EXPORT CONTROLS

NASA Management 

Action and Improved 

Oversight Needed to 

Reduce the Risk of 

Unauthorized Access 

to Its Technologies 

Statement of Belva Martin, Director, 

Acquisition and Sourcing Management 

Testimony 

Before the Subcommittees on 

Space and Oversight, Committee 

on Science, Space, and Technology, 

House of Representatives 

For Release on Delivery 

Expected at 10:00 a.m. ET 

Friday, June 20, 2014 

GAO-14-690T 

United States Government Accountability Office 
United States Government Accountability Office

Highlights of GAO-14-690T, a report to 

congressional requesters 

June 2014

EXPORT CONTROLS

NASA Management Action and Improved Oversight 

Needed to Reduce the Risk of Unauthorized Access 

to Its Technologies

Why GAO Did This Study

NASA develops sophisticated 

technologies and shares them with its 

international partners and others. U.S. 

export control regulations require 

NASA to identify and protect its 

sensitive technology; NASA delegates 

implementation of export controls to its 

10 research and space centers. 

Recent allegations of export control 

violations at two NASA centers have 

raised questions about NASA’s ability 

to protect its sensitive technologies. 

GAO was asked to review NASA’s 

export control program. 

This report assessed (1) NASA’s 

export control policies and how centers 

implement them, and (2) the extent to 

which NASA Headquarters and CEAs 

apply oversight of center compliance 

with its export control policies. To do 

this, GAO reviewed export control laws 

and regulations, NASA export control 

policies, and State and Commerce 

export control compliance guidance. 

GAO also reviewed NASA information 

on foreign national visits and technical 

papers and interviewed officials from 

NASA and its 10 centers as well as 

from other agencies. 

What GAO Recommends

In April 2014, GAO recommended that 

the NASA Administrator establish 

guidance to better define the CEA 

function, establish time frames to 

implement foreign national access 

corrective actions and assess results, 

and establish a more risk-based 

approach to oversight, among other 

actions. NASA concurred with all of our 

recommendations and provided 

information on actions taken or 

planned to address them.

What GAO Found

Weaknesses in the National Aeronautics and Space Administration (NASA) 

export control policy and implementation of foreign national access procedures at 

some centers increase the risk of unauthorized access to export-controlled 

technologies. NASA policies provide Center Directors wide latitude in 

implementing export controls at their centers. Federal internal control standards 

call for clearly defined areas of authority and establishment of appropriate lines of 

reporting. However, NASA procedures do not clearly define the level of center 

Export Administrator (CEA) authority and organizational placement, leaving it to 

the discretion of the Center Director. GAO found that 7 of the 10 CEAs are at 

least three levels removed from the Center Director. Three of these 7 stated that 

their placement detracted from their ability to implement export control policies by 

making it difficult to maintain visibility to staff, communicate concerns to the 

Center Director, and obtain resources; the other four did not express concerns 

about their placement. However, in a 2013 meeting of export control officials, the 

CEAs recommended placing the CEA function at the same organizational level at 

each center for uniformity, visibility, and authority. GAO identified and the NASA 

Inspector General also reported instances in which two centers did not comply 

with NASA policy on foreign national access to NASA technologies. For example, 

during a 4-month period in 2013, one center allowed foreign nationals on a major 

program to fulfill the role of sponsors for other foreign nationals, including 

determining access rights for themselves and others. Each instance risks 

damage to national security. Due to access concerns, the NASA Administrator 

restricted foreign national visits in March 2013, and directed each center to 

assess compliance with foreign national access and develop corrective plans. By 

June 2013, six centers identified corrective actions, but only two set time frames 

for completion and only one planned to assess the effectiveness of actions taken. 

Without plans and time frames to monitor corrective actions, it will be difficult for 

NASA to ensure that actions are effective.

NASA headquarters export control officials and CEAs lack a comprehensive 

inventory of the types and location of export-controlled technologies and NASA 

headquarters officials have not addressed deficiencies raised in oversight tools, 

limiting their ability to take a risk-based approach to compliance. Export 

compliance guidance from the regulatory agencies of State and Commerce 

states the importance of identifying controlled items and continuously assessing 

risks. NASA headquarters officials acknowledge the benefits of identifying 

controlled technologies, but stated that current practices, such as foreign national 

screening, are sufficient to manage risk and that they lack resources to do more. 

Recently identified deficiencies in foreign national visitor access discussed above 

suggest otherwise. Three CEAs have early efforts under way to better identify 

technologies which could help focus compliance on areas of greatest risk. For 

example, one CEA is working with NASA’s Office of Protective Services 

Counterintelligence Division to identify the most sensitive technologies at the 

center to help tailor oversight efforts. Such approaches, implemented NASAwide, could enable the agency to better target existing resources to protect 

sensitive technologies. View GAO-14-690T. For more information, 

contact Belva Martin at (202) 512-4841 or 

martinb@gao.gov. 
Page 1 GAO-14-690T 

Chairmen Palazzo, Broun, Ranking Members Edwards, Maffei, and 

Members of the Subcommittees:

Thank you for the opportunity to participate in today’s hearing on the 

National Aeronautics and Space Administration’s (NASA) system to 

protect sensitive information, including through its export control program. 

NASA develops new and sophisticated technologies to accomplish its 

missions in areas such as robotic probes to explore the surface of Mars 

and spacecraft to transport humans and cargo beyond low-earth orbit. 

The National Aeronautics and Space Act directs NASA to provide the 

widest practical and appropriate dissemination of information concerning 

its activities and results. The U.S. export control system, regulated 

primarily by two agencies—the Departments of State and Commerce—

seeks to limit the risk of sensitive information and items falling into the 

wrong hands while allowing legitimate sharing of information and trade to 

occur.1 U.S. export control regulations require any exporter, including 

NASA, to protect its sensitive information and technology. To effectively 

achieve its mission, NASA has to strike a balance between protecting 

sensitive technologies and information and preserving its mission to 

support international partnerships and dissemination of information. 

NASA’s export control program is governed by a NASA Policy Directive 

and NASA Procedural Requirement (export control NPR). These policies 

outline the goals of the export control program and NASA export control 

procedures contain detailed requirements and responsibilities for 

implementing the policy. NASA performs its mission through numerous 

programs and projects across its 10 research and space centers and 

headquarters.2

 1 Generally, exporters may submit an export license application to State if their items are 

controlled on the International Traffic in Arms Regulations (ITAR) U.S. Munitions List or to 

Commerce if their items are controlled on the Export Administration Regulations (EAR) 

Commerce Control List. Both the ITAR and EAR provide for exemptions and exceptions to 

licensing requirements, respectively. See 22 C.F.R. Part 12 and 15 C.F.R. Part 740. The 

Export Administration Act is not permanent legislation. Authority granted under the act 

lapsed in August 2001. 50 U.S.C. App. § 2419. However, Executive Order No. 13222, 

Continuation of Export Control Regulations, which was issued in August 2001 under the 

authority provided by the International Emergency Economic Powers Act (50 U.S.C. §§ 

1701-1707) continues the controls established under the act, and the implementing Export 

Administration Regulations. Executive Order No. 13222 requires an annual extension and 

was recently renewed by Presidential Notice on August 8, 2013. 78 Fed. Reg. 49.107 

(Aug. 12, 2013).

NASA Headquarters Export Administrator (HEA), the 

2 The Jet Propulsion Laboratory (JPL) is a NASA federally funded research and 

development center managed by the California Institute of Technology under contract with 

NASA. For purposes of this statement, we refer to JPL as a NASA center. 
Page 2 GAO-14-690T 

Center Directors, and their appointed Center Export Administrators 

(CEA), as well as Center Project Managers are some of the key 

personnel responsible for implementing NASA’s export control program.

Allegations of export control violations at two NASA centers over the last 

two years have raised questions about NASA’s ability to protect its 

sensitive technologies. In April 2014, we issued a report entitled Export 

Controls: NASA Management Action and Improved Oversight Needed to 

Reduce the Risk of Unauthorized Access to Its Technologies.

3

Like the April 2014 report, this statement discusses (1) NASA’s export 

control policies and how centers implement them, and (2) the extent to 

which NASA Headquarters and CEAs apply oversight of center 

compliance with its export control policies.

My 

remarks today are based on this report and initial actions NASA reported 

it has taken to begin addressing our recommendations.

For our April 2014 report, we reviewed export control laws and 

regulations, NASA export control policies, and State and Commerce 

export control compliance program guidance. We also reviewed NASA 

information on foreign national visits and technical papers and 

interviewed export control and security officials from NASA Headquarters 

and its 10 centers as well as from other agencies. Our work was 

performed in accordance with generally accepted government auditing 

standards.

We found weaknesses in the implementation of NASA’s export control 

policy and procedures concerning the CEA function and foreign national 

access procedures, which increase the risk of unauthorized access to 

export-controlled technology.

Variations in CEA Position, Function, and Resources: NASA’s export 

control policy provides the CEA the responsibility to ensure compliance of 

all Center program activities with U.S. export control laws and regulations 

and states that the position should be “senior-level,” but does not define 

what “senior-level” means. NASA headquarters export control officials 

define senior-level as a person at the GS-15 level or in the senior 

 3 GAO-14-315 (Washington, D.C.: April 15, 2014).

Weaknesses in 

Implementation of 

NASA Export Control 

Procedures Create 

Export Control 

Vulnerabilities
Page 3 GAO-14-690T 

executive service; however, we found that no CEAs were at the senior 

executive service level, three were GS-15s, and the CEAs at the 

remaining seven centers were at the GS-14 and GS-13 levels. 

In addition, NASA’s export control NPR does not contain a provision on 

the placement of the export control function and CEA within the center’s 

organizational structure. At some centers where they were several levels 

removed from the Center Director, CEAs stated that this placement 

makes it difficult to maintain authority and visibility to staff, to 

communicate concerns to center management, and to obtain the 

resources necessary to carry out their export control responsibilities. 

Conversely, a CEA at another center stated that his placement as Special 

Assistant to the Center Director creates a supportive environment to 

incorporate export controls into the project management processes and to 

require and provide export control training for the majority of center staff.

NASA headquarters’ export control officials, as well as several CEAs, 

noted that limitations in staff resources and time spent on export control 

functions makes it difficult to carry out the full range of export control 

duties, such as improving center export control procedures or providing a 

more robust export control training program. However, NASA’s export 

control NPR does not discuss the allocation of resources for the export 

control function or for the CEA within the center, and, according to NASA 

headquarters’ export control officials, each Center Director has the 

discretion of how to allocate resources to the export control function. As a 

result, we found variation among the centers in the staff resources 

assigned to the export control function, as shown in figure 1.
Page 4 GAO-14-690T 

Figure 1: NASA Center Export Control Staff Resources (as of Fiscal Year 2013)

Moreover, we found indications that the resources assigned to export 

controls at centers did not always appear to be commensurate with the 

export control workload. Specifically, 8 of the 10 centers had two or fewer 

civil servant staff to carry out export control activities for hundreds to 

thousands of foreign national visits, Scientific and Technical Information 

(STI) reviews, international agreements, and technical assistance 

agreements. For example, at one center in 2013, two civilian export 
Page 5 GAO-14-690T 

control officials working less than full time on export control activities were 

responsible for reviewing and providing any needed export control access 

restrictions for over 3,000 foreign national visitors and conducting STI 

reviews for over 2,000 publications. NASA’s procedural requirements for 

STI requires that all STI intended for release outside of NASA or 

presented at internal meetings where foreign persons may be present 

undergo technical, legal, and export control reviews, among others, to 

ensure that information is not unintentionally released through 

publication.4

 4

NASA NPR 2200.2C, “Requirements for Documentation, Approval, and Dissemination of 

NASA Scientific and Technical Information,” STI NPR. (Apr. 19, 2001)

See figure 2 for export control workload by center for fiscal 

year 2013. The CEA at one of the centers stated that the time to complete 

required review activities leaves little time to improve procedures or 

provide more robust training. To address the variations in authority, 

placement, and resources of the CEAs, we recommended NASA 

establish guidance defining the appropriate level and placement for the 

CEA function and assess the CEA workload to determine appropriate 

resources needed at each Center. NASA concurred, indicating plans to 

update existing guidance and to explore strategies to enhance support for 

the export control function.
Page 6 GAO-14-690T 

Figure 2: CEA Export Control Workload Activities in Fiscal Year 2013
Page 7 GAO-14-690T 

Weaknesses in Foreign National Access: Throughout fiscal year 2013 

NASA centers and Headquarters approved over 11,000 foreign national 

visits for periods ranging from less than 30 days to greater than 6 months. 

NASA’s security procedure requires screening of all foreign national 

visitors prior to gaining approval for access to any NASA facility. 

However, we identified instances in which NASA security procedures for 

foreign national access were not followed, which were significant given 

the potential impact on national security or foreign policy from 

unauthorized access to NASA technologies. Specifically, at one center, 

export control officials’ statements and our review of documentation 

identified instances between March and July of 2013, where foreign 

nationals fulfilled the role of sponsors for other foreign nationals by 

identifying the access rights to NASA technology for themselves and 

other foreign nationals for one NASA program.5 This is not in compliance 

with NASA’s security procedures which provide that only NASA civil 

servants or JPL employees who are U.S. citizens can act as sponsors for 

foreign nationals, which is one step in NASA’s process of approving and 

activating foreign national access. This center is taking action to address 

this issue and, as of December 2013, it developed a new approval 

process and criteria for foreign nationals requesting access to center 

automated databases and made revisions to center policies for 

information systems and foreign national access. We identified planned 

corrective actions at this and other Centers related to the management of 

foreign national access and, in our April report, we recommended that 

NASA develop plans with specific time frames to monitor these corrective 

actions to ensure their effectiveness. NASA concurred and indicated that 

it plans to take action to increase the effectiveness of its existing 

procedures and implement improvements.

 5 A foreign national sponsor is typically a NASA Project Manager or other NASA official 

who establishes and endorses the need for a relationship between the foreign national 

and NASA and requests their access to NASA facilities and information technology 

systems by identifying the foreign national’s access rights to NASA technology for a NASA 

program.
Page 8 GAO-14-690T 

We found that NASA headquarters export control officials and some 

CEAs faced challenges in providing effective oversight. In particular, the 

lack of a comprehensive inventory of export-controlled technologies and 

not effectively utilizing available oversight tools limit their ability to identify 

and address risks.

Lack of a Comprehensive Inventory of Export-Controlled 

Technologies: NASA headquarters export control officials and CEAs 

lack a comprehensive inventory of the types and location of exportcontrolled technologies at the centers, limiting their ability to identify 

internal and external risks to export control compliance. Five CEAs told us 

that they do not know the types and locations of export-controlled 

technologies, but rather rely on NASA program and project managers to 

have knowledge of this information. NASA’s export control NPR provides 

that NASA Center Program and Project Managers, in collaboration with 

CEAs, are to identify and assess export-controlled technical data. 

Additionally, NASA Center Project Managers are required by NASA’s 

export control NPR to provide appropriate safeguards to ensure exportcontrolled items6 and technical data are marked or identified prior to 

authorized transfer to foreign parties consistent with export control 

requirements. The CEA and security chief at one center told us that they 

requested a plan identifying where export-controlled and sensitive 

technologies are located within a research branch in order to facilitate 

foreign national visit requests. According to the branch manager, he was 

unable to provide this information, stating it would be too cumbersome to 

map out all of that information and try to restrict access to the areas with 

sensitive technologies. Assessing areas of vulnerability, including 

identifying and assessing export-controlled items, could better ensure that 

consistent procedures are practiced. NASA’s lack of a comprehensive 

inventory of its export-controlled technologies is a longstanding issue that 

the NASA Inspector General identified as early as 1999.7

Three centers began recent efforts to identify export-controlled 

technologies at their centers—one of which involves coordination with the 

center counterintelligence officer. Specifically, at this center, the 

 6 “Item” means commodities, software, and/or technology/technical data. NASA NPR 

2190.1B, “NASA Export Control Program” (Dec. 27, 2011).

7 NASA Inspector General Report, NASA Control of Export-Controlled Technologies, IG99-020, (Mar. 31, 1999).

NASA Lacks a 

Comprehensive 

Inventory of

Export-Controlled 

Technologies and

Is Not Fully Utilizing 

Oversight Tools
Page 9 GAO-14-690T 

counterintelligence office collaborated with the CEA to conduct a sensitive

technology survey—designed to identify the most sensitive technologies 

at the center—to better manage risks by developing protective measures 

for these technologies in the areas of counterintelligence, information 

technology security, and export controls. Such approaches, implemented 

NASA-wide, could enable the agency to take a more risk-based approach 

to oversight by targeting existing resources to identify the most sensitive 

technologies and then ensure the location of such technologies are 

known and protected. To implement a risk-based approach, we 

recommended NASA build off of existing information sources, such as 

assessments by NASA’s counterintelligence office, to identify targeted 

technologies. In its response, NASA highlighted plans to implement a 

risk-based approach that would include CEAs, program managers, and 

counterintelligence officials.

Underutilization of Oversight Tools: NASA’s oversight tools, including 

annual audits, export control conferences with CEA, and voluntary 

disclosures, have identified deficiencies, but NASA headquarters has not 

addressed them. Specifically, we found that seven centers have 

unresolved findings, recommendations, or observations spanning a 

period from 2005 to 2012, in areas including export control awareness, 

management commitment, resources, training, foreign national visitor 

processes, and disposal of property. At five centers, responding to audit 

findings and implementing recommendations required that the CEA 

coordinate with other offices and programs across the center beyond the 

CEA’s control. The remaining two centers cited resource constraints, 

organizational priorities, and insufficient coordination with center 

management as barriers to implementing corrective actions and resolving 

recommendations. NASA’s current procedures do not address 

coordination among offices at a center to address findings from annual 

audits.

Further, NASA headquarters export control officials hold annual export 

control program reviews with the CEAs to discuss export control changes 

and CEA concerns and recommendations for the program. At NASA’s 

2013 annual review, the CEAs presented NASA headquarters export 

control officials with a list of comments regarding the export control 

program, many of which echo the issues raised in our April 2014 report, 

such as CEA position and resources, foreign national access, and 

awareness of export-controlled technologies. NASA headquarters’ export 

control officials stated that they agree with the issues raised by the CEAs 

but acknowledged that they have not fully addressed the CEA concerns 

from the most recent program review in March 2013 and have not 
Page 10 GAO-14-690T 

developed specific plans to do so. In fact, we found that over the last 3 

years, NASA headquarters export control officials provided only one 

policy update or other direction to address export control concerns raised 

by the CEAs. In our April report, we made two recommendations to 

address underutilization of the audit and program review tools. To ensure 

implementation of audit findings, we recommended that NASA direct 

Center Directors to oversee implementation of the audit findings. 

Similarly, we recommended that NASA develop a plan, including 

timeframes, to ensure CEA issues and suggestions for improvement are 

addressed. NASA concurred and plans to revise existing guidance.

NASA may also be missing an opportunity to use voluntary disclosures to 

help improve export control compliance. NASA’s export control NPR 

provides that it is every NASA employee’s personal responsibility to 

comply with U.S. export control laws and regulations; and further provides 

the Departments of State and Commerce’s regulatory requirements for 

voluntary self disclosure of noncompliance in export activities, even if the 

errors were inadvertent. NASA’s headquarters’ export control program 

officials told us that few or no voluntary disclosures might indicate a 

weakness in a center’s export control program. We found little usage of 

the voluntary disclosure process at the NASA centers: a total of 13 

voluntary disclosures divided among four of the NASA centers since 

2011, and potential noncompliance ranged from failure to file a record of 

shipment to Germany to potential foreign national exposure to a 

program’s technical data. The remaining six NASA centers have not 

submitted voluntary disclosures since 2011. We found that a similar event 

may lead to a voluntary disclosure at one center but not another and that 

CEA approaches toward voluntary disclosures at some centers may 

affect NASA’s ability to identify and report potential violations of export 

control regulations. To ensure consistency in reporting potential export 

control violations, in our April 2014 report, we recommended that NASA 

re-emphasize to CEAs the requirements on how and when to notify 

headquarters. NASA concurred and plans to revise and develop 

additional guidance.

As stated above, NASA concurred with all of our recommendations and 

stated that our findings and recommendations complement results from 

the recent reviews by the NASA’s Inspector General and the National 

Academy of Public Administration. Further, NASA stated in its response 

to each of these reviews that it plans to adopt a more comprehensive, 

risk-based approach to enhance its export control program.
Page 11 GAO-14-690T 

Subsequent to our report, the NASA Administrator issued an email to all 

employees reiterating the importance of the export control program and 

announcing plans to expand the online and in-person export control 

training. This is an important step as it sets a tone from the top and could 

help ensure the centers apply consistent approaches. However, it will be 

important for NASA to be vigilant in assessing actions taken to help 

ensure effective implementation and to avoid a relapse into the former 

practices. Collectively, improvements in all of these areas can help NASA

strike an effective balance between protecting the sensitive exportcontrolled technologies and information it creates and uses and 

supporting international partners and disseminating important scientific 

information as broadly as possible.

Mr. Chairmen, Ranking Members, and members of the subcommittees, 

this concludes my prepared remarks. I would happy to answer any 

questions that you may have.

For questions about this statement, please contact Belva Martin at (202) 

512-4841, or at (martinb@gao.gov). Contact points for our Offices of 

Congressional Relations and Public Affairs may be found on the last page 

of this statement. Individuals making key contributions to this testimony 

include William Russell, Assistant Director; Caryn Kuebler, Analyst-inCharge; Marie Ahearn; Lisa Gardner; Laura Greifner; Amanda Parker; 

and Roxanna Sun.

GAO Contact and 

Staff 

Acknowledgements

(121235)
This is a work of the U.S. government and is not subject to copyright protection in the 

United States. The published product may be reproduced and distributed in its entirety 

without further permission from GAO. However, because this work may contain 

copyrighted images or other material, permission from the copyright holder may be 

necessary if you wish to reproduce this material separately.
The Government Accountability Office, the audit, evaluation, and 

investigative arm of Congress, exists to support Congress in meeting its 

constitutional responsibilities and to help improve the performance and 

accountability of the federal government for the American people. GAO 

examines the use of public funds; evaluates federal programs and 

policies; and provides analyses, recommendations, and other assistance 

to help Congress make informed oversight, policy, and funding decisions. 

GAO’s commitment to good government is reflected in its core values of 

accountability, integrity, and reliability.

The fastest and easiest way to obtain copies of GAO documents at no 

cost is through GAO’s website (http://www.gao.gov). Each weekday 

afternoon, GAO posts on its website newly released reports, testimony, 

and correspondence. To have GAO e-mail you a list of newly posted 

products, go to http://www.gao.gov and select “E-mail Updates.”

The price of each GAO publication reflects GAO’s actual cost of 

production and distribution and depends on the number of pages in the 

publication and whether the publication is printed in color or black and 

white. Pricing and ordering information is posted on GAO’s website, 

http://www.gao.gov/ordering.htm. 

Place orders by calling (202) 512-6000, toll free (866) 801-7077, or 

TDD (202) 512-2537.

Orders may be paid for using American Express, Discover Card, 

MasterCard, Visa, check, or money order. Call for additional information.

Connect with GAO on Facebook, Flickr, Twitter, and YouTube.

Subscribe to our RSS Feeds or E-mail Updates. Listen to our Podcasts.

Visit GAO on the web at www.gao.gov.

Contact:

Website: http://www.gao.gov/fraudnet/fraudnet.htm

E-mail: fraudnet@gao.gov

Automated answering system: (800) 424-5454 or (202) 512-7470

Katherine Siggerud, Managing Director, siggerudk@gao.gov, (202) 512-

4400, U.S. Government Accountability Office, 441 G Street NW, Room 

7125, Washington, DC 20548

Chuck Young, Managing Director, youngc1@gao.gov, (202) 512-4800

U.S. Government Accountability Office, 441 G Street NW, Room 7149 

Washington, DC 20548

GAO’s Mission

Obtaining Copies of 

GAO Reports and 

Testimony

Order by Phone

Connect with GAO

To Report Fraud, 

Waste, and Abuse in 

Federal Programs

Congressional 

Relations

Public Affairs

Please Print on Recycled Paper.