JULY 14, 2009 

AUDIT REPORT

REPORT NO. IG-09-018 (ASSIGNMENT NO. A-08-005-00) 

OFFICE OF AUDITS

IMPROVEMENTS NEEDED IN NASA’S OVERSIGHT AND 

MONITORING OF SMALL BUSINESS CONTRACTOR 

TRANSFERS OF EXPORT-CONTROLLED TECHNOLOGIES 

OFFICE OF INSPECTOR GENERAL

National Aeronautics and 

Space Administration 

 

 
REPORT NO. IG-09-018 

Final report released by: 

 /signed/ Debra Pettitt for 

Evelyn R. Klemstine 

Assistant Inspector General for Auditing 

Acronyms 

COTR Contracting Officer Technical Representative 

DDTC Directorate of Defense Trade Controls 

DoD Department of Defense 

DTSA Defense Technology Security Administration 

EAR Export Administration Regulations 

FAR Federal Acquisition Regulation 

GAGAS Generally Accepted Government Auditing Standards 

HQ Headquarters 

ITAR International Traffic in Arms Regulations 

NAICS North American Industry Classification System 

NFS NASA Federal Acquisition Regulation (FAR) Supplement 

NPR NASA Procedural Requirements 

SBIR Small Business Innovation Research 

STTR Small Business Technology Transfer 
JULY 14, 2009 

REPORT NO. IG-09-018 

OVERVIEW

IMPROVEMENTS NEEDED IN NASA’S OVERSIGHT AND 

MONITORING OF SMALL BUSINESS CONTRACTOR TRANSFERS 

OF EXPORT-CONTROLLED TECHNOLOGIES 

The Issue 

The United States has enacted strict controls over the export of certain defense-related 

goods and technical information and the technology associated with the design, 

manufacture, and use of those goods and technologies. Controls are needed for reasons 

of national security and foreign policy. Unauthorized disclosure of export-controlled 

technology could give a foreign country or adversary a military or economic advantage 

over the United States, and unauthorized disclosure of export-controlled technology to a 

foreign national is deemed an export to the foreign national’s home country by export 

regulations. 

Contractor compliance with U.S. export-control regulations is particularly relevant to 

NASA because a large percentage of the work to support NASA’s mission is done by 

contract to companies and universities. NASA FY 2008 procurement information shows 

that approximately 83 percent of NASA’s obligated appropriations was for contractorprovided products and services. While NASA is not directly responsible for a 

contractor’s compliance with export regulations, lack of compliance could put NASA’s 

mission in jeopardy because consequences of export-control violations could seriously 

impede a contractor’s ability to provide supplies or services to NASA. 

The Office of the Inspector General is required to report annually to Congress the extent 

to which NASA is carrying out its activities in compliance with Federal export-control 

laws. We systematically selected 13 active NASA contracts that were performed by 

10 contractors and had a high probability of involving critical technologies and technical 

information. Of the 10 contractors, 4 were large corporations, 2 were universities, and 

4 were small companies with either Small Business Innovation Research (SBIR) or Small 

Business Technology Transfer (STTR) contracts. Our objective was to evaluate whether 

NASA had maintained effective oversight and monitoring of contractor transfers of 

critical technologies and technical information to foreign nationals and countries of 

concern. 
OVERVIEW

ii REPORT No. IG-09-018 

Results 

NASA could improve its oversight and monitoring of small business contractor transfers 

of critical technology and technical information to foreign nationals and countries of 

concern. Although the large corporations and universities we reviewed generally had 

adequate procedures to protect export-controlled technology from illegal transfer, the 

procedures at the small business contractors did not adequately protect export-controlled 

technology. Specifically, we found a lack of export-control awareness among small 

business contractors and NASA and small business procurement personnel. As a result, 

small business contractors are at increased risk of improperly releasing critical 

technology and technical information. Increased awareness of export regulations and 

improved oversight and monitoring of small business contractors’ compliance should 

enhance and reduce the attendant risks to NASA’s mission and national security. 

The large corporations’ and universities’ export-control programs included robust 

physical security such as double perimeter fence lines, barbed wire, and security officers; 

personnel security procedures such as swiping badges, badge verification, and logging in 

and escorting visitors; and information technology (IT), or logical,1 security procedures 

to prevent unauthorized personnel from gaining access to critical and sensitive 

technologies. Each of the large corporations and universities had also established 

procedures to restrict foreign visitors’ access to sensitive or critical technologies. 

