Export Controls:

Agencies Should Assess Vulnerabilities and Improve Guidance for Protecting Export-Controlled Information at Universities

GAO-07-70: Published: Dec 5, 2006. Publicly Released: Dec 5, 2006.

Additional Materials:

Contact:

John P. Hutton
(202) 512-4383
contact@gao.gov

 

Office of Public Affairs
(202) 512-4800
youngc1@gao.gov

Foreign students and scholars have made substantial contributions to U.S. research efforts and technology development. However, according to a federal government intelligence assessment, foreign access to sensitive U.S. technology has imposed a significant but unquantifiable cost to the United States. Given this risk, GAO was asked to (1) describe the nature of the research at universities and identify steps they take to comply with export controls and (2) assess efforts by the Departments of Commerce and State--the key export control agencies--to determine the risk of export violations in university research. GAO reviewed Commerce and State export control programs and met with officials from 13 universities, selected based on their foreign student populations, applications for export licenses, and federal grants and contracts.

The U.S. export control system requires export licensing for defense items and items that have both commercial and military applications, except where exclusions apply, such as those applicable to universities in some circumstances. The U.S. export control agencies place the onus on universities to understand and comply with the regulations. According to university officials we interviewed, their institutions focus almost exclusively on fundamental research--defined as basic and applied research in science and engineering, the results of which ordinarily are published and shared broadly within the scientific community. Such research is generally not subject to export controls. Universities we visited conduct research in such areas as nanotechnologies, computer security, and chemical engineering. To ensure their research remains in the public domain, university officials said they negotiate contract language to remove publication or other dissemination restrictions for research they consider to be fundamental. If export controls apply, university officials stated they sometimes involve only those students eligible to conduct the research under a license exclusion, to avoid the lengthy license application process. In other cases, they refer such work to off-campus associated facilities that can better regulate and control foreign national access to the research. Universities we visited indicated that government-provided training and guidance on export control regulations is limited in informing their efforts to manage and protect export-controlled information in the university environment. State and Commerce officials expressed concerns that universities may not correctly interpret and apply export regulations, given the large number of foreign students participating in research at universities and the relative lack of license applications from universities. Although federal internal control standards contain guidelines for agencies to conduct risk assessments, State and Commerce have not conducted an overall assessment of available trend data on technology development research and foreign participation in such research at U.S. universities to identify potential vulnerabilities. For example, U.S. government agencies collect data on foreign student nationality, school enrollment, and types of research conducted at universities for federal agencies, which could supplement information that State and Commerce receive from visa application processes and other sources. Although State and Commerce provide guidance through training seminars, agency Web sites, and telephone help desks to assist exporters in understanding and complying with regulations, officials stated that their focus is on processing export license applications--primarily from industry. Recently, Commerce established an advisory committee composed of industry and university representatives who are expected to discuss issues such as the nature of university research and its relation to export controls.

Status Legend:

More Info
  • Review Pending-GAO has not yet assessed implementation status.
  • Open-Actions to satisfy the intent of the recommendation have not been taken or are being planned, or actions that partially satisfy the intent of the recommendation have been taken.
  • Closed-implemented-Actions that satisfy the intent of the recommendation have been taken.
  • Closed-not implemented-While the intent of the recommendation has not been satisfied, time or circumstances have rendered the recommendation invalid.
    • Review Pending
    • Open
    • Closed - implemented
    • Closed - not implemented

    Recommendations for Executive Action

    Recommendation: To improve the Department of State's oversight of export-controlled information under its jurisdiction at universities, the Secretary of State should direct the Director of the Directorate of Defense Trade Controls to strategically assess potential vulnerabilities in the conduct and publication of academic research by becoming more knowledgeable about research being conducted on university campuses and, in consultation with other agencies, make use of available information on technology development and foreign student populations at universities to assess the extent to which research at universities may be subject to export controls.

