meetings. Commerce highlighted one such issue in a May 2006 Federal
Register notice where it described the difference between the academic
community views that export controls would only apply to the results of
research, and the Commerce view that export controls can also apply to
the conduct of research.
In September 2005, the Federal Bureau of Investigation established a
separate forum to improve its lines of communication with the academic
community. The National Security Higher Education Advisory Board--
consisting of the presidents and chancellors of several prominent U.S.
universities--aims to foster outreach and to promote understanding
between higher education and the Federal Bureau of Investigation. The
board will provide insight on the higher education culture of openness,
academic freedom, and international collaboration and dialogue on
issues such as terrorism, counterintelligence, and homeland security.
In addition, the Department of Homeland Security's Project Shield
America aims to work with exporters of U.S. technologies that could be
illegally exported, in particular, technologies used in weapons of mass
destruction. According to a DHS official, the project's first outreach
effort specifically targeting the U.S. academic community was scheduled
to be held at the beginning of December 2006.
Conclusions:
Balancing the desire to attract gifted foreign research scientists to
U.S. universities and the need to ensure that export-controlled
research at universities is not compromised is a considerable
challenge. Since government agencies place the responsibility for
complying with export control regulations on universities and other
exporting entities, it is essential that Commerce and State, the two
agencies primarily charged with administering export regulations,
understand whether universities correctly interpret and apply relevant
export control policies and regulations when deciding whether their
research is subject to export controls. Despite some concerns that
universities may not understand their responsibilities when conducting
research, Commerce and State have not leveraged available government
information and assessed potential risks of illegal transfers of export-
controlled information at universities. Furthermore, although Commerce
and State have separate export control jurisdictions, the lack of
coordination between these agencies on outreach, analysis, and
oversight could hamper their ability to determine whether export-
controlled information may be at risk of transfer to foreign nationals
in the course of university research. Without such knowledge, the
government agencies cannot determine whether their guidance and
training for universities is appropriate and sufficient and whether
their resources are strategically targeted to optimize their ability to
regulate and monitor universities' research. Until Commerce and State
take such steps, sensitive information may remain vulnerable to
improper transfer, potentially putting at risk U.S. national security
interests.
Recommendations for Executive Actions:
To improve the Department of Commerce's oversight of export-controlled
information under its jurisdiction at universities, we recommend that
the Secretary of Commerce direct the Administrator of the Bureau of
Industry and Security to:
* strategically assess potential vulnerabilities in the conduct and
publication of academic research by becoming more knowledgeable about
research being conducted on university campuses and, in consultation
with other agencies, make use of available information on technology
development and foreign student populations at universities to assess
the extent to which research at universities may be subject to export
controls and:
* on the basis of this assessment of university research and foreign
student populations, improve interagency coordination, conduct
additional outreach, and improve guidance to ensure that universities
understand when to apply export controls.
To improve the Department of State's oversight of export-controlled
information under its jurisdiction at universities, we recommend that
the Secretary of State direct the Director of the Directorate of
Defense Trade Controls to:
* strategically assess potential vulnerabilities in the conduct and
publication of academic research by becoming more knowledgeable about
research being conducted on university campuses and, in consultation
with other agencies, make use of available information on technology
development and foreign student populations at universities to assess
the extent to which research at universities may be subject to export
controls and:
* on the basis of this assessment of university research and foreign
student populations, improve interagency coordination, conduct
additional outreach, and improve guidance to ensure that universities
understand when to apply export controls.
Agency Comments and our Evaluation:
We provided a draft of this report to the Departments of Commerce,
Defense, Homeland Security, and State for their review and comment.
Commerce and State provided written comments, which are reprinted in
appendixes II and III, respectively.[Footnote 20] Defense did not have
any comments on our draft report. Homeland Security provided technical
comments, which are incorporated as appropriate throughout the report.
The Department of Commerce generally agreed with the report's
recommendations, and stated that the Deemed Export Advisory Committee
will aid in this respect. However, Commerce stated that Student and
Exchange Visitor Information System (SEVIS) data are too general for
use in identifying whether foreign students and scholars are subject to
deemed export license requirements and that the collection of more
specific visa application information is needed to assess
vulnerabilities. While we agree that additional information from the
visa application process could be useful, we found that SEVIS data
include information that State and Commerce could use to perform
general trend analysis to determine where best to focus outreach and
compliance efforts at the university level. For example, an analysis of
the majors that foreign students and scholars are pursuing at
universities with large federal research contracts could provide
Commerce and State with a proactive plan for targeting their outreach
and training efforts for the academic community. Furthermore, while
Commerce states that about one-third of its outreach events focus on
the academic community, as our report states, we found that several of
the events that Commerce classified as academic outreach were actually
targeted at government research entities. Finally, Commerce correctly
notes that our report focuses on fundamental research or other research
that may be subject to export controls while excluding other research
that falls outside of the export control universe. We identified the
application of the fundamental research exclusion as a significant
issue between the academic community and Commerce, and as Commerce's
letter notes, some universities could benefit from a better
understanding of deemed export control requirements. Our report
indicates that an assessment of the vulnerabilities will best allow
Commerce to focus its outreach and training efforts toward addressing
this issue with the academic community.
State agreed with our recommendation to improve interagency
coordination on training and guidance for universities and disagreed
with our report's finding that it does not assess the potential
vulnerabilities associated with export-controlled information at
academic institutions. State responded that it is currently working
with the Department of Commerce and the Department of the Treasury to
conduct an export control conference during 2007 specifically aimed at
universities. As we recommended in our report, such outreach that is
specifically targeted to the academic community, particularly in
coordination with other agencies, could improve universities'
understanding of regulations concerning export controlled information.
However, while such outreach may help universities seeking guidance on
deemed export regulations, State would benefit from strategically
assessing vulnerabilities at universities using readily available data,
such as SEVIS, to help the department identify and address areas of
potential risk. While State disagreed with our recommendation, in its
response it noted that it is considering conducting such an assessment.
A trend analysis conducted on SEVIS and federal procurement data would
be a valuable investment in providing a proactive plan for targeting
outreach and training for universities. State also provided technical
comments, which we incorporated throughout the report, as appropriate.
We are sending copies of this report to appropriate congressional
committees and to the Secretary of Commerce, the Secretary of Defense,
the Secretary of Homeland Security, and the Secretary of State. Copies
will be made available to others upon request. In addition, this report
will be available at no charge on the GAO Web site at [Hyperlink,
http://www.gao.gov].
If you or your staff have any questions about this report, please
contact me on (202) 512-7333. Key contributors to this report are
acknowledged in appendix IV.
Sincerely,
Signed by:
John Hutton, Acting Director:
Acquisition and Sourcing Management:
[End of section]
Appendix I: Scope and Methodology:
To describe the nature of the research conducted at universities and
identify the steps they have taken to comply with government export
control regulations, we interviewed and obtained documentation from
officials at 13 universities in positions such as vice chancellor for
research, director of compliance, and general counsel. We conducted our
review at the following 13 universities: Boston University, Boston,
Massachusetts; California Institute of Technology, Pasadena,
California; Carnegie Mellon University, Pittsburgh, Pennsylvania;
Colorado State University, Fort Collins, Colorado; George Washington
University, Washington, D.C; Johns Hopkins University, Baltimore,
Maryland; Massachusetts Institute of Technology, Cambridge and
Lexington, Massachusetts; Stanford University, Stanford, California;
University of California at Berkeley; University of California at Los
Angeles; University of Colorado at Boulder; University of Maryland at
College Park; and the University of Southern California, Los Angeles,
California. To get a general overview of the nature of research at
universities, we also spoke by telephone with officials from the
Association of American Universities, Association of University
Technology Managers, National Council of University Research
Administrators, and the Southwest Research Institute. To systematically
select the universities that we visited, we cross-tabulated data on
universities with large numbers of international students or scholars,
those that are associated with federally funded research centers, those
that had applied for International Traffic in Arms Regulations or
Export Administration Regulations export licenses, and those that had
high-dollar contracts with either the Department of Defense or other
government entities. While some of the selected academic institutions
fall within the top tiers across the selection criteria, their views
stated in this report do not represent those of the entirety of the
U.S. academic community.
To assess Commerce's and State's efforts to determine the risk of
export violations in university research, we interviewed officials from
the Bureau of Industry and Security of the Department of Commerce and
its related export offices: National Security and Technology Transfer
Controls, Exporter Services, Export Administration, Export Enforcement.
We also interviewed officials in the Department of Commerce's Offices
of General Counsel and Inspector General. At the Department of State,
we interviewed officials and reviewed data from the Bureau of Political-
Military Affairs' Directorate of Defense Trade Controls, the Bureaus of
Consular Affairs and International Security and Nonproliferation, and
the Office of the Inspector General. We obtained and analyzed
regulations, guidance, and training documents from these departments.
We also collected data and other documentation and met with officials
from the Office of Defense Procurement and Acquisition Policy of the
Department of Defense and the Department of Homeland Security's
Immigration Policy Directorate and U.S. Immigration and Customs
Enforcement.
We conducted our work from March 2006 through November 2006 in
accordance with generally accepted government auditing standards.
[End of section]
Appendix II: Comments from the Department of Commerce:
The Secretary Of Commerce:
Washington, D.C. 20230:
Mr. John Hutton:
Acting Director, Acquisition and Sourcing Management:
Government Accountability Office:
441 G Street, NW, Room 4718:
Washington, DC 20548:
Dear Mr. Hutton:
Thank you for the opportunity to provide comments on two related
Government Accountability Office (GAO) Draft Reports, Export Controls:
Agencies Should Assess Vulnerabilities and Improve Guidance for
Protecting Export-Controlled Information at Companies, GAO-07-69, and
Export Controls: Agencies Should Assess Vulnerabilities and Improve
Guidance on Protecting Export-Controlled Information at Universities,
GAO-07-70.
Along with a March 2004 report by the Commerce Department's Office of
Inspector General (Inspection Report No. IPE-16176), these reports help
draw attention to the importance of protecting sensitive export-
controlled information without impeding the competitive position of
U.S. industry and academia. Indeed, the issue of deemed exports is one
that has received and continues to receive considerable attention from
the Commerce Department's Bureau of Industry and Security (BIS).
Noting that deemed exports under the Export Administration Regulations
(EAR) are separate from technology transfer restrictions under the
International Trade in Arms Regulations (ITAR), we generally agree with
the reports' recommendations to assess potential vulnerabilities within
industry and academia and then conduct more targeted deemed export
outreach and compliance activities. As the reports note, BIS has
already taken significant action in this regard. In September, the
Commerce Department established the Deemed Export Advisory Committee
(DEAC), co-chaired by Robert Gates, President of Texas A&M University,
and Norman Augustine, retired Chairman and CEO of Lockheed Martin
Corporation, to review the entire issue of deemed exports. (Dr. Gates
was subsequently nominated by President Bush as Secretary of Defense,
and we are in the process of identifying a replacement as co-chair.)
The DEAC has high-level members from industry, academia, and the
security field who will review and make recommendations to me on how
best to ensure that transfers of sensitive technologies to foreign
nationals protect vital national security interests while ensuring that
U.S. companies and universities continue to be the world's leaders in
research and development.
In addition, BIS has expanded its already robust deemed export outreach
program in all high-technology sectors, including universities,
industry, and government laboratories. Significant outreach efforts
have been undertaken with industry sectors and compliance officials on
the requirements for deemed exports, including the requirement that
license applications have in place a Technology Control Plan (TCP) to
protect export-controlled information from unauthorized release. BIS
publishes best practices guidance on TCPs on its website and discusses
TCP requirements in enforcement outreach visits. Significantly, in
September 2006, BIS officials addressed the annual convention of the
American Society for Industrial Security (ASIS), a trade association of
information and physical security management professionals, on the
protection of export-controlled information and essential elements of
TCPs in protecting such information from unauthorized access and
release.
In addition to its Fiscal Year 2005 pilot program for deemed export
compliance verification, BIS has also initiated a formal Deemed Export
Compliance Review Program. Under this program, BIS conducts formal
compliance reviews of deemed export license holders' compliance with
license conditions, including the efficacy of their required TCPs.
Deemed export licenses are targeted for review based on the
sensitivities of the technology involved (e.g., such as that connected
with weapons of mass destruction development) and countries involved.
BIS completed 14 reviews under this program in Fiscal Year 2006, and
will continue reviews under the program in Fiscal Year 2007.
Finally, BIS has worked closely with other agencies to gather data on
potential risks of unauthorized technology transfers at universities.
We have found that existing data, such as that found in the Department
of Homeland Security's Student and Exchange Visitor Information System,
is often too general to be useful in identifying whether foreign
nationals will be subject to deemed export license requirements.
Therefore, we have taken specific steps to improve this data, such as
suggesting revisions to the relevant visa application form to collect
information needed to assess technology transfer vulnerabilities from
foreign nationals in the United States.
Based on the Department's work to date and the findings of your reports
and other studies, it is clear that some universities and research
institutions need to acquire a better understanding of deemed export
control requirements. Because we recognize the important need to
improve understanding of deemed export license requirements at
universities, about one-third of BIS's 120 annual deemed export
outreach activities now focus on the academic community. At the same
time, however, it is important to note that deemed export licensing
consideration is required only if a foreign national has access to
export-controlled technology. The EAR identifies a larger universe of
information that is not subject to the Department's regulatory
oversight and, therefore, is not export-controlled. The full context of
this universe bears mentioning since it is not fully addressed in the
report, which focuses primarily on the concept of fundamental research.
As noted in Section 734.3(3) of the EAR, certain publicly available
technology is not subject to the requirements of the EAR. This includes
information that is already published or will be published. Section
734.8 of the EAR clarifies that the information resulting from
fundamental research which is intended for publication is considered
publicly available and thus not subject to the EAR.
Informed by the reports' findings and recommendations and actions taken
to date, BIS will continue to assess vulnerabilities and work to more
precisely target outreach and compliance efforts. BIS's efforts will
also be significantly informed by the recommendations of the DEAC,
which we currently expect to receive in the fall of 2007.
Sincerely,
Signed by:
Carlos M. Gutierrez:
[End of section]
Appendix III: Comments from the Department of State:
United States Department of State:
Assistant Secretary for Resource Management and Chief Financial
Officer:
Washington, D.C., 20520:
Ms. Jacquelyn Williams-Bridgers:
Managing Director:
International Affairs and Trade:
Government Accountability Office:
441 G Street, N. W.
Washington, D.C. 20548-0001:
Nov 30 2006:
Dear Ms. Williams-Bridgers:
We appreciate the opportunity to review your draft report, "Export
Controls: Agencies Should Assess Vulnerabilities and Improve Guidance
for Protecting Export-Controlled Information at Universities," GAO Job
Code 120508.
The enclosed Department of State comments are provided for
incorporation with this letter as an appendix to the final report.
If you have any questions concerning this response, please contact
Patricia Slygh, Acting Director of Management, Bureau of Political and
Military Affairs at (202) 663-2844.
Sincerely,
Signed by:
Bradford R. Higgins:
cc: GAO - John Neumann:
PM - Gregory Suchan:
State/OIG - Mark Duda:
Department of State Comments on GAO Draft Report:
Export Controls: Agencies Should Assess Vulnerabilities and Improve
Guidance for Protecting Export-Controlled Information at Universities
(GAO-07-70, GAO Code 120508):
Thank you for allowing the Department of State the opportunity to
comment on draft report "Export Control: Agencies Should Assess
Vulnerabilities and Improve Guidance on Protecting Export-Controlled
Information at Universities. "
The report highlights the potential risks of foreign students at
universities being exposed to export controlled technology with or
without proper authorization and makes recommendations for both the
Department of State and the Department:
of Commerce regarding risk assessment and increased training and
outreach for universities. The Department agrees with the GAO with
respect to the need for increased training and outreach and is
currently working with the Department of Commerce and the Department of
Treasury to conduct an export control conference during 2007
specifically aimed at universities. We disagree with the GAO's
assertion that we are not presently assessing the risk of unauthorized
data exports. While State's DDTC may not have concretely quantified the
potential risk, there is a recognition that a risk exists. We estimate
that it would take from one-half to one full man year to conduct an
assessment and are presently determining if we can conduct the study,
along with the planned outreach to universities in FY 2007, within the
limits of existing resources.
[End of section]
Appendix IV: Staff Contact and Acknowledgments:
GAO Contact:
John P. Hutton (202) 512-7773:
Acknowledgments:
John Neumann, Sharron Candon, Gregory Harmon, Arturo Holguin, Angela
Thomas, and Sandra Moore made key contributions to this report. Other
key contributors include Marie Ahearn and Karen Sloan.
FOOTNOTES
[1] Dual-use information is that which has both commercial and military
application. 15 C.F.R. Sec. 730.3.
[2] National Security Decision Directive 189, issued September 21,
1985, and still in effect, established national policy for controlling
the flow of science, technology, and engineering information produced
in federally-funded fundamental research at colleges, universities, and
laboratories. The directive defines fundamental research to mean basic
and applied research in science and engineering, the results of which
ordinarily are published and shared broadly within the scientific
community, as distinguished from proprietary research and from
industrial development, design, production, and product utilization,
the results of which ordinarily are restricted for proprietary or
national security reasons.
[3] Office of the National Counterintelligence Executive, Annual Report
to Congress on Foreign Economic Collection and Industrial Espionage--
2004, NCIX 2005-10006, (Washington, D.C.: April 2005).
[4] GAO, University Research: Most Federal Agencies Need to Better
Protect against Financial Conflicts of Interest, GAO-04-31 (Washington,
D.C., Nov. 14, 2003).
[5] House of Representatives Committee on the Judiciary, Subcommittee
on Immigration, Border Security, and Claims, Hearing on Sources and
Methods of Foreign Nationals Engaged in Economic and Military
Espionage, Serial No. 109-58, (Washington, D.C., Sept. 15, 2005).
[6] The ITAR (22 C.F.R.§§ 120-130) implements the Arms Export Control
Act (22 U.S.C. 2778). The Act authorizes the President to control the
export of defense articles and services and promulgate corresponding
regulations, which has been delegated to the Secretary of State by
Executive Order 11958, as amended. The ITAR defines fundamental
research to mean basic and applied research in science and engineering
where the resulting information is ordinarily published and shared
broadly within the scientific community, as distinguished from
research, the results of which are restricted for proprietary reasons
or specific U.S. government access and dissemination control. 22 C.F.R.
sec.120.11 (a)(8).
[7] The ITAR defines a foreign person as any natural person who is not
a lawful permanent resident as defined by 8 U.S.C. sec. 1101(a)(20) or
who is not a protected individual as defined by 8 U.S.C. 1324b(a)(3).
It also means any foreign corporation, business association,
partnership, trust, society, or any other entity or group that is not
incorporated or organized to do business in the United States, as well
as international organizations, foreign governments, and any agency or
subdivision of foreign governments (e.g., diplomatic missions).
[8] The EAR (15 C.F.R. §§ 730-774) implements the Export Administration
Act (50 U.S.C. 2401-2420). Although the Act has lapsed, export
regulations have been extended through executive orders, of which
Executive Order 13222 (August 17, 2001) is the most recent. The EAR,
like National Security Decision Directive 189, defines fundamental
research to mean basic and applied research in science and engineering
where the resulting information is ordinarily published and shared
broadly within the scientific community. Such research can be
distinguished from proprietary research and from industrial
development, design, production, and product utilization, the results
of which ordinarily are restricted for proprietary reasons or specific
national security reasons. 15 C.F.R. sec.734.8.
[9] The EAR defines a foreign national as a person who is not lawfully
admitted for permanent residence in the United States or a person who
is not a protected individual under the Immigration and Naturalization
Act, 8 U.S.C. 1324b(a)(3). 15 C.F.R. sec.734.2 (b)(2)(ii).
[10] These transfers are commonly referred to as "deemed" exports.
Commerce's export control regulations (15 CFR 734.2(b)(2)(ii))
specifically utilize the term "deemed export" to describe these
transfers. While the ITAR does not use a precise corresponding term,
State Department officials told us the concept of a "deemed" export is
covered under the ITAR's general definition of an export--that is, an
export means "disclosing (including oral or visual disclosure) or
transferring technical data to a foreign person, whether in the United
States or abroad" (see 22 C.F.R. Sec. 120.17), and the ITAR's
requirements for the export of unclassified technical data, which state
"a license is required for the oral, visual or documentary disclosure
of technical data by U.S. persons to foreign persons—regardless of the
manner in which the technical data is transmitted (e.g., in person, by
telephone, correspondence, electronic means, etc.)" (see 22 C.F.R. Sec.
125.2(a) and (c)). State officials told us they also refer to these
transfers as "deemed exports."
[11] Defense Federal Acquisition Regulation 252.204-7000 prohibits the
contractor from releasing any unclassified information to anyone
outside of the contractor's organization unless the contracting officer
has given prior written approval or the information is otherwise in the
public domain before the date of release.
[12] In 2005, DOD issued a proposed regulation that would have required
contract officers to ensure that contracts identify any export-
controlled information and technology and the contractor to not allow
access by foreign nationals or persons to export-controlled information
and technology without obtaining an export license, other
authorization, or exemption. According to university associations, they
were concerned that application of this regulation by contracting
officers would not take into consideration whether export-controlled
information is involved when restricting universities from sharing the
results of fundamental research.
[13] At the time of this report, the revised rule (2004-D010) had not
been finalized.
[14] The Society for International Affairs is a volunteer, nonprofit,
educational organization jointly formed in 1967 by the federal
government and industry. Its purpose is to serve as a forum for the
exchange of information--through events such as luncheons, conferences,
and workshops--related to export and import licensing issues.
[15] The EAR and ITAR both impose criminal and civil penalties.
[16] Offices of Inspectors General, Interagency Review of Foreign
National Access to Export-Controlled Technology in the United States,
Report No. D-2004-062 (Washington, D.C.: Apr. 16, 2004).
[17] See GAO, Export Controls: Improvements to Commerce's Dual-Use
System Needed to Ensure Protection of U.S. Interests in the Post-9/11
Environment , GAO-06-638 (Washington, D.C.: Jun. 26, 2006); GAO, Export
Controls: Department of Commerce Controls over Transfers of Technology
to Foreign Nationals Need Improvement, GAO-02-972 (Washington, D.C.:
Sept. 6, 2002); and GAO, Export Controls: Processes for Determining
Proper Control of Defense-Related Items Need Improvement, GAO-02-996
(Washington, D.C.: Sept. 20, 2002)
[18] GAO, Standards for Internal Control in the Federal Government,
GAO/AIMD-00-21.3.1 (Washington, D.C.: November 1999).
[19] U.S. Department of Commerce, Office of Inspector General, Bureau
of Industry and Security, Final Inspection Report No. IPE-16176, Deemed
Export Controls May Not Stop the Transfer of Sensitive Technology to
Foreign Nationals in the U.S. (Washington, D.C., Mar. 31, 2004).
[20] Commerce's response letter also included comments on our draft
report on export controlled information, Export Controls: Agencies
Should Assess Vulnerabilities and Improve Guidance for Protecting
Export-Controlled Information at Companies, GAO-07-69 (Washington,
D.C.: Dec. 5, 2006).
GAO's Mission:
The Government Accountability Office, the audit, evaluation and
investigative arm of Congress, exists to support Congress in meeting
its constitutional responsibilities and to help improve the performance
and accountability of the federal government for the American people.
GAO examines the use of public funds; evaluates federal programs and
policies; and provides analyses, recommendations, and other assistance
to help Congress make informed oversight, policy, and funding
decisions. GAO's commitment to good government is reflected in its core
values of accountability, integrity, and reliability.
Obtaining Copies of GAO Reports and Testimony:
The fastest and easiest way to obtain copies of GAO documents at no
cost is through GAO's Web site (www.gao.gov). Each weekday, GAO posts
newly released reports, testimony, and correspondence on its Web site.
To have GAO e-mail you a list of newly posted products every afternoon,
go to www.gao.gov and select "Subscribe to Updates."
Order by Mail or Phone:
The first copy of each printed report is free. Additional copies are $2
each. A check or money order should be made out to the Superintendent
of Documents. GAO also accepts VISA and Mastercard. Orders for 100 or
more copies mailed to a single address are discounted 25 percent.
Orders should be sent to:
U.S. Government Accountability Office 441 G Street NW, Room LM
Washington, D.C. 20548:
To order by Phone: Voice: (202) 512-6000 TDD: (202) 512-2537 Fax: (202)
512-6061:
To Report Fraud, Waste, and Abuse in Federal Programs:
Contact:
Web site: www.gao.gov/fraudnet/fraudnet.htm E-mail: fraudnet@gao.gov
Automated answering system: (800) 424-5454 or (202) 512-7470:
Congressional Relations:
Gloria Jarmon, Managing Director, JarmonG@gao.gov (202) 512-4400 U.S.
Government Accountability Office, 441 G Street NW, Room 7125
Washington, D.C. 20548:
Public Affairs:
Paul Anderson, Managing Director, AndersonP1@gao.gov (202) 512-4800
U.S. Government Accountability Office, 441 G Street NW, Room 7149
Washington, D.C. 20548:
