Export Controls: State Needs to Improve Compliance Data to Enhance Oversight of Defense Services

What GAO Found

The Department of State, which has responsibility for enforcing the International Traffic in Arms Regulations (ITAR), uses three mechanisms to monitor and enforce ITAR compliance among U.S. individuals or entities exporting defense services. They are (1) exporters' voluntary disclosures about their potential ITAR violations; (2) directed disclosures exporters submit in response to State's request for information about potential violations; and (3) referrals from State's end-use monitoring program.

State's Process for Identifying Potential ITAR Violations

According to State, in fiscal years 2013 through 2021, it received 8,547 voluntary disclosures of potential ITAR violations from exporters; requested information about potential violations from respondents in 505 directed disclosures; and found 85 potential violations through its end-use monitoring program. However, State told GAO it could not readily provide GAO with data from its compliance database on how many disclosures or potential violations involved defense services. According to State officials, State could not specify the number of cases related to potential ITAR violations for defense services in both the Compliance Case Management System and its predecessor system. According to State officials, State has limitations in its internal information technology mechanism used to tag cases, and in the mechanism used to collect information on violations from the regulated community. As a result, GAO found that State may not be able to readily use these data to assess trends or risks related to the export of defense services. State officials said they plan to develop procedures to improve data entry and quality, but were unable to provide GAO with documentation of these plans. State also plans to implement an online application that would improve the accuracy of disclosure submissions but has not yet established a definitive time frame for implementing the application.

The Department of Justice (DOJ) pursued at least 11 cases involving defense services during fiscal years 2013 through 2021. According to DOJ officials, these numbers are likely undercounts because DOJ databases do not specifically track ITAR violations and the department often charges persons under other statutes due to the high legal bar of prosecuting such violations. During this period, State pursued 16 civil enforcement actions for ITAR violations, five for unauthorized defense service exports; imposed fines of $100,000 to $41 million each year; and imposed other remedies.

Why GAO Did This Study

Cases involving private U.S. companies and individuals who have provided defense services, such as military training or furnishing technical data directly to foreign governments or entities, in violation of the ITAR have prompted questions about the U.S. government's monitoring and enforcement of such cases. U.S. persons seeking to export defense articles and defense services subject to control on the U.S. Munitions List as direct commercial sales must obtain authorization from State before exporting them. This process assists State in limiting exports that could present national security risks.

GAO was asked to review the U.S. government's efforts to enforce ITAR requirements for exports of defense services. This report examines (1) State's mechanisms for ensuring U.S. persons comply with ITAR requirements for defense services and (2) the actions that State and DOJ have pursued when a suspected violation of ITAR requirements has occurred. GAO reviewed related laws and regulations ; analyzed agency data on compliance, investigations, and prosecutions in fiscal years 2013 through 2021 ; and interviewed State and DOJ officials in Washington, D.C.

This is a public version of a sensitive report GAO issued in September 2022. Information State deemed sensitive has been removed.