    Agency Affected: Department of State

    Status: Closed - Not Implemented

    Comments: According to Department of State letter dated July 19, 2007, the Department's Directorate of Defense Trade Controls does not have the resources to conduct the strategic analysis we recommended. Therefore we are closing this recommendation since State does not intend to implement it.

    Recommendation: To improve the Department of Commerce's oversight of export-controlled information under its jurisdiction at universities, the Secretary of Commerce should, on the basis of this assessment of university research and foreign student populations, direct the Administrator of the Bureau of Industry and Security to improve interagency coordination, conduct additional outreach, and improve guidance to ensure that universities understand when to apply export controls.

    Agency Affected: Department of Commerce

    Status: Closed - Implemented

    Comments: Based on Commerce's Deemed Export Strategic Outreach Plan, Commerce officials stated that the agency has increased its outreach and training activities to both universities and industry, including updates to its guidance and teaching tools, increases in the number of seminars, and the introduction of webinars. Officials also noted the agency is implementing recommendations of Deemed Export Advisory Committee (DEAC) to clarify the transfer of export controlled information. Regarding interagency coordination, Commerce officials indicated that there have been increasing efforts to collaborate on export control enforcement efforts, including Commerce-provided training on export control enforcement for employees of other agencies and the creation of regional task forces, comprised of government law enforcement agencies, that utilize each agency's express expertise to address export control enforcement. Agency officials also noted expanded interagency coordination with the State Department and other agencies in Commerce seminars.

    Recommendation: To improve the Department of Commerce's oversight of export-controlled information under its jurisdiction at universities, the Secretary of Commerce should direct the Administrator of the Bureau of Industry and Security to strategically assess potential vulnerabilities in the conduct and publication of academic research by becoming more knowledgeable about research being conducted on university campuses and, in consultation with other agencies, make use of available information on technology development and foreign student populations at universities to assess the extent to which research at universities may be subject to export controls.

    Agency Affected: Department of Commerce

    Status: Closed - Implemented

    Comments: To address this recommendation, Commerce cited the agency's 2007 strategic outreach plan that was serves as a roadmap for assessing vulnerabilities in the protection of export controlled information, as well as establishment of the Deemed Export Advisory Committee (DEAC) to gain additional expert advice on deemed export policy, including potential vulnerabilities. Agency officials also have provided documentation of agency activities that address this recommendation, including the implementation of DEAC recommendations to simplify the deemed export licensing process and to extend Commerce's educational outreach efforts to ensure familiarity by those subject to the deemed export rule. Commerce also completed a Deemed Export Strategic Outreach Plan which aided development of specific criteria for the selection of organizations, including universities, targeted for agency's outreach activities. In addition, Commerce has analyzed compliance data, which agency officials stated has enabled the agency to identify gaps--compliance errors and violations by exporters--in the protection of controlled information as well as to target educational outreach to exporters.

    Recommendation: To improve the Department of State's oversight of export-controlled information under its jurisdiction at universities, the Secretary of State should direct the Director of the Directorate of Defense Trade Controls, on the basis of this assessment of university research and foreign student populations, to improve interagency coordination, conduct additional outreach, and improve guidance to ensure that universities understand when to apply export controls.

    Agency Affected: Department of State

    Status: Closed - Implemented

    Comments: As of Sept. 29, 2010, State responded that the US Government has significantly improved the way it does business with universities. The Department of Defense through the Defense Supplement to the Federal Acquisition Regulations (DFARS) now requires that contracts with universities (& others) contain a clause notifying contractors of their requirement to comply with the ITAR and AECA where the research involves export controlled subject matter. Further guidance about contractor requirements for physical security and limitations on access to foreign students is contained in the National Industrial Security Policy Manual (NISPOM).

    Jul 21, 2014

    Jul 9, 2014

    Jul 8, 2014

    Jun 26, 2014

    Jun 25, 2014

    Jun 24, 2014

    Jun 17, 2014

    Looking for more? Browse all our products here