DOD Critical Technologies: Plans for Communicating, Assessing, and Overseeing Protection Efforts Should Be Completed
Fast Facts
Protecting critical technologies—such as those used in aeronautics and space systems—is necessary for maintaining U.S. military superiority. Adversaries often try to steal or illegally export these technologies. Protecting them requires a collective effort from multiple federal agencies.
DOD has begun compiling a list of acquisition programs, technologies, manufacturing capabilities, and research areas that are critical for preserving U.S. advantages. But it has not decided how to communicate the list internally and to other agencies.
We recommended that DOD specify how it will communicate the list and assess and oversee protection efforts.
Highlights
What GAO Found
Critical technologies—such as elements of artificial intelligence and biotechnology—are those necessary to maintain U.S. technological superiority. As such, they are frequently the target of theft, espionage, and illegal export by adversaries. The Department of Defense (DOD) has outlined a revised process (see figure) to better identify and protect its critical technologies including those associated with acquisition programs throughout their lifecycle or those early in development. Prior DOD efforts to identify these technologies were considered by some military officials to be too broad to adequately guide protection. The revised process is expected to address this by offering more specificity about what elements of an acquisition program or technology need to be protected and the protection measures DOD is expected to implement. It is also expected to support DOD's annual input to the National Strategy for Critical and Emerging Technologies, which was first published in October 2020.
Overview of DOD's Revised Process to Identify and Protect Critical Acquisition Programs and Technologies
DOD began implementing this process in February 2020, and officials expect to complete all steps for the first time by September 2021. DOD has focused on identifying critical acquisition programs and technologies that need to be protected and how they should be protected. It has not yet determined
- how it will communicate the list internally and to other agencies,
- which metrics it will use to assess protection measures, and
- which organization will oversee future protection efforts.
By determining the approach for completing these tasks, DOD can better ensure its revised process will support the protection of critical acquisition programs and technologies consistently across the department.
Once completed, the revised process should also inform DOD and other federal agencies' protection efforts. Military officials stated they could use the list of critical acquisition programs and technologies to better direct resources. Officials from the Departments of State, Commerce, and the Treasury stated that they could use the list, if it is effectively communicated, to better understand what is important to DOD to help ensure protection through their respective programs.
Why GAO Did This Study
The federal government spends billions annually to develop and acquire advanced technologies. It permits the sale and transfer of some of these technologies to allies to promote U.S. national security, foreign policy, and economic interests. However, the technologies can be targets for adversaries. The John S. McCain National Defense Authorization Act for Fiscal Year 2019 requires the Secretary of Defense to develop and maintain a list of acquisition programs, technologies, manufacturing capabilities, and research areas that are critical for preserving U.S. national security advantages. Ensuring effective protection of critical technologies has been included on GAO's high-risk list since 2007.
This report examines (1) DOD's efforts to identify and protect its critical technologies, and (2) opportunities for these efforts to inform government protection activities. GAO analyzed DOD critical acquisition program and technologies documentation, and held interviews with senior officials at DOD and other federal agencies responsible for protecting critical technologies.
Recommendations
GAO is recommending that DOD specify how it will communicate its critical programs and technologies list, develop metrics to assess protection measures, and select the DOD organization that will oversee protection efforts beyond 2020. DOD concurred with the first recommendation and partially concurred with the second and third. GAO maintains the importance of all recommendations in this report.
Recommendations for Executive Action
| Agency Affected | Recommendation | Status |
|---|---|---|
| Department of Defense | The Secretary of Defense should direct the Deputy Secretary of Defense in conjunction with the Protecting Critical Technology Task Force to determine a process for formally communicating future critical acquisition programs and technologies lists to all relevant DOD organizations and federal agencies. (Recommendation 1) |
DOD agreed with this recommendation and in January 2021 attached a memorandum with instructions for addressees to disseminate the 2020 critical programs and technologies list to stakeholder DOD organizations and other relevant federal agencies. DOD intends to repeat this process year to year.
|
| Department of Defense | The Secretary of Defense should direct the Deputy Secretary of Defense in conjunction with the Protecting Critical Technology Task Force to identify, develop, and periodically review appropriate metrics to assess the implementation and sufficiency of the assigned protection measures. (Recommendation 2) |
DOD partially concurred with this recommendation, recognizing the need to identify mechanisms that can assess the effectiveness of assigned protection measures. DOD took steps in the last year to (1) share issues related to technology protection, (2) ensure commonality of protection measures across the department, and (3) assign responsibility for protection measures. However, DOD has yet to develop metrics to track implementation of protection measures, and to establish a process for routinely assessing the sufficiency or effectiveness of those metrics. As of November 2024, DOD was still in the process of determining how to address these elements.
|
| Department of Defense | The Secretary of Defense should direct the Deputy Secretary of Defense in conjunction with the Protecting Critical Technology Task Force to finalize the decision as to which DOD organization will oversee protection efforts beyond 2020. (Recommendation 3) |
DOD partially concurred with this recommendation and in July 2021 issued a memorandum transitioning protection efforts from the Protecting Critical Technology Task Force to the Office of the Under Secretary of Defense for Research and Engineering and other DOD entities.
|