Report to the Committee on Armed 

Services, U.S. Senate 

United States Government Accountability Office

GAO

July 2005 INDUSTRIAL 

SECURITY 

DOD Cannot Ensure 

Its Oversight of 

Contractors under 

Foreign Influence Is 

Sufficient 

GAO-05-681 
What GAO Found

United States Government Accountability Office

Why GAO Did This Study

Highlights

Accountability Integrity Reliability

www.gao.gov/cgi-bin/getrpt?GAO-05-681.

To view the full product, including the scope 

and methodology, click on the link above. 

For more information, contact Ann CalvaresiBarr at (202) 512-4841 or 

calvaresibarra@gao.gov. 

Highlights of GAO-05-681, a report to 

Committee on Armed Services, U.S. 

Senate 

July 2005

INDUSTRIAL SECURITY 

DOD Cannot Ensure Its Oversight of 

Contractors under Foreign Influence 

Is Sufficient 

DSS’s oversight of contractors under FOCI depends on contractors self--

reporting foreign business transactions such as foreign acquisitions. As part 

of its oversight responsibilities, DSS verifies the extent of the foreign 

relationship, works with the contractor to establish protective measures to 

insulate foreign interests, and monitors contractor compliance with these 

measures. In summary, GAO found that DSS cannot ensure that its approach 

to overseeing contractors under FOCI is sufficient to reduce the risk of 

foreign interests gaining unauthorized access to U.S. classified information. 

First, DSS does not systematically ask for, collect, or analyze information on 

foreign business transactions in a manner that helps it properly oversee 

contractors entrusted with U.S. classified information. In addition, DSS does 

not collect and track the extent to which classified information is left in the 

hands of a contractor under FOCI before measures are taken to reduce the 

risk of unauthorized foreign access. During our review, we found instances 

in which contractors did not report foreign business transactions to DSS for 

several months. We also found a contractor under foreign ownership that 

appeared to operate for at least 6 months with access to U.S. classified 

information before a protective measure was implemented to mitigate 

foreign ownership. 

Second, DSS does not centrally collect and analyze information to assess its 

effectiveness and determine what corrective actions are needed to improve 

oversight of contractors under FOCI. For example, DSS does not know the 

universe of all contractors operating under protective measures, the degree 

to which contractors are complying overall with measures, or how its 

oversight could be strengthened by using information such as 

counterintelligence data to bolster its measures. 

Third, DSS field staff face a number of challenges that significantly limit 

their ability to sufficiently oversee contractors under FOCI. Field staff told 

us they lack research tools and training to fully understand the significance 

of corporate structures, legal ownership, and complex financial relationships 

when foreign entities are involved. Staff turnover and inconsistencies over 

how guidance is to be implemented also detract from field staff’s ability to 

effectively carry out FOCI responsibilities. 

The Department of Defense (DOD) 

is responsible for ensuring that U.S. 

contractors safeguard classified 

information in their possession. 

DOD delegates this responsibility 

to its Defense Security Service 

(DSS), which oversees more than 

11,000 contractor facilities that are 

cleared to access classified 

information. Some U.S. contractors 

have foreign connections that may 

require measures to be put into 

place to reduce the risk of foreign 

interests gaining unauthorized 

access to classified information. 

In response to a Senate report 

accompanying the National 

Defense Authorization Act for 

Fiscal Year 2004, GAO assessed the 

extent to which DSS has assurance 

that its approach provides 

sufficient oversight of contractors 

under foreign ownership, control, 

or influence (FOCI). 

What GAO Recommends

GAO recommends that DOD direct 

DSS to improve data collection and 

analysis of FOCI transactions and 

protective measures and direct DSS 

to systematically assess the 

effectiveness of the FOCI process 

to reduce risk of foreign interests 

gaining unauthorized access to 

classified information. DSS should 

formulate a human capital strategy 

and plan to evaluate whether its 

staff need better information, 

training, and tools to perform FOCI 

responsibilities. DOD did not 

concur with our recommendations 

and stated the process is sufficient. 
Page i GAO-05-681 Industrial Security 

Letter 1

Results in Brief 3 

Background 4 

DSS’s Approach to Overseeing FOCI Contractors Is Insufficient 8 

Conclusions 15 

Recommendations for Executive Action 16 

Agency Comments 17 

Appendix I Scope and Methodology 20 

Appendix II Comments from the Department of Defense 21 

Table 

Table 1: Types of Protective Measures 7 

Figures 

Figure 1: Overview of DSS’s FOCI Process 6 

Figure 2: Knowledge Gaps in DSS’s FOCI Process 9 

Abbreviations 

DOD Department of Defense 

DSS Defense Security Service 

FOCI foreign ownership, control, or influence 

Contents 

This is a work of the U.S. government and is not subject to copyright protection in the 

United States. It may be reproduced and distributed in its entirety without further 

permission from GAO. However, because this work may contain copyrighted images or 

other material, permission from the copyright holder may be necessary if you wish to 

reproduce this material separately. 
Page 1 GAO-05-681 Industrial Security 

July 15, 2005 

The Honorable John W. Warner 

Chairman 

Committee on Armed Services 

United States Senate 

The Honorable Carl Levin 

Ranking Minority Member 

Committee on Armed Services 

United States Senate 

The Department of Defense (DOD) depends on numerous U.S. contractor 

facilities to develop and produce military technologies, such as those used 

in tactical aircraft and military satellites, that require access to classified 

information. DOD’s Defense Security Service (DSS) on behalf of DOD and 

23 other federal departments administers the National Industrial Security 

Program, which was established to ensure that contractors appropriately 

safeguard classified information in their possession while performing 

work for the U.S. government. DSS is responsible for providing oversight 

and assistance to U.S. contractors that are cleared for access to classified 

information. Among these contractors are those under foreign ownership, 

control, or influence (FOCI)—that is, a situation in which a foreign 

interest has the power to decide matters affecting a contractor’s 

operations and that could result in unauthorized access to U.S. classified 

information or adversely affect the performance of classified contracts.1

The policy of the U.S. government is to allow foreign interests to invest in 

U.S. contractors as long as those investments do not pose a threat to U.S. 

national security interests. 

DSS depends on the contractor to self-report information about certain 

business transactions with foreign entities such as foreign ownership of a 

contractor’s stock. Once it becomes aware that a contractor has come 

under foreign influence through such transactions, DSS is responsible for 

verifying the extent of the foreign relationship. DSS and the contractor 

 1

FOCI is defined in the National Industrial Security Program Operating Manual, which 

prescribes the requirements, restrictions, and safeguards that contractors are to follow to 

prevent the unauthorized disclosure of classified information. 

United States Government Accountability Office

Washington, DC 20548 
Page 2 GAO-05-681 Industrial Security 

then work together to decide what appropriate action or measure is to be 

taken to protect U.S. classified information from unauthorized disclosure 

to foreign interests. DSS relies on a number of protective measures to 

reduce the risk of foreign entities having unauthorized access to classified 

information, including requiring a foreign owner to transfer title of 

company stock to U.S. citizen trustees approved by DOD. DSS is also 

responsible for monitoring the contractors’ implementation of the 

protective measures put in place to mitigate FOCI and relies on 

contractors to report instances of noncompliance with its protective 

measures. 

In a report accompanying the National Defense Authorization Act for 

Fiscal Year 2004, the Senate Armed Services Committee directed us to 

review DSS’s oversight of contractors with foreign business relationships. 

In response, we examined the extent to which DSS has assurance that its 

approach provides sufficient oversight of contractors under foreign 

ownership, control, or influence.2

To assess DSS’s oversight of U.S. contractors involved in foreign business 

transactions, we interviewed and obtained documentation from DSS 

headquarters, DSS field offices, and selected contractors operating under 

various protective measures. We reviewed DSS’s guidance and procedures 

for overseeing contractors that operate under FOCI and for monitoring 

contractors’ compliance with protective measures. We examined and 

analyzed 27 case files for contractors that had various types of foreign 

business transactions reviewed by DSS, which we discussed with DSS 

headquarters and field officials. We performed our work from June 2004 to 

May 2005 in accordance with generally accepted government auditing 

standards. Details on our scope and methodology can be found in 

appendix I. 

 2

 As part of its report accompanying the National Defense Authorization Act for Fiscal Year 

2004 (S. Rep. No. 108-46, at 345-346 (2003)), the Senate Committee on Armed Services also 

directed us to review DOD’s National Industrial Security Program. In response to that 

request, we assessed (1) DSS’s oversight of U.S. contractor facilities’ implementation of the 

National Industrial Security Program and (2) DSS’s adherence to required procedures after 

a security violation and possible compromise of classified information. Our assessment 

was detailed in the following report: GAO, Industrial Security: DOD Cannot Provide 

Adequate Assurance That Its Oversight Ensures the Protection of Classified Information, 

GAO-04-332 (Washington, D.C.: Mar. 3, 2004). 
Page 3 GAO-05-681 Industrial Security 

DSS cannot ensure that its oversight of contractors under FOCI is 

sufficient to reduce the risk of foreign interests gaining unauthorized 

access to U.S. classified information. First, DSS does not systematically 

ask for information that would allow it to know if contractors are 

reporting foreign business transactions when they occur. DSS also does 

not collect and track the extent to which classified information is 

accessible to a contractor under FOCI before measures are taken to 

reduce the risk of unauthorized foreign access. Without this information, 

DSS is limited in its ability to effectively oversee contractors under FOCI 

and take actions when needed to protect classified information from 

undue foreign access. During our review, we found instances in which 

contractors did not report foreign business transactions to DSS for several 

months. In addition, we found a contractor under foreign ownership that 

appeared to have had access to U.S. classified information for at least 6 

months before a protective measure was implemented. Second, DSS does 

not centrally collect and analyze information to assess its effectiveness 

and determine what corrective actions are needed to improve oversight of 

contractors under FOCI. For example, DSS does not know the total 

number of contractors operating under all protective measures and the 

degree to which contractors are complying overall with protective 

measures. Third, DSS field staff face a number of challenges in carrying 

out their responsibilities in overseeing contractors under FOCI. Field staff 

told us they lack research tools and training to fully understand the 

significance of corporate structures, legal ownership, and complex 

financial relationships when foreign entities are involved. Field staff also 

informed us that staff turnover further compounded these challenges. In 

addition, we found inconsistencies in how field staff understand and 

implement FOCI guidance. These challenges combined significantly limit 

DSS field staff’s ability to sufficiently oversee contractors under FOCI to 

minimize the risk of unauthorized foreign access to U.S. classified 

information. 

In light of our findings, we are recommending that the Secretary of 

Defense take certain actions to (1) improve DDS’s knowledge of the timing 

of foreign business transactions, (2) assess the overall effectiveness of 

DSS’s oversight of contractors under FOCI, and (3) develop a human 

capital strategy that would provide the appropriate support for industrial 

security representatives. DOD did not concur with our recommendations. 

In commenting on a draft of our report, DOD indicated that it believes the 

FOCI process is adequate to ensure the protection of classified 

information. However, DOD did not provide evidence to support this 

belief. Given the vulnerabilities we identified in our report, our 

recommendations stand. 

Results in Brief 
Page 4 GAO-05-681 Industrial Security 

The National Industrial Security Program was established in 1993 for the 

protection of classified information. DSS administers the National 

Industrial Security Program on behalf of DOD and 23 other federal 

departments and agencies. DSS is responsible for providing oversight, 

advice, and assistance to more than 11,000 U.S. contractor facilities that 

are cleared for access to classified information. Contractor facilities can 

range in size, be located anywhere in the United States, and include 

manufacturing plants, laboratories, and universities. About 221 industrial 

security representatives work out of 25 DSS field offices across the United 

States and serve as the primary points of contact for these facilities. DSS is 

responsible for ensuring that these contractors meet requirements to 

safeguard classified information under the National Industrial Security 

Program. Contractors must have facility security clearances under this 

program before they can work on classified contracts. 

To obtain a facility security clearance, contractors are required to selfreport foreign business transactions on a Certificate Pertaining to Foreign 

Interests form. 3 Examples of such transactions include foreign ownership 

of a contractor’s stock, a contractor’s agreements or contracts with 

foreign persons, and whether non-U.S. citizens sit on a contractor’s board 

of directors. DSS’s industrial security representatives provide guidance to 

contractors on filling out the certificate. If a contractor declares no foreign 

business transactions on the certificate, DSS places the certificate in the 

contractor’s file located in the field. When U.S. contractors with facility 

security clearances have changes in foreign business transactions to 

report, they are required to complete the certificate again and resubmit it 

every 5 years, even if no foreign transactions take place. Because a U.S. 

company can own a number of contractor facilities, the corporate 

headquarters or another legal entity within that company is required to 

complete the certificate.4

 3

 Throughout our report, we refer to information reported by contractors on the Certificate 

Pertaining to Foreign Interests form, or the changes afterwards, as foreign business 

transactions. 

4

 Each business structure has its own set of legal requirements. Within the National 

Industrial Security Program, the most common type of business structure is the 

corporation. A corporation may be organized as a single corporate entity, a multiple facility 

organization with divisions, or a parent-subsidiary relationship. Under a multiple facility 

organization, the home office is the legal entity, while the divisions are extensions of the 

legal entity. In a parent-subsidiary relationship, the parent and the subsidiary are separate 

legal entities. 

Background 
Page 5 GAO-05-681 Industrial Security 

When contractors declare foreign transactions on their certificates and 

notify DSS, industrial security representatives are responsible for ensuring 

that contractors properly identify all relevant foreign business 

transactions. They are also required to collect, analyze, and verify 

pertinent information about these transactions. For example, by 

examining various corporate documents, the industrial security 

representatives can determine corporate structures and ownership and 

identify key management officials. The representatives may consult with 

DSS counterintelligence officials, who can provide information about 

threats to U.S. classified information. If contractors’ answers on the 

certificates indicate that foreign transactions meet certain DSS criteria or 

exceed thresholds, such as the percentage of company stock owned by 

foreign persons, the representatives forward these FOCI cases to DSS 

headquarters. DSS headquarters works with contractors to determine 

what, if any, protective measures are needed to reduce the risk of foreign 

interests gaining unauthorized access to U.S. classified information. DSS 

field staff are then responsible for monitoring contractor compliance with 

these measures. Figure 1 shows highlights of the FOCI process. 
Page 6 GAO-05-681 Industrial Security 

Figure 1: Overview of DSS’s FOCI Process 

On a case-by-case basis, DSS headquarters can approve the use by 

contractors of one of six types of protective measures: voting trust 

agreements, proxy agreements, special security agreements, security 

control agreements, board resolutions, and limited facility clearances. 

These protective measures are intended to insulate contractor facilities 

from undue foreign control and influence and to reduce the risk of 

unauthorized foreign access to classified information. Protective measures 

vary in the degree to which foreign entities are insulated from classified 

information and are not intended to deny foreign owners the opportunity 

Submit Certificate Pertaining to Foreign 

Interests along with supporting

documentation to DSS

Identification and

verification of FOCI

Who is involved

in the process Mitigation of FOCI

Oversight of 

contractors with FOCI

Submit plan to

DSS headquarters for

protective measures

Participate in DSS 

security review

Submit compliance report 

and hold annual FOCI 

meeting (when required) 

with DSS industrial security

representatives 

Conduct security review

Review compliance report

and attend annual FOCI

meeting (when required)

with contractors

Review compliance 

report and attend first 

annual FOCI meeting 

(when required) with 

contractors

Review and approve

contractors’ plans for 

protective measures

Hold initial meeting with

contractors to discuss

protective measures

Conduct further review of contractorsupplied FOCI information

Determine need for protective

measures

Verify information in foreign interest 

certificate and in supporting documentation

Determine if answers on certificate meet 

criteria or exceed thresholds that require 

DSS headquarters’ review

 If criteria are met or thresholds are

 exceeded, forward case to headquarters

 If case does not require headquarters

 review, maintain documentation in field 

 office file

Industrial security

representatives in

DSS field offices

DSS headquarters

officials

Source: DSS (data); GAO (analysis and presentation).

Contractor

facilities’ officials
Page 7 GAO-05-681 Industrial Security 

to pursue business relationships with their U.S.-based contractor facilities 

working on classified contracts. Table 1 provides a general description of 

each of these protective measures. In addition to these measures, DSS can 

also require contractors to take certain actions to mitigate specific FOCI 

situations such as termination of loan agreements or elimination of debt 

owed to a foreign entity. 

Table 1: Types of Protective Measures 

Protective measure General description 

Voting trust agreement • Foreign owners transfer legal title to the stock of the foreign-owned U.S. company to U.S. citizen 

trustees that are approved by DOD 

Proxy agreement • Similar to a voting trust, except foreign owners retain legal title to the stock and transfer voting 

rights of stock to U.S. citizen proxy holders that are approved by DOD 

Special security agreement • Allows representatives of the foreign owner to be on the U.S. contractor’s board of directors but 

requires U.S. citizen outside directors that are approved by DOD 

• Contractors under a special security agreement are denied access to classified information such 

as Top Secret, special access, and other sensitive information unless DOD determines it is in 

the U.S. national interest and grants an exception 

Security control agreement • Similar to a special security agreement and used when contractor is not effectively owned or 

controlled by foreign person(s) 

• Unlike contractors under a special security agreement, contractors under a security control 

agreement are not denied access to classified information such as Top Secret, special access, 

and other sensitive information 

Board resolution • Resolution by contractor’s board of directors certifying that foreign shareholder(s) shall not have 

access to classified information or be permitted to hold positions that enable them to influence 

the performance of classified contracts 

Limited facility clearance • Requires industrial security agreement with the foreign government of the country from which 

foreign ownership is derived 

• Access to classified information is restricted to performance on a specific contract as defined by 

the government customer, but there is no restriction on foreign management control and 

influence 

Source: DSS (data); GAO (analysis and presentation). 

For contractors operating under voting trust, proxy, special security, or 

security control agreements, industrial security representatives are 

supposed to conduct annual FOCI meetings with contractor staff who are 

responsible for ensuring compliance with these protective measures. In 

preparation for these annual meetings, contractors are required to 

produce and submit to DSS annual FOCI compliance reports that can 

describe specific acts of noncompliance with protective measures, 

changes in organizational structure or changes in security procedures at 

the contractor, and other issues that have occurred over the course of a 

year. Industrial security representatives should then review the reports to 

determine how contractors are fulfilling their obligations under the 
Page 8 GAO-05-681 Industrial Security 

protective measures. In addition, DSS generally conducts security reviews 

annually for facilities that store classified information or every 18 months 

for facilities that do not have classified information on site. However, for 

contractors operating under voting trust, proxy, special security, or 

security control agreements, industrial security representatives are 

required to conduct a security review every 12 months whether the 

contractor has classified information on site or not. These reviews are 

designed to determine security vulnerabilities and contractor compliance 

with National Industrial Security Program requirements and to evaluate 

the overall quality of the facility’s security program, including compliance 

with protective measures to mitigate FOCI. 

DSS will not grant a new facility security clearance to a contractor until all 

relevant FOCI have been mitigated. In addition, DSS shall suspend an 

existing clearance if FOCI at a contractor facility has not been mitigated. A 

contractor with a suspended facility clearance can continue to work on an 

existing classified contract unless the government contracting office 

denies access to the existing contract. In addition, the contractor cannot 

be awarded a new classified contract until the clearance is restored. 

DSS does not systematically ask for, collect, or analyze foreign business 

transactions in a manner that helps it properly oversee contractors 

entrusted with U.S. classified information, nor does DSS aggregate and 

analyze information to determine the overall effectiveness of its oversight 

of FOCI contractors. Notably, DSS does not know if contractors are 

reporting foreign business transactions as they occur and lacks knowledge 

about how much time a contractor facility with unmitigated FOCI has 

access to classified information.5

 Figure 2 shows a general description of 

gaps in DSS knowledge about the FOCI process. Furthermore, DSS field 

staff said they lack research tools and sufficient training regarding the 

subject of foreign transactions and have indicated challenges with regard 

to staff turnover. 

 5

 “Unmitigated FOCI” refers to situations in which contractors with facility security 

clearances are under FOCI and protective measures are needed but not yet implemented. 

DSS’s Approach to 

Overseeing FOCI 

Contractors Is 

Insufficient 
Page 9 GAO-05-681 Industrial Security 

Figure 2: Knowledge Gaps in DSS’s FOCI Process 

Note: Per the National Industrial Security Program Operating Manual, DSS shall suspend the facility 

clearance of a contractor with unmitigated FOCI. 

DSS does not systematically ask for information that would allow it to 

know if contractors are reporting certain foreign business transactions 

when they occur, which begins the process for reducing FOCI-related 

security risks. DSS industrial security representatives are responsible for 

advising contractors that timely notification of foreign business 

transactions is essential. The National Industrial Security Program 

Operating Manual requires contractors with security clearances to report 

any material changes of foreign business transactions previously notified 

to DSS but does not specify a time frame for doing so. DSS is dependent 

on contractors to self-report transactions by filling out the Certificate 

Pertaining to Foreign Interests form, but this form does not ask 

contractors to provide specific dates for when foreign transactions took 

place. In addition, DSS does not compile or analyze how much time passes 

before DSS becomes aware of foreign business transactions. DSS field 

staff told us that some contractors report foreign business transactions as 

they occur, while others report transactions months later, if at all. During 

our review, we found a few instances in which contractors were not 

reporting foreign business transactions when they occurred. One 

contractor did not report FOCI until 21 months after awarding a 

subcontract to a foreign entity. Another contractor hired a foreign national 

as its corporate president but did not report this transaction to DSS, and 

DSS did not know about the FOCI change until 9 months later, when the 

industrial security representative came across the information on the 

DSS Cannot Ensure Timely 

Reporting from FOCI 

Contractors or Determine 

the Extent to Which FOCI 

Is Unmitigated 

FOCI business

transaction

occurs

Potential period of unmitigated FOCI

DSS’s FOCI process

DSS does not analyze

whether contractors

self-report transactions

DSS does not know how much time passes

before contractor implements the protective measure

Contractor self-reports

FOCI transaction

to DSS

If protective measure is required, 

DSS and contractor decide which type

of measure to implement

Contractor implements

protective measure

Source: DSS (data); GAO (analysis and presentation).
Page 10 GAO-05-681 Industrial Security 

contractor’s Web site. In another example, DSS was not aware that a 

foreign national sat on a contractor’s board of directors for 15 months 

until we discovered it in the process of conducting our audit work. 

Without timely notification from contractors, DSS cannot track when 

specific foreign business transactions took place and therefore is not in a 

position to take immediate action so that FOCI is mitigated, if necessary. 

In addition, DSS does not determine the time elapsed from reporting of 

foreign business transactions by contractors with facility clearances to the 

implementation of protective measures or when suspensions of facility 

clearances occur. Without protective measures in place, unmitigated FOCI 

at a cleared contractor increases the risk that foreign interests can gain 

unauthorized access to U.S. classified information. During our review, we 

found two cases in which contractors appeared to have operated with 

unmitigated FOCI before protective measures were implemented. For 

example, officials at one contractor stated they reported to DSS that their 

company had been acquired by a foreign entity. However, the contractor 

continued operating with unmitigated FOCI for at least 6 months. In the 

other example, a foreign-purchased contractor continued operating for 2 

months with unmitigated FOCI. Contractor officials in both examples told 

us that their facility clearances were not suspended. According to the 

National Industrial Security Program Operating Manual, DSS shall 

suspend the facility clearance of a contractor with unmitigated FOCI. DSS 

relies on field office staff to make this determination. Because information 

on suspended contractors with unmitigated FOCI is maintained in the 

field, DSS headquarters does not determine at an aggregate level the 

extent to which and under what conditions it suspends contractors’ 

facility clearances due to unmitigated FOCI. 

DSS does not centrally collect and analyze information to determine the 

magnitude of contractors under FOCI and assess the effectiveness of its 

oversight of those contractors. For example, DSS does not know how 

many contractors under FOCI are operating under all types of protective 

measures and, therefore, does not know the extent of potential FOCIrelated security risks. Although DSS tracks information on contractors 

operating under some types of protective measures, it does not centrally 

compile data on contractors operating under all types of protective 

measures.6

 Specifically, DSS headquarters maintains a central repository 

 6

 There may be multiple contractor locations under a particular protective measure, but the 

legal parent signs the measure that covers its divisions. 

DSS Does Not Maintain 

Aggregate Information to 

Assess Overall 

Effectiveness of the FOCI 

Process 
Page 11 GAO-05-681 Industrial Security 

of data on contractors under voting trust agreements, proxy agreements, 

and special security agreements—protective measures intended to 

mitigate majority foreign ownership. However, information on contractors 

under three other protective measures—security control agreements, 

limited facility clearances, and board resolutions—are maintained in paper 

files in the field offices.7 DSS does not aggregate data on contractors for all 

six types of protective measures and does not track and analyze overall 

numbers. In addition, DSS does not conduct overall analysis of foreign 

business transactions reported by contractors on their Certificate 

Pertaining to Foreign Interests forms or maintain aggregate information 

for contractors’ responses. Consequently, DSS does not know the universe 

of FOCI contractors operating under protective measures, and DSS cannot 

determine the extent to which contractors under FOCI are increasing or if 

particular types of foreign business transactions are becoming more 

prevalent. This information would help DSS target areas for improved 

oversight. According to DSS officials, centralizing and tracking 

information on contractors under all types of measures would require 

more resources because information is dispersed in paper files in DSS 

field offices around the country. 

DSS does not systematically compile and analyze trends from its oversight 

functions to identify overall compliance trends or concerns with 

implementation of protective measures by contractors. DSS industrial 

security representatives are responsible for ensuring compliance of FOCI 

contractors under certain protective measures through annual FOCI 

meetings where they discuss contractors’ compliance reports.8

 Industrial 

security representatives notify headquarters of the results of the meetings 

and place compliance reports and their own assessments in paper files 

located in field offices. However, DSS headquarters does not use annual 

compliance reports to assess trends to evaluate overall effectiveness of the 

FOCI process. 

 7

 The field office files are the official record for documenting information on contractor 

facilities’ security programs and industrial security representatives’ interactions with those 

contractors, including those under FOCI. The paper folders contain such information as the 

identity of the facility owner, contractor-submitted Certificate Pertaining to Foreign 

Interests forms, and the results of the contractor’s last two security reviews. In addition to 

the file folders, DSS has a facilities database that contains information on facilities’ security 

programs. DSS officials acknowledged that the database is prone to data integrity and data 

loss problems that need to be addressed. 

8

 The protective measures include voting trust, proxy, special security, and security control 

agreements. 
Page 12 GAO-05-681 Industrial Security 

Finally, the use of protective measures at FOCI contractor facilities was 

designed in part to counter attempts to gather classified information 

through unauthorized means. DSS does not assess trends from its own 

counterintelligence data or information gathered by other intelligence 

agencies to evaluate whether protective measures are effectively 

mitigating FOCI risk across the board. For example, a 2004 DSS 

counterintelligence report states that foreign information targeting 

through e-mail and Internet communication and collection methods is on 

the rise. However, according to DSS officials, not all protective measures 

at FOCI contractors include provisions to monitor e-mail or other Internet 

traffic. By assessing counterintelligence trends to analyze the effectiveness 

of protective measures in countering foreign information collection 

attempts, DSS could identify weaknesses in its protective measures and 

adjust them accordingly. 

DSS’s field staff face numerous challenges: complexities in verifying FOCI 

cases, limited tools to research FOCI transactions, insufficient FOCI 

training, staff turnover, and inconsistencies in implementing guidance on 

FOCI cases. 

For industrial security representatives, verifying if a contractor is under 

FOCI is complex. Industrial security representatives cited various 

difficulties verifying FOCI information. To verify if a contractor is under 

FOCI, industrial security representatives are required to understand the 

corporate structure of the legal entity completing the Certificate 

Pertaining to Foreign Interests form and evaluate the types of foreign 

control or influence that exist for each entity within a corporate family. 

DSS officials informed us that tracing strategic company relationships, 

country of ownership, and foreign affiliations and suppliers, or reviewing 

corporate documentation—such as loan agreements, financial reports, or 

Securities and Exchange Commission filings—is complicated. For 

example, representatives are required to verify information on stock 

ownership by determining the distribution of the stock among the 

stockholders and the influence or control the stockholders may have 

within the corporation. This entails identifying the type of stock and the 

number of shares owned by the foreign person(s) to determine their 

authority and management prerogatives, which DSS guidance indicates 

may be difficult to ascertain in certain cases. According to DSS field 

officials, verifying information is especially difficult when industrial 

security representatives have limited exposure to FOCI cases. In some 

field offices we visited, industrial security representatives had few or no 

DSS Industrial Security 

Representatives Face 

Challenges in Carrying Out 

FOCI Responsibilities 
Page 13 GAO-05-681 Industrial Security 

FOCI cases and, therefore, had limited knowledge about how to verify 

foreign business transactions. 

Some industrial security representatives in one field office told us they do 

not always have the tools needed to verify if contractors are under FOCI. 

As part of their review process, industrial security representatives are 

responsible for verifying what a contractor reports on its Certificate 

Pertaining to Foreign Interests form and determining the extent of foreign 

interests in the company. Industrial security representatives conduct 

independent research using the Internet or return to the contractor for 

more information to evaluate the FOCI relationships and hold discussions 

with management officials, such as the chief financial officer, treasurer, 

and legal counsel. DSS headquarters officials told us additional 

information sources, such as the Dun and Bradstreet database of millions 

of private and public companies are currently not available in the field. 

However, some industrial security representatives stated that such 

additional resource tools would be beneficial for verifying complex FOCI 

information. 

In addition, industrial security representatives stated they lacked the 

training and knowledge needed to better verify and oversee contractors 

under FOCI. For example, DSS does not require its representatives to have 

financial or legal training. While some FOCI training is provided, 

representatives largely depend on DSS guidance and on-the-job training to 

oversee a FOCI contractor. In so doing, representatives work with more 

experienced staff or seek guidance, when needed, from DSS headquarters. 

In a 1999 review, DSS recognized that recurring training was necessary to 

ensure industrial security representatives remain current on complex 

FOCI issues and other aspects of the FOCI process. DSS headquarters 

officials said that they have held regionwide meetings where they 

discussed FOCI case scenarios and responded to questions about the FOCI 

process. However, we found that the training needs on complex FOCI 

issues are still a concern to representatives. In fact, many said they needed 

more training to help with their responsibility of verifying FOCI 

information, including how to review corporate documents, strategic 

company relationships, and financial reports. DSS field officials said the 

DSS training institute currently offers a brief training unit on FOCI 
Page 14 GAO-05-681 Industrial Security 

covering basic information.9 DSS established a working group of DSS field 

and headquarters staff to look at ways to improve the training program, 

including more specific FOCI training. The group submitted 

recommendations in March 2005 to field managers for their review.10 DSS 

is also planning to work with its training institute to develop additional 

FOCI courses to better meet the needs of the industrial security 

representatives. 

According to field staff, industrial security representatives operate in an 

environment of staff turnover, which can affect their in-depth knowledge 

of FOCI contractors. Officials from one-third of the field offices we 

reviewed noted staff retention problems. DSS officials at two of these field 

offices said that in particular they have problems retaining more 

experienced industrial security representatives. Field officials said that 

when an industrial security representative retires or leaves, the staff 

member’s entire workload is divided among the remaining representatives, 

who already have a substantial workload. In addition, DSS guidance 

advises field office officials to rotate contractor facilities among industrial 

security representative every 3 years, if possible, as a means of retaining 

DSS independence from the contractors. DSS officials told us the rotation 

can actually occur more frequently because of staff turnover. DSS 

headquarters officials said they are formulating a working group to help 

improve staff retention in the field. 

Compounding these challenges are inconsistencies among field offices in 

how industrial security representatives said they understood and 

implemented DSS guidance for reviewing contractors under FOCI. For 

example, per DSS guidance, security reviews and FOCI meetings should 

be performed every 12 months for contractors operating under special 

security agreements, security control agreements, voting trust agreements, 

and proxy agreements. However, we found that some industrial security 

representatives were inconsistent in implementing the guidance. For 

example, one representative said a contractor under a special security 

 9

 DSS officials told us that new industrial security representatives participate in a 12-week 

mentoring program prior to attending a 4-week course at the DSS training institute. The 

mentoring program consists of separate units that contain activities that must be 

completed before an industrial security representative is approved to attend the 4-week 

course. In either the program or the course, only one unit or section of training pertains to 

general FOCI information. 

10 According to DSS, the overall goal for this working group was to connect professional 

development to the individual employee, the budget, and DSS’s mission. 
Page 15 GAO-05-681 Industrial Security 

agreement was subject to a security review every 18 months because the 

contractor did not store classified information on-site.11 In addition, two 

industrial security representatives told us they did not conduct annual 

FOCI meetings for contractors that were operating under a proxy 

agreement and security control agreement, respectively. We also found 

that industrial security representatives varied in their understanding or 

application of DSS guidance for when they should suspend a contractor’s 

facility clearance when FOCI is unmitigated. The guidance indicates that 

when a contractor with a facility clearance is determined to be under 

FOCI that requires mitigation by DSS headquarters, the facility security 

clearance shall be suspended until a protective measure is implemented. 

However, we were told by officials in some field offices that they rarely 

suspend clearances when a contractor has unmitigated FOCI as long as 

the contractor is demonstrating good faith in an effort to provide 

documentation to DSS to identify the extent of FOCI and submits a FOCI 

mitigation plan to DSS. Officials in other field offices said they would 

suspend a contractor’s facility clearance once they learned the contractor 

had unmitigated FOCI. 

The protection of classified information has become increasingly 

important in light of the internationalization of multibillion-dollar 

cooperative development programs, such as a new-generation fighter 

aircraft, and a growing number of complex cross-border industrial 

arrangements. Although such developments offer various economic and 

technological benefits, there can be national security risks when foreign 

companies control or influence U.S. contractors with access to classified 

information. Given the growing number of DOD contractors with 

connections to foreign countries, it is critical for DSS to ensure that 

classified information is protected from unauthorized foreign access. In 

carrying out its responsibilities, DSS is dependent on self-reported 

information from the contractors about their foreign activities, creating 

vulnerabilities outside of DSS’s control. Within this environment, unless 

DSS improves the collection and analysis of key information and provides 

its field staff with the training and tools they need to perform FOCI 

responsibilities, DSS will continue to operate without knowing how 

 11 DSS reported in a 1999 review of its FOCI process that the oversight by industrial 

security representatives was not always consistent, and at that time DSS recommended 

that FOCI companies should be assessed annually rather than on an 18-month schedule. 

Conclusions 
Page 16 GAO-05-681 Industrial Security 

effective its oversight is at reducing the risk of foreign interests gaining 

unauthorized access to U.S. classified information. 

To improve knowledge of the timing of foreign business transactions and 

reduce the risk of unauthorized foreign access to classified information, 

we recommend that the Secretary of Defense direct the director of DSS to 

take the following three actions: 

• clarify when contractors need to report foreign business transactions 

to DSS, 

• determine how contractors should report and communicate dates of 

specific foreign business transactions to DSS, and 

• collect and analyze when foreign business transactions occurred at 

contractor facilities and when protective measures were implemented 

to mitigate FOCI. 

To assess overall effectiveness of DSS oversight of contractors under 

FOCI, we recommend that the Secretary of Defense direct the director of 

DSS to take the following three actions: 

• collect and analyze data on contractors operating under all protective 

measures as well as changes in types and prevalence of foreign 

business transactions reported by contractors; 

• collect, aggregate, and analyze the results of annual FOCI meetings, 

contractors’ compliance reports, and data from the counterintelligence 

community; and 

• develop a plan to systematically review and evaluate the effectiveness 

of the FOCI process. 

To better support industrial security representatives in overseeing 

contractors under FOCI, we recommend the Secretary of Defense direct 

the director of DSS to formulate a human capital strategy and plan that 

would encompass the following two actions: 

• evaluate the needs of representatives in carrying out their FOCI 

responsibilities and 

Recommendations for 

Executive Action 
Page 17 GAO-05-681 Industrial Security 

• determine and implement changes needed to job requirements, 

guidance, and training to meet FOCI responsibilities and explore 

options for improving resource tools and knowledge-sharing efforts 

among representatives. 

In commenting on a draft of our report, DOD disagreed with our 

conclusions that improvements are needed to ensure sufficient oversight 

of contractors under FOCI, and it also disagreed with our 

recommendations to improve oversight. Overall, DOD’s comments 

indicate that it believes that the actions DSS takes when it learns of FOCI 

at contractors is sufficient. However, DOD has not provided evidence 

necessary to support its assertions. In fact, we found two cases in which 

contractors appeared to have operated with unmitigated FOCI before 

protective measures were put into place. Unmitigated FOCI at contractors 

increases the risk that foreign interests can gain unauthorized access to 

U.S. classified information. Further, DOD states that we did not establish a 

link between collecting and analyzing FOCI data and the effectiveness of 

DSS’s oversight or the protection of classified information. We found that 

DSS lacks fundamental FOCI information—including information on the 

universe of FOCI contractors and trends in overall contractor compliance 

with protective measures—that is needed to determine the effectiveness 

of the FOCI process and the sufficiency of oversight. Ultimately, without 

making this determination, DSS cannot adequately ensure it is taking 

necessary steps to reduce the risk of foreign interests gaining 

unauthorized access to classified information. Unless our 

recommendations are implemented, we are concerned that DSS will 

continue to operate on blind faith that its FOCI process is effective and its 

oversight is sufficient. 

DOD did not concur with seven of our recommendations and only partially 

concurred with the eighth. Regarding our first three recommendations, 

which aim to improve DSS’s knowledge of the timing of foreign business 

transactions and reduce the risk of unauthorized foreign access to 

classified information, DOD argues that having such information will not 

help protect classified information. However, as we noted in our report, 

without this information, DSS is not in a position to know when FOCI 

transactions occur so that timely protective measures can be implemented 

to mitigate FOCI as needed—the purpose of the FOCI process. 

Regarding our next three recommendations, which aim to enable DSS to 

assess the overall effectiveness of its oversight of contractors under FOCI, 

DOD argues that it does not need to collect and analyze information on the 

Agency Comments 

and Our Evaluation 
Page 18 GAO-05-681 Industrial Security 

universe of contractors under FOCI and trends in foreign business 

transactions, or aggregate compliance and counterintelligence 

information. However, without this information, DSS limits its ability to 

identify vulnerabilities in the FOCI process and to target areas for 

improving oversight of contractors, including potential changes to 

protective measures. DOD also argues that it has three mechanisms to 

systematically evaluate DSS’s processes: DSS’s Inspector General, a 

management review process for industrial security field office oversight, 

and a standards and quality program. However, DOD has not provided 

evidence in its comments that these mechanisms are focused on 

systematically reviewing and evaluating the effectiveness of the FOCI 

process. 

Regarding our last two recommendations—to formulate a human capital 

strategy and plan that would better support industrial security 

representatives in overseeing FOCI contractors—DOD does not believe 

that its industrial security representatives need additional support. DOD 

supports this belief with two points. First, DOD states that because less 

than 3 percent of the approximately 12,000 cleared companies overseen by 

DSS have any FOCI mitigation, most DSS industrial security 

representatives do not oversee such contractors. Yet it is unclear how 

DOD arrived at these figures because DSS does not collect and analyze 

information on all contactors operating under protective measures. 

Regardless of the number of these contractors, industrial security 

representatives must have adequate support—including training and 

guidance—to verify if contractors are under FOCI and to ensure 

contractors comply with any protective measures put in place. In the 

course of our review, we found that industrial security representatives are 

not sufficiently equipped to fulfill their FOCI responsibilities. Second, 

DOD noted that DSS is under new leadership and is exploring operational 

improvements as well as implementing a new industrial security 

information management system. While it is too early to assess the effect 

of these proposals, it is also unclear how these efforts will bring about any 

needed changes to industrial security representatives’ job requirements, 

guidance, tools, and training. 

As we concluded in our report, DSS’s dependence on self-reported 

information from contractors about their foreign activities creates 

vulnerabilities outside of DSS’s control. Given these vulnerabilities, it is 

imperative that DSS improve the collection and analysis of key 

information on the FOCI process and provide its industrial security 

representatives with the training and tools they need to perform their 

FOCI responsibilities. If DSS continues to operate without knowing how 
Page 19 GAO-05-681 Industrial Security 

effective its oversight is and does not support the representatives in 

carrying out their FOCI responsibilities, then the value of DSS’s 

management and the FOCI process should be open for further 

examination. Therefore, we did not modify our recommendations. 

DOD also provided technical comments, which we addressed. DOD’s letter 

is reprinted in appendix II, along with our evaluation of its comments. 

We are sending copies of this report to interested congressional 

committees; the Secretary of Defense; the Director, Defense Security 

Service; the Assistant to the President for National Security Affairs; and 

the Director, Office of Management and Budget. We will make copies 

available to others upon request. In addition, this report will be available 

at no charge on the GAO Web site at http://www.gao.gov. 

If you have any questions about this report, please contact me at (202) 

512-4841. Major contributors to this report are Anne-Marie Lasowski, 

Maria Durant, Ian A. Ferguson, Suzanne Sterling, Kenneth E. Patton, Lily J. 

Chin, and Karen Sloan. 

Ann Calvaresi-Barr 

Director 

Acquisition and Sourcing Management 
Appendix I: Scope and Methodology 

Page 20 GAO-05-681 Industrial Security 

To assess the Defense Security Service’s (DSS) process for determining 

and overseeing contractors under foreign ownership, control, or influence 

(FOCI), we reviewed Department of Defense (DOD) regulations and 

guidance on FOCI protective measures included in the National 

Industrial Security Program Operating Manual, and the Industrial 

Security Operating Manual, as well as DSS policies, procedures, and 

guidance for verifying contractors under FOCI and for overseeing them. 

We discussed with DSS officials at headquarters and field locations how 

they use DSS guidance to oversee FOCI contractors. We also discussed 

DSS roles and responsibilities for headquarters and field staff and 

challenges in overseeing contractors that report FOCI and the use of FOCI 

information to evaluate effectiveness of the process. We reviewed DSS 

training materials to learn about the type of training DSS offers industrial 

security representatives in meeting their FOCI responsibilities. We also 

examined FOCI studies conducted by DSS to determine the results of 

earlier DSS reviews of the FOCI process. 

We visited nine field offices that varied in how many FOCI contractors 

they monitored and in their geographic location. Through discussions with 

DSS officials at headquarters in Alexandria, Virginia, and from nine field 

offices, we identified FOCI contractors operating under various protective 

measures and examined DSS actions to verify FOCI and oversee the 

implementation of protective measures at contractor facilities. We 

collected information on a nonrepresentative sample of 27 contractor 

facility case files reviewed by DSS for FOCI. In addition, we visited 8 of the 

27 contractor facilities and spoke with security officials, corporate 

officers, and board members to obtain additional clarification on the types 

of protective measures and the FOCI process. 

We spoke with DSS headquarters and field staff regarding actions taken to 

implement protective measures and reviewed supporting documentation 

maintained by DSS and contractor facilities. During our visits to nine field 

offices, we discussed the contents of selected contractor facility file 

folders to understand how DSS oversees contractors’ implementation of 

protective measures, determines unmitigated FOCI, and assesses the 

effectiveness of the FOCI process. Because we did not take a statistical 

sample of case files, the results of our analyses cannot be generalized. 

However, we confirmed that the data used to select the files that we 

reviewed were consistent with the information in the facility files that we 

reviewed. 

Appendix I: Scope and Methodology 
Appendix II: Comments from the Department 

of Defense 

Page 21 GAO-05-681 Industrial Security 

Appendix II: Comments from the Department 

of Defense 

See comment 3. 

See comment 2. 

See comment 1. 

GAO’s comments 

supplementing those in 

the report text appear at 

the end of this appendix. 
Appendix II: Comments from the Department 

of Defense 

Page 22 GAO-05-681 Industrial Security 
Appendix II: Comments from the Department 

of Defense 

Page 23 GAO-05-681 Industrial Security 

See comment 5. 

See comment 4. 
Appendix II: Comments from the Department 

of Defense 

Page 24 GAO-05-681 Industrial Security 

See comment 8. 

See comment 7. 

See comment 6. 
Appendix II: Comments from the Department 

of Defense 

Page 25 GAO-05-681 Industrial Security 

See comment 11. 

See comment 4. 

See comment 10. 

See comment 9. 
Appendix II: Comments from the Department 

of Defense 

Page 26 GAO-05-681 Industrial Security 

See comment 11. 

See comment 13. 

See comment 12. 
Appendix II: Comments from the Department 

of Defense 

Page 27 GAO-05-681 Industrial Security 

See comment 14. 
Appendix II: Comments from the Department 

of Defense 

Page 28 GAO-05-681 Industrial Security 

The following are GAO’s comments on the Department of Defense’s letter 

dated June 29, 2005. 

1. It is unclear how DOD came to the conclusion that our report lacks an 

understanding of the national policy governing contractors’ access to 

classified information, given that our description of the policy and 

process in the background of our report is taken directly from 

documentation provided by DSS. Further, DOD did not provide in its 

technical comments any suggested amendments to remove perceived 

misunderstandings from our report. 

2. Cleared U.S. citizens need not break the law for foreign interests to 

gain unauthorized access to classified information or adversely affect 

performance of classified contracts. Classified information can be at 

risk when foreign nationals at a cleared FOCI contractor facility are 

not identified and timely protective measures are not established to 

mitigate their influence. 

3. DOD’s position that there is little in our report that would enable DSS 

to improve the FOCI process or justify the cost of implementing our 

recommendations underscores the department’s failure to grasp the 

gravity of our findings. DOD has neither systematically evaluated the 

effectiveness of its FOCI process nor identified opportunities to 

strengthen its oversight for contractors under FOCI. Our 

recommendations specifically target correcting these weaknesses. 

Further, raising concerns about cost without evaluating the 

effectiveness of its FOCI process is shortsighted. 

4. According to the National Industrial Security Program Operating 

Manual, contractors are required to report material changes to FOCI 

information previously reported and every 5 years, even if no change 

occurs. We added a footnote to further clarify the definition of foreign 

business transactions used in our report. 

5. DOD’s response concerning self-reporting underscores the 

department’s complacency regarding its responsibility to take actions 

needed to prevent foreign interests from gaining unauthorized access 

to U.S. classified information. While we recognize that DSS is 

dependent on self-reporting and that some vulnerabilities are outside 

of DSS’s control, there are numerous steps DOD could take to mitigate 

these vulnerabilities. For example, if DSS implemented our 

recommendation to clarify when reporting should occur and require 

reporting dates when specific foreign business transactions took place, 

GAO’s Comments 
Appendix II: Comments from the Department 

of Defense 

Page 29 GAO-05-681 Industrial Security 

then DSS could monitor whether contractors are reporting foreign 

transactions on time and put mitigation measures in place, as 

appropriate. 

6. While DOD maintains that contractors are to report material changes 

concerning FOCI information as they occur, we found that the 

National Industrial Security Program Operating Manual does not 

state this. As we reported, DSS field staff told us that while some 

contractors report transactions as they occur, some do not report 

transactions until months later, if at all. Specifying a time frame for 

contractors could result in more timely reporting of these transactions. 

7. As we reported, the FOCI process begins when a contractor reports 

FOCI information. Having information on when foreign transactions 

occur would enable DSS to take timely action to impose safeguards or 

restrictions authorized by the National Industrial Security Program 

Operating Manual. 

8. Unmitigated FOCI at a cleared contractor increases the risk that 

foreign interests can gain unauthorized access to U.S. classified 

information. During our review, we found two cases in which 

contractors appeared to have operated with unmitigated FOCI before 

protective measures were put in place. Therefore, it is important to 

know the length of time between when a foreign transaction occurs 

and when protective measures are put in place to mitigate FOCI. 

9. According to the National Industrial Security Program Operating 

Manual, a contractor under FOCI with an existing facility clearance 

shall have its clearance suspended or revoked unless protective 

measures are established to remove the possibility of unauthorized 

access to classified information or adversely affect performance on 

classified contracts. DOD’s characterization of DSS having the option 

to suspend the clearance of contractors with unmitigated FOCI seems 

to differ from what is stated in the manual. 

10. It is unclear why DOD does not see the value in collecting information 

on contractors operating under all six protective measures, when DSS 

already centrally collects information on contractors operating under 

three measures. DSS cannot assess the overall effectiveness of its 

FOCI process unless it has a complete and accurate account of 

contractors operating under all types of protective measures. 

11. It is unclear how DOD determined that less than 3 percent of its 

cleared contractors are operating under all six protective measures 

because DSS does not centrally collect and analyze this information 
Appendix II: Comments from the Department 

of Defense 

Page 30 GAO-05-681 Industrial Security 

for all six measures. In addition, the most recent information provided 

to us by DSS indicated that there are about 11,000 contractor facilities 

participating in the National Industrial Security Program, rather than 

the 12,000 cited in DOD’s comments. Further, DOD did not provide 

technical comments to revise the number of contractor facilities stated 

in our report. 

12. Industrial security representatives may use the results of annual 

meetings, compliance reports, and counterintelligence data to assess 

an individual contractor’s security posture. However, as stated in our 

report, DSS does not systematically compile and analyze trends from 

these oversight activities. Aggregating overall compliance and 

counterintelligence trends is valuable because it would allow DSS to 

identify actual or potential weaknesses, evaluate effectiveness, and 

take actions as needed to improve its FOCI process. 

13. Citing how long the program has been in existence misses the point, 

and DOD does not provide evidence that the needs of representatives 

are well known. As we reported, industrial security representatives 

face numerous challenges in carrying out their FOCI responsibilities, 

which formulates the basis of our recommendation to evaluate the 

needs of the representatives. Assessing their needs is particularly 

important given the increasingly complex environment—characterized 

by international cooperative defense programs and a growing number 

of cross-border defense industrial relationships—in which industrial 

security representatives work. 

14. As stated in our report, industrial security representatives told us they 

lacked the training and knowledge they needed to verify complex 

FOCI cases and oversee contractors under FOCI. 

(120348) 
The Government Accountability Office, the audit, evaluation and 

investigative arm of Congress, exists to support Congress in meeting its 

constitutional responsibilities and to help improve the performance and 

accountability of the federal government for the American people. GAO 

examines the use of public funds; evaluates federal programs and policies; 

and provides analyses, recommendations, and other assistance to help 

Congress make informed oversight, policy, and funding decisions. GAO’s 

commitment to good government is reflected in its core values of 

accountability, integrity, and reliability. 

The fastest and easiest way to obtain copies of GAO documents at no cost 

is through GAO’s Web site (www.gao.gov). Each weekday, GAO posts 

newly released reports, testimony, and correspondence on its Web site. To 

have GAO e-mail you a list of newly posted products every afternoon, go 

to www.gao.gov and select “Subscribe to Updates.” 

The first copy of each printed report is free. Additional copies are $2 each. 

A check or money order should be made out to the Superintendent of 

Documents. GAO also accepts VISA and Mastercard. Orders for 100 or 

more copies mailed to a single address are discounted 25 percent. Orders 

should be sent to: 

U.S. Government Accountability Office 

441 G Street NW, Room LM 

Washington, D.C. 20548 

To order by Phone: Voice: (202) 512-6000 

TDD: (202) 512-2537 

Fax: (202) 512-6061 

Contact: 

Web site: www.gao.gov/fraudnet/fraudnet.htm 

E-mail: fraudnet@gao.gov

Automated answering system: (800) 424-5454 or (202) 512-7470 

Gloria Jarmon, Managing Director, JarmonG@gao.gov (202) 512-4400 

U.S. Government Accountability Office, 441 G Street NW, Room 7125 

Washington, D.C. 20548 

Paul Anderson, Managing Director, AndersonP1@gao.gov (202) 512-4800 

U.S. Government Accountability Office, 441 G Street NW, Room 7149 

Washington, D.C. 20548 

GAO’s Mission 

Obtaining Copies of 

GAO Reports and 

Testimony 

Order by Mail or Phone 

To Report Fraud, 

Waste, and Abuse in 

Federal Programs 

Congressional 

Relations 

Public Affairs 

PRINTED ON RECYCLED PAPER