Export Controls:

Agencies Should Assess Vulnerabilities and Improve Guidance for Protecting Export-Controlled Information at Companies

GAO-07-69: Published: Dec 5, 2006. Publicly Released: Dec 5, 2006.

Additional Materials:

Contact:

Anne Marie F. Lasowski
(202) 512-4383
contact@gao.gov

 

Office of Public Affairs
(202) 512-4800
youngc1@gao.gov

The U.S. government controls exports of defense-related goods and services by companies and the export of information associated with their design, production, and use, to ensure they meet U.S. interests. Globalization and communication technologies facilitate exports of controlled information providing benefits to U.S. companies and increase interactions between U.S. and foreign companies, making it challenging to protect such exports. GAO assessed (1) how the government's export control processes apply to the protection of export-controlled information, and (2) steps the government has taken to identify and help mitigate the risks in protecting export-controlled information. To do this, GAO analyzed agency regulations and practices and interviewed officials from 46 companies with a wide range of exporting experiences.

U.S. government export control agencies, primarily the departments of Commerce and State, have less oversight on exports of controlled information than they do on exports of controlled goods. Commerce's and State's export control requirements and processes provide physical checkpoints on the means and methods companies use to export controlled goods to help the agencies ensure such exports are made under their license terms, but the agencies cannot easily apply these same requirements and processes to exports of controlled information. For example, companies are generally required to report their shipments of export controlled goods overseas with Customs and Border Protection for exports made under a license, but such reporting is not applicable to the export of controlled information. Commerce and State expect individual companies to be responsible for implementing practices to protect export-controlled information. One third of the companies GAO interviewed did not have internal control plans to protect export-controlled information, which set requirements for access to such material by foreign employees and visitors. Commerce and State have not fully assessed the risks of companies using a variety of means to protect export-controlled information. The agencies have not used existing resources, such as license data, to help identify the minimal protections for such exports. As companies use a variety of measures for protecting export-controlled information, increased knowledge of the risks associated with protecting such information could improve agency outreach and training efforts, which now offer limited assistance to companies to mitigate those risks. GAO's internal control standards highlight the identification and management of risk as a key element of an organization's management control program. GAO also found that Commerce's and State's communications with companies do not focus on export-controlled information. For example, Commerce's and State's Internet Web sites do not provide specific guidance on how to protect electronic transfers of export-controlled information, a point raised by almost one fourth of the company officials GAO interviewed.

Status Legend:

More Info
  • Review Pending-GAO has not yet assessed implementation status.
  • Open-Actions to satisfy the intent of the recommendation have not been taken or are being planned, or actions that partially satisfy the intent of the recommendation have been taken.
  • Closed-implemented-Actions that satisfy the intent of the recommendation have been taken.
  • Closed-not implemented-While the intent of the recommendation has not been satisfied, time or circumstances have rendered the recommendation invalid.
    • Review Pending
    • Open
    • Closed - implemented
    • Closed - not implemented

    Recommendations for Executive Action

    Recommendation: To improve the Department of State's oversight of export-controlled information at companies, the Secretary of State should direct the Director of the Directorate of Defense Trade Controls to strategically assess potential vulnerabilities in the protection of export-controlled information using available resources, such as licensing data, and evaluate company practices for protecting such information.

    Agency Affected: Department of State

    Status: Closed - Not Implemented

    Comments: State, in its agency comments on our draft report and 60-day letter, disagreed with this recommendation and noted that it continuously assesses the defense industry's protection of export-controlled information through actions such as established license requirements and compliance activities.

    Recommendation: To improve the Department of Commerce's oversight of export-controlled information at companies, the Secretary of Commerce should direct the Administrator of the Bureau of Industry and Security to improve its interagency coordination with the Department of State in the following areas (1) provide specific guidance, outreach, and training on how to protect export-controlled information and (2) better target compliance activities on company protection of export-controlled information.

    Agency Affected: Department of Commerce

    Status: Closed - Implemented

    Comments: Based on Commerce's Deemed Export Strategic Outreach Plan, Commerce officials stated that the agency has increased its outreach and training activities to both universities and industry, including updates to its guidance and teaching tools, increases in the number of seminars, and the introduction of webinars. Officials also noted the agency is implementing recommendations of Deemed Export Advisory Committee (DEAC) to clarify the transfer of export controlled information, particularly within companies. Regarding interagency coordination, Commerce officials indicated that there have been increasing efforts to collaborate on export control enforcement efforts, including Commerce-provided training on export control enforcement for employees of other agencies and the creation of regional task forces, comprised of government law enforcement agencies, that utilize each agency's express expertise to address export control enforcement. Agency officials also noted expanded interagency coordination with the State Department and other agencies in Commerce seminars.

    Recommendation: To improve the Department of Commerce's oversight of export-controlled information at companies, the Secretary of Commerce should direct the Administrator of the Bureau of Industry and Security to strategically assess potential vulnerabilities in the protection of export-controlled information using available resources, such as licensing data, and evaluate company practices for protecting such information.

    Agency Affected: Department of Commerce

    Status: Closed - Implemented

    Comments: To address this recommendation, Commerce cited the agency's 2007 strategic outreach plan that was serves as a roadmap for assessing vulnerabilities in the protection of export controlled information, as well as establishment of the Deemed Export Advisory Committee (DEAC) to gain additional expert advice on deemed export policy, including potential vulnerabilities. Agency officials also have provided documentation of agency activities that address this recommendation, including the implementation of DEAC recommendations to simplify the deemed export licensing process and to extend Commerce's educational outreach efforts to ensure familiarity by those subject to the deemed export rule. Commerce also completed a Deemed Export Strategic Outreach Plan which aided development of specific criteria for the selection of organizations, including companies, targeted for agency's outreach activities. In addition, Commerce has analyzed compliance data, which agency officials stated has enabled the agency to identify gaps--compliance errors and violations by exporters--in the protection of controlled information as well as to target educational outreach to those companies.

    Recommendation: To improve the Department of State's oversight of export-controlled information at companies, the Secretary of State should direct the Director of the Directorate of Defense Trade Controls to improve its interagency coordination with the Department of Commerce in the following areas (1) provide specific guidance, outreach, and training on how to protect export-controlled information and (2) better target compliance activities on company protection of export-controlled information.

    Agency Affected: Department of State

    Status: Closed - Implemented

    Comments: On Sept. 29, 2010, State responded that it has and and will continue to expand guidance on licensing, compliance, and policy matters--stating that the Department has made significant improvements to its website for defense exporters since the GAO study was concluded. State also continues to work with the Society for International Affairs, a non-profit educational organization of the defense industry, Commerce and others on scheduling educational and training events throughout the United States.

    Aug 28, 2014

    Jul 24, 2014

    Jul 21, 2014

    Jul 9, 2014

    Jul 8, 2014

    Jun 26, 2014

    Looking for more? Browse all our products here