We identified procedural weaknesses at each of the four small business contractors’ 

locations. Only one of the small business contractors employed foreign nationals; the 

other three had established a policy to only employ U.S. citizens, which significantly 

reduced their risk of disclosing export-controlled technology to foreign nationals and 

countries of concern. However, among the four contractors we found a lack of physical 

security procedures such as procedures for determining the nationality of visitors and for 

recording the presence of foreign visitors, lack of a physical security plan, and lack of 

restrictions to areas that contained potentially export-controlled technology. We 

determined that one small business contractor inappropriately provided at least two 

foreign national employees with access to export-controlled technology. We are 

coordinating with our Office of Investigations on this matter. 

NASA procurement personnel also were not always aware of export-control regulations. 

Although NASA is not directly responsible for a contractor’s compliance with export 

regulations, it is responsible for administration of the export-control program at NASA 

Centers and facilities. We determined that NASA procurement officials do not monitor 

exports as part of their contract administration duties and NASA’s export-control 

outreach efforts did not include small business procurement personnel. 

 

1

 IT, or “logical,” security procedures” refers to the collection of policies, procedures and electronic access 

controls designed to restrict access to computer software and data files. 
OVERVIEW

REPORT NO. IG-09-018 iii 

Recently, the Department of Defense (DoD) developed a draft final rule to address DoD 

contractor compliance with export controls and to prevent unauthorized disclosure of 

export controlled information and technology. The draft final rule was developed in 

coordination with the Departments of State, Commerce, and Justice to remind contractors 

of their responsibility to comply with export control laws and regulations. The rule 

emphasizes the importance of registering with the State Department’s Directorate of 

Defense Trade Controls, which is charged with controlling the export and temporary 

import of defense articles and defense services, and directs contractors to contact either 

the Department of State or Department of Commerce regarding any questions related to 

either the International Traffic in Arms Regulations or Export Administration Regulation. 

NASA could improve both NASA contracting officers’ and small business contractor 

awareness of export regulations by monitoring export-control rule developments in other 

Federal agencies and amending the NASA FAR Supplement to align with those agency’s 

best practices. 

Management Action 

We recommended that the Assistant Administrator for Procurement coordinate with the 

Department of State to monitor any modifications made to the DoD draft final rule 

intended to increase contractors’ awareness of their export-control responsibilities, and 

amend the NASA FAR Supplement accordingly. We also recommended that the NASA 

Assistant Administrator for Procurement improve NASA’s oversight and monitoring of 

contractors compliance with export-control regulations. Finally, we recommended that 

the Assistant Administrator for External Relations expand current export-control 

outreach efforts to NASA SBIR/STTR Program Management Office personnel, 

procurement personnel involved in the administration of SBIR/STTR contracts, and small 

business contractors. 

In response to a draft of this report, issued May 27, 2009, the Assistant Administrator for 

Procurement concurred with the recommendation to monitor modifications to the DoD 

draft final rule intended to increase contractor awareness of their export-control 

responsibilities and, if required, amend the NASA FAR Supplement. We consider 

management’s proposed actions to be responsive. The recommendation is resolved and 

will be closed upon completion and verification of management’s corrective action. 

The Assistant Administrator for Procurement partially concurred with our 

recommendation to require contracting officers to monitor and oversee contractors’ 

compliance with export-control regulations. He agreed that contractors should be aware 

of and comply with export control regulations but noted that updating the solicitation 

requirements for small business contractors would be a more appropriate way to increase 

contractor awareness than requiring the delivery of an export control compliance plan or 

the reporting of major safety and security breaches and illegal technology transfers. 

Although management’s proposed actions are responsive to the intent of the 

recommendation, the effectiveness of those actions can only be measured by the extent to 
OVERVIEW

iv REPORT No. IG-09-018 

which SBIR/STTR contractors comply with applicable export control regulations. The 

recommendation is resolved; however, it will remain open until we evaluate the 

effectiveness of the efforts to increase contractor awareness. 

The Assistant Administrator for External Relations concurred with the recommendation 

to expand current export-control outreach efforts to NASA personnel involved in the 

administration of SBIR/STTR contracts and to small business contractors. We consider 

management’s proposed actions to be responsive. The recommendation is resolved and 

will be closed upon completion and verification of management’s corrective action. (See 

Appendix B for the full text of management’s comments.) 
JULY 14, 2009 

REPORT NO. IG-09-018 

CONTENTS

INTRODUCTION

Background __________________________________________ 1 

Objectives ___________________________________________ 2 

RESULTS

SBIR/STTR Procedures Do Not Adequately Protect ExportControlled Technology _______________________________ 3 

APPENDIX A 

Scope and Methodology _______________________________ 15 

Review of Internal Controls _____________________________ 16 

Prior Coverage _______________________________________ 17 

APPENDIX B 

Management Comments _______________________________ 18 

APPENDIX C 

Report Distribution ___________________________________ 21 

JULY 14, 2009 

REPORT NO. IG-09-018 1 

INTRODUCTION

Background 

For reasons related to national security, foreign policy, antiterrorism, and 

nonproliferation of weapons of mass destruction, the United States controls the export of 

certain goods and technologies. The Department of State controls the export of Defense 

articles2 and services, and the Department of Commerce controls the export of goods and 

technologies that have both commercial and military use (dual-use commodities). The 

Department of State, Office of Defense Trade Controls, implements the authority of the 

Arms Export-Control Act through the International Traffic in Arms Regulations (ITAR). 

The Department of Commerce, Bureau of Industry and Security, controls the export of 

dual-use commodities under the authority of the Export Administration Act and through 

implementing Export Administration Regulations (EAR). 

According to EAR, “export” means an actual shipment or transmission of items subject 

to EAR out of the United States or release of technology or software subject to EAR to a 

foreign national in the United States, and “technology” means specific information 

necessary for the “development,” “production,” or “use” of a product. ITAR defines 

“export” as sending or taking a defense article out of the United States, in any manner, or 

the disclosure or transfer of technical data to a foreign person, whether in the United 

States or abroad. The EAR at 15 CFR § 734.2(b)(2)(ii), notes that the release of exportcontrolled technology to a foreign national is deemed an export to the foreign national’s 

home country, commonly referred to as a “deemed export.” The deemed export rule 

applies to any foreign person except a foreign national who is granted (1) permanent 

U.S. residence, as demonstrated by the issuance of a permanent resident visa (i.e., Green 

Card); or (2) U.S. citizenship; or (3) status as a “protected person.” Deemed exports may 

involve the transfer of sensitive technology to foreign employees or visitors at 

U.S. companies, universities, or Federal research facilities. 

NASA’s programs and projects in many cases involve research and technology that must 

be protected because unauthorized disclosure could provide a foreign country or 

adversary a military or economic advantage. According to the Defense Security 

Service,3

 aeronautics, laser and optics, and space systems are 3 of the top 10 U.S. 

technologies most frequently targeted for theft by foreign entities. The two most 

common methods of collection by foreign entities are request for information and directly 

acquiring controlled technology. Other methods of collecting controlled information 

include covertly obtaining the information through foreign nationals working in or 

visiting U.S. companies, universities, research facilities, and other sources. 

 

2

 A defense article is any item or technical data designated in the United States Munitions List. 

3

 Defense Security Service, “Targeting U.S. Technologies: A Trend Analysis of Reporting from Defense 

Industry” (January 26, 2009). 
INTRODUCTION

2 REPORT NO. IG-09-018 

NASA is responsible for administration of the export-control program at its Centers and 

facilities. NASA’s export-control procedures are documented in NASA Procedural 

Requirements (NPR) 2190.1, “NASA Export-control Program - Revalidated w/changes,” 

February 1, 2007. This NPR outlines the Agency’s policies and procedures for ensuring 

compliance with Federal export-control laws established in EAR and ITAR. NPR 2190.1 

also documents the roles and responsibilities of NASA employees, support contractors, 

universities, and partners engaged in activities that involve the transfer of commodities, 

software, or technologies to foreign individuals or organizations. 

In general, it is the responsibility of the U.S. entity to apply for and obtain an export 

license from the Department of State or the Department of Commerce. While NASA is 

not directly responsible for a contractor’s compliance with export regulations, NASA’s 

ability to accomplish its mission could be jeopardized as a result of the consequences of 

noncompliance. For example, if a contractor releases export-controlled technology to a 

foreign country or individual without a license, if caught the company could be subject to 

civil and criminal penalties, which could delay or prevent delivery of goods or 

technologies NASA needs. Penalties for violations of ITAR can be severe and include 

imprisonment, monetary fines, and debarment from participating in the import or export 

of defense articles or services. NASA’s reliance on contractors’ compliance with exportcontrol regulations is particularly relevant because contracts represent the majority of 

NASA’s budget. In FY 2008, NASA’s procurements totaled $16,785.4 million, which 

represented 82.7 percent of NASA’s obligated appropriations. Of the $16,785.4 million 

obligated, 73.7 percent went to business firms, 10.5 percent went to the Jet Propulsion 

Laboratory, and 6.5 percent went to educational institutions. The remaining 9.3 percent 

was divided among other Government agencies, nonprofit organizations, and companies 

outside the United States. 

Objectives 

Our audit objective was to evaluate whether NASA had maintained effective oversight 

and monitoring of contractor transfers of critical technologies and technical information 

to foreign nationals and countries of concern. We reviewed internal controls as they 

related to the audit objective. See Appendix A for details of the audit’s scope and 

methodology, our review of internal controls, and a list of prior coverage. 
RESULTS

REPORT NO. IG-09-018 3 

SBIR/STTR PROCEDURES DO 

NOT ADEQUATELY PROTECT 

EXPORT-CONTROLLED 

TECHNOLOGY

We reviewed 13 contracts performed by 10 contractors: 4 large corporations, 

2 universities, and 4 small companies with either Small Business Innovation 

Research (SBIR) or Small Business Technology Transfer (STTR) contracts. The 

large corporations and universities we visited generally had adequate procedures in 

place to protect export-controlled technology. However, at each of the 4 small 

business contractors we reviewed, we identified weaknesses in their procedures to 

protect export-controlled technology. This occurred because the small business 

contractors and NASA procurement officials were not always aware of exportcontrol regulations or that the contract performance involved export-controlled 

technology. In addition, NASA procurement officials were not overseeing or 

monitoring small business contractors for export-control compliance. As a result, 

small business contractors are at increased risk of improperly releasing critical 

technology and technical information to foreign nationals and countries of concern. 

Export-Control Guidance 

The primary legislative authority for controlling the export of defense articles and 

services is the Arms Export-Control Act of 1976 (22 USC section 2751), implemented by 

the Department of State, Office of Defense Trade Controls through ITAR. The primary 

legislative authority for controlling the export of dual-use items is the Export 

Administration Act of 1979, as amended (50 USC appendix 2401), implemented by the 

Department of Commerce, Bureau of Industry and Security, under authority provided in 

EAR. 

The State Department’s Directorate of Defense Trade Controls (DDTC) is charged with 

controlling the export and temporary import of defense articles and defense services 

covered by the United States Munitions List, in accordance with ITAR. ITAR requires 

any person in the U.S. who engages in either the manufacture or export of defense 

articles to register with DDTC, even someone who engages in manufacturing or 

exporting defense articles on only one occasion. Registering with DDTC provides the 

Government necessary information on who is involved in certain manufacturing and 

exporting activities. 

DDTC’s compliance guidelines recommend that companies involved in manufacturing 

export-controlled goods implement a comprehensive operational export-control 

compliance program. According to DDTC, an export-control program should articulate 
RESULTS

4 REPORT NO. IG-09-018 

the company’s policy on and commitment to compliance with U.S. defense trade laws 

and regulations, outline the procedures for dealing with licensing and compliance 

matters, and provide employees with the knowledge to understand when and how ITAR 

affects the company’s controlled items and technical data. In addition, DDTC 

recommends that the plan contain a methodology to identify and account for all ITARcontrolled items, including technical data. The purpose of developing an export-control 

plan and providing export-control training is to reduce the risk of employees 

inadvertently releasing critical and sensitive technologies to foreign nationals. 

NASA Procedural Requirements (NPR) 2190.1, “NASA Export-Control Program - 

Revalidated w/changes,” February 1, 2007, outlines the roles and responsibilities for 

implementing NASA’s export-control program. Center Export Administrators are 

responsible for implementing and managing the export-control programs at NASA 

Centers and for (1) assisting procurement officials with export-control issues; 

(2) coordinating with Center Export Counsel, Transportation Officers, and 

Program/Project Managers on export-control matters affecting Center programs and 

activities; and (3) providing assistance in developing Technology Transfer Control Plans 

that define which NASA technologies or technical data require protection and what level 

of foreign access is permissible. NPR 2190.1 also details export-control requirements, 

instructions, and responsibilities for all NASA employees and contractors as well as 

universities and partners engaged in NASA activities that involve the transfer of 

commodities, software, or technologies to foreign individuals or organizations. 

The SBIR and STTR Programs provide an opportunity for small, high technology 

companies to participate in Government sponsored research and development efforts in 

key technology areas. NASA’s SBIR/STTR Program Management Office annually 

issues solicitations based on the technical needs of the Mission Directorates. Companies 

submit proposals to the SBIR/STTR Program Management Office detailing how they can 

provide NASA with the desired key technologies described in the solicitations. The 

SBIR/STTR Program Management Office provides the proposals to appropriate technical 

experts at various NASA Centers to evaluate the probability that the proposed technology 

will meet NASA’s needs. Based on the technical experts’ evaluations, the SBIR/STTR 

Program Management Office decides which companies it will award with a contract and 

which NASA Center is best suited to manage the contract based on the subject matter. 

The “requiring activity” in this process is the Mission Directorate that identified the 

technological need. 

Contracts Selected for Review 

We queried the Federal Procurement Data System-Next Generation4

 for active NASA 

contracts that were not performed at a NASA Center. To identify contracts that 

 

4

 Federal Procurement Data System-Next Generation is the Federal Government’s central repository for 

capturing information on all Federal procurement actions. 
RESULTS

REPORT NO. IG-09-018 5 

potentially contained export-controlled technology relevant to NASA, we based our 

selection on the North American Industry Classification System (NAICS) codes5

identifying space vehicles, guided missiles, and related equipment and then 

systematically selected contracts with a total award value greater than $500,000. 

Selected contracts contained one of the following NAICS codes: 

• 336414 Guided Missile and Space Vehicle Manufacturing 

• 336415 Guided Missile and Space Vehicle Propulsion Unit and Propulsion Unit 

Parts Manufacturing 

• 336419 Other Guided Missile and Space Vehicle Parts and Auxiliary Equipment 

Manufacturing 

• 927110 Space Research and Technology 

We also focused only on contracts administered by Goddard, Marshall, and Kennedy 

based on both the number of contracts awarded and the award value of contracts. We 

reviewed ITAR, EAR, and NASA guidance and consulted with NASA export-control 

personnel and determined that 13 contracts contained technologies potentially subject to 

export controls. 

The services and products involved in performance of the contracts included developing 

instruments for use on spacecraft, launching space vehicles, developing optical sensors to 

detect leaks during launch operations, adapting special polymers for use on spacecraft 

and military body armor, developing launch range surveillance equipment, and 

developing cameras that track explosion debris. The 13 contracts were performed by 

10 contractors: 4 were large corporations, 2 were universities, and 4 were small business 

contractors. 

Procedures for Protecting Export-Controlled Technology at 

Contractor Locations 

While the large corporations and universities we reviewed had adequate procedures in 

place to protect export-controlled technology, the procedures in place at each of the small 

business contractors did not adequately protect export-controlled technology from 

unauthorized disclosure. 

At each location, we reviewed procedures for controlling physical access and logical 

access and procedures for determining the nationality of employees and visitors. Where 

available, we also reviewed the contractor’s export-control program and obtained and 

 

5 The Office of Management and Budget (OMB) developed the North American Industry Classification 

System (NAICS) as the standard for use by Federal statistical agencies in classifying business 

establishments for the collection, analysis, and publication of statistical data. (Source: 

http://www.naics.com/faq.htm#q1.) 
RESULTS

6 REPORT NO. IG-09-018 

reviewed the contractor’s applicable technical assistance agreements, DDTC registration 

number, and export licenses and exceptions. 

Procedures at Large Corporations and Universities. The four large corporations and 

two universities had physical and logical access controls in place to prevent unauthorized 

personnel from gaining access to critical and sensitive technologies. Although the 

security procedures varied by location, examples of security included access control 

badges, cipher locks, visitor sign-in logs and escorts, double perimeter fence lines, barbed 

wire, security officers, and logical access controls. 

Two of the large corporations employed only U.S. citizens and had procedures in place to 

identify and escort all foreign visitors on the premises. The remaining two large 

corporations and the two universities employed foreign personnel and had procedures to 

identify non-U.S. citizens and restrict their access to only those physical areas and 

computer systems that did not contain export-controlled technology. One of the large 

corporations established an “ITAR-free zone” within one building that was controlled by 

employee access-control badges. The non-U.S. citizens only had access to that area of 

the building and their computer access was restricted to a network that did not contain 

export-controlled technology. The remaining large corporation had developed an 

extensive technology transfer control plan, with assistance from the Defense Technology 

Security Administration (DTSA), that restricted the physical and logical access their 

non-U.S. employees had within the facility. 

Both of the universities we visited had established separate areas that contained the 

export-controlled technology related to the contracts we reviewed. Only U.S. citizens 

were allowed unrestricted access to these areas. Foreign visitors were required to be 

escorted by a U.S. citizen and were not allowed access to export-controlled technology. 

All the technical data related to the contracts we reviewed resided on computers that were 

not part of the university networks, and logical access was limited to only those people 

authorized. Each of the large corporations and universities had also obtained applicable 

export licenses and were aware of the requirement to register with the DDTC, indicating 

a thorough knowledge of export-control regulations. 

Procedures at Small Business Contractors. At each small business contractor we 

reviewed, we identified procedural weaknesses that increased their risk of violating 

export-control regulations. Three of the four contractors had not developed an exportcontrol plan and did not provide export-control training to their employees. Two of the 

four contractors did not have physical security procedures adequate to protect exportcontrolled technology. As a result of the procedural weaknesses, we determined that at 

least one small business contractor inappropriately provided foreign national employees 

access to potentially export-controlled technology. 

Export-control plan. Small business contractors 1, 2, and 3 had not developed 

an export-control plan and did not provide export-control training to their employees. As 

a result, the export-control efforts at each of the three contractors focused on the physical 
RESULTS

REPORT NO. IG-09-018 7 

shipment of goods and not the transfer of technical data to foreign nationals. Although 

contractors 2 and 3 were at a reduced risk of releasing technical data to foreign nationals 

because they employed only U.S. citizens, none of the three contractors appeared to 

understand the concept of deemed exports sufficiently to protect technical data from 

being released to foreign nationals. For example, when we explained deemed exports to 

the Chief Operating Officer for one of the contractors, the officer stated that their 

company was at risk of inadvertently releasing export-controlled technology because they 

do not review the technical information they presented at industry trade shows to market 

the company’s technical capabilities for any export-controlled data that might be 

included. A manager responsible for export-control compliance at another contractor 

stated that he did not know what a deemed export was and believed that an export only 

occurred when a good or product was shipped outside the United States. 

Physical security procedures. Contractor 1, who employed foreign nationals, 

had not developed a physical security plan, did not have procedures to identify the 

nationality of foreign visitors, and did not restrict access to any visitors. As a result, 

contractor 1 did not restrict the access their employees had to potentially exportcontrolled technology. The technical data associated with the contract we reviewed 

involved optical sensors to detect leaks during launch operations. We requested technical 

assistance from DTSA to verify that technical data associated with the contract was 

export controlled. (DTSA frequently performs similar reviews for the Department of 

State.) DTSA concluded that the technical data was, at a minimum, export controlled by 

the Department of Commerce and possibly by the Department of State, depending on the 

use of the end product. Because of the procedural weaknesses, the contractor 

inappropriately provided at least two foreign national employees with access to exportcontrolled technology. One employee was a citizen of the People’s Republic of China 

and the other was a citizen of India. We are coordinating with our Office of 

Investigations on this matter. 

Contractor 4, who employed only U.S. citizens, did not have a physical security plan and 

the only physical security procedure we identified was that they locked the front doors at 

the end of the business day. Technical data associated with the contract we reviewed 

involved the development of polymers that could potentially be used by the military for 

body armor, which is technology controlled under ITAR. However, the contractor did 

not have badges to identify employees and had no access restrictions to locations that 

contained the potentially export-controlled technology. Although the contractor 

employed only U.S. citizens, the contractor did not have procedures for determining the 

nationality of visitors and did not have procedures for documenting the presence of 

foreign visitors. 

Awareness of Export-Control Regulations 

NASA procurement personnel and small business contractors were not always aware that 

export-controlled items were involved in contract performance or aware of export-control 
RESULTS

8 REPORT NO. IG-09-018 

regulations intended to protect critical and sensitive technologies from being improperly 

released to foreign nationals and countries of concern. Specifically, we determined that 

NASA procurement personnel and small business contractors did not properly identify 

potentially export-controlled information in the contracts we reviewed. Additionally, the 

small business contractors were also not aware of the ITAR requirement to register with 

DDTC when engaged in the manufacture or export of export-controlled technology. 

NASA provides outreach to educate some NASA personnel and contractors about exportcontrol issues relevant to NASA; however, NASA’s export-control outreach efforts did 

not include small business procurement personnel. 

Identification of Export-Control Technology. Each of the small business contracts we 

reviewed included the NASA Federal Acquisition Regulation (FAR) Supplement (NFS) 

export-control clause 1852.225-70, Export Licenses, which informs contractors of their 

responsibility to comply with export laws and regulations. However, the export-control 

clause does not necessarily indicate that the contract involves export-controlled 

technology because NFS section 1825.1103-70 requires the export-control clause in all 

NASA solicitations and contracts, except in contracts with foreign entities. Further, the 

export-control clause does not specifically inform contactors of the requirement to 

register with DDTC when engaged in the manufacture or export of export-controlled 

items, nor does it require contractors to consult with the Department of State regarding 

any questions relating to the ITAR or with the Department of Commerce regarding any 

questions related to the EAR. 

For the small business contracts we selected for review, contract performance involved 

technology that was potentially export-controlled. We asked both the contracting officer 

technical representatives (COTRs) and the small business contractors whether their 

contract involved potentially export-controlled technology: of the five COTRs that 

managed the contracts for the four contractors we reviewed, two said no, one said yes, 

and two were not sure; of the four small business contractors, three said no and one was 

not sure. For one contract, the COTR said the contract involved export-controlled 

technology, while the small business contractor said that it did not. We found no 

evidence that the contracting officer had informed the small business contractor that the 

contract involved export-controlled technology. 

DDTC Registration. None of the four small business contractors we reviewed had 

registered with DDTC, despite that each of the small business contracts involved 

potentially export-controlled products or technical data. The products involved in 

performance of the small business contracts included optical sensors to detect leaks 

during launch operations, special polymers for use on spacecraft and military body 

armor, launch range surveillance equipment, and cameras that track explosion debris. 

These products, and their related technical data, are categorized as export-controlled 

products by either ITAR or EAR. Although three of the four small business contractors 

did not know their contract involved export-controlled technology, in addition to not 

registering, none of the small business contractors were aware of the registration 

requirement and did not know how to register with DDTC. 
RESULTS

REPORT NO. IG-09-018 9 

In March 2009, Department of Defense (DoD) developed a draft final rule to amend the 

Defense Federal Acquisition Regulation Supplement and establish an export-control 

clause to ensure DoD contractors complied with export-control laws and regulations and 

to prevent unauthorized disclosure of export-controlled information and technology. 

DoD coordinated with the Departments of State, Commerce, and Justice in developing 

the clause. Responsible personnel with the Department of State informed us that the 

export-control clause was developed to emphasize the importance of the requirement for 

contractors to register with the DDTC, and to direct contractors to contact either the 

Departments of State or Commerce regarding any questions related to either the ITAR or 

EAR. 

It is in NASA’s best interests to monitor export-control rule developments in other 

Federal agencies and look for opportunities to improve both NASA contracting officers’ 

and small business contractors’ awareness of export regulations. DoD is coordinating 

with the Departments of State, Commerce, and Justice to ensure that the Defense Federal 

Acquisition Regulation Supplement rule is in compliance with other Federal regulations. 

Adopting provisions in the DoD draft final rule could help NASA improve contactors’ 

awareness of export-control regulations. NASA should be aware of the latest changes to 

assure NASA policy is aligned with the best practices. 

Office of External Relations Outreach Efforts. NASA’s Office of External Relations 

has developed multiple outreach efforts to educate NASA personnel and increase 

awareness of export-control issues relevant to NASA. The Office of External Relations 

sends to selected personnel throughout each Mission Directorate and Center, via e-mail, 

a weekly activity report that includes export-control issues and activities. The Export 

Control and Interagency Liaison Division, within the Office of External Relations, 

annually holds an export-control conference that is attended by NASA personnel from 

every Center, and they frequently send e-mails addressing specific export-control issues 

to personnel within the NASA Export Control Program at Headquarters and each NASA 

Center. According to the Export Control and Interagency Liaison Division, in 2008, 

personnel with the NASA Export Control Program at Headquarters and the Centers 

provided training to 3,200 NASA employees and on-site contractors. Additionally, 

NASA Export Control Program personnel frequently accept invitations at non-NASA 

events and conferences that are attended by U.S. companies. We acknowledge the 

extensive efforts undertaken by the Office of External Relations to increase the 

awareness of export-control issues. However, most of the outreach efforts are directed to 

Center export-control personnel and do not target the SBIR/STTR Program Management 

Office staff or procurement personnel, or small business contractors. 

In a 2006 Government Accountability Office (GAO) report, “Agencies Should Assess 

Vulnerabilities and Improve Guidance for Protecting Export-Controlled Information at 

Companies” (GAO-07-69, December 2006), it was stated that training and outreach by 

Government agencies was particularly important because smaller businesses working in 

advanced technology areas were not as aware of the extent of their responsibilities to 

protect export-controlled information. GAO also found that, while the Departments of 
RESULTS

10 REPORT NO. IG-09-018 

State and Commerce provide export-control training to companies, the Departments do 

not strategically target companies where the greatest risk of violations of the export 

regulations may exist. GAO recommended that the Department of State improve its 

oversight of export-controlled information at companies by strategically assessing 

potential vulnerabilities in the company’s protection of export-controlled information. 

The results of our review indicate that SBIR/STTR Program Management Office 

contractors are at a higher risk than larger corporations of improperly releasing exportcontrolled technology. Given the lack of export-control awareness we identified with 

SBIR/STTR procurement personnel and small business contractors, we believe that 

expanding outreach efforts to NASA personnel involved in the SBIR/STTR procurement 

process and small business contractors would increase export-control awareness among 

NASA personnel and reduce the risk of small business contractors violating exportcontrol regulations. 

NASA Oversight and Monitoring of Small Business Contractor 

Compliance with Export-Control Guidance 

Through interviews with contracting officers, COTRs, and the Program Managers for the 

small business contracts, we determined that procurement officials do not monitor 

technology transfers, i.e. exports, as part of their contract administration duties. Even 

when the COTR said yes, the contract contained export-controlled technology, the COTR 

informed us that his oversight did not include monitoring the export-control compliance 

of the small business contractor. 

Each of the small business contracts we reviewed contained NFS clause 1852.223-75, 

Major Breach of Safety or Security, which states that “a major breach of security may 

constitute a breach of contract that entitles the Government to exercise any of its rights 

and remedies applicable to material parts of this contract, including termination for 

default. A major breach of security may occur on or off Government installation, but 

must be related directly to the work on the contract.” The clause defines a major breach 

of security as an act or omission by the contractor that results in compromise or illegal 

technology transfer of export-controlled technology. The clause also states that in the 

event of a major breach of safety or security, the contractor shall report the breach to the 

contracting officer. This clause is required in all solicitations and contracts with 

estimated values of $500,000 or more, unless waived at a level above the contracting 

officer position with the concurrence of the project manager and the installation 

official(s) responsible for matters of security, export-control, safety, and occupational 

health.

Contracting officers should monitor safety and security, to include illegal technology 

transfers, as part of their contract administration duties. However, none of the small 

business contracts we reviewed included safety or security reporting as a deliverable, 

even though the contracts involved potentially export-controlled technology. Based on 
RESULTS

REPORT NO. IG-09-018 11 

the contractor’s reporting requirements of NFS clause 1852.223-75, contracting officers 

could increase oversight and monitoring of contractor compliance with export regulations 

by requiring contractors to report major safety and security breaches, to include actual or 

suspected illegal technology transfers, as a deliverable. By requiring reporting on actual 

or suspected illegal technology transfers, NASA will have documented assurance from 

contractors that they are protecting sensitive NASA technology from inappropriate 

transfers to foreign nationals or countries of concern. 

Conclusion 

Space systems and aeronautics technologies are frequently targeted for theft by foreign 

entities. The unauthorized disclosure of certain information may enable a foreign 

country or adversary to gain an advantage militarily. NASA’s programs and projects in 

many cases involve research and technology that must be protected, and that work is 

frequently performed for NASA by contractors. Small business contractors usually enter 

into contracts with NASA to develop technology and products to satisfy a need that has 

been identified by NASA. Although NASA is not responsible for contractors’ export 

compliance in the execution of contracted work, NASA has a vested interest in ensuring 

the companies they contract with comply with export-control laws. Otherwise, NASA’s 

ability to accomplish their mission could be put in jeopardy if fines or debarment 

seriously impedes a contractor’s ability to provide supplies or services to NASA. We 

believe that NASA can reduce the small business contractors’ risk of violating exportcontrol procedures by informing the contractors when a contract contains technology that 

is potentially export-controlled, and monitoring contractors’ compliance with exportcontrol laws and procedures. 

Recommendations, Management’s Response, and Evaluation of 

Management’s Response 

1. The Assistant Administrator for Procurement should: 

a. coordinate with the Department of State to monitor the modifications to the 

DoD draft final rule intended to increase contractor awareness of their exportcontrol responsibilities, and, if required, amend the NASA FAR Supplement 

(NFS) to align with other Federal agencies best practices. 

Management’s Response. The Assistant Administrator for Procurement 

concurred and stated that the Office of Procurement will monitor the 

modifications to the DoD draft final rule and, if required and appropriate, amend 

the NASA FAR Supplement to align with other Federal agencies best practices. 
RESULTS

12 REPORT NO. IG-09-018 

Evaluation of Management’s Response. Management’s proposed action is 

responsive. The recommendation is resolved and will be closed upon completion 

and verification of management’s corrective action. 

b. require contracting officers to monitor and oversee contractors’ compliance 

with export-control regulations by 

i. requiring contractors with contracts that contain export-controlled 

technology to provide the contracting officers with an export compliance 

plan at the time of contract award, and 

ii. adding the reporting of major safety and security, to include actual or 

suspected, illegal technology transfers as a contract deliverable on 

contracts that involve export-control technology. 

Management’s Response. The Assistant Administrator for Procurement partially 

concurred and agreed that SBIR and STTR contractors should be aware of and 

comply with export control regulations. However, the Assistant Administrator for 

Procurement believed that updating the solicitation requirements for small 

business contractors would be a more appropriate way of increasing SBIR and 

STTR contractor awareness when compared to requiring the delivery of an export 

control compliance plan. The Assistant Administrator for Procurement stated that 

the SBIR and STTR solicitations will direct contractors to contact the Department 

of State for questions related to the International Traffic in Arms Regulations and 

to contact the Department of Commerce for questions related to the Export 

Administration Regulations. The solicitations will also remind contractors of the 

requirement to report major breaches of safety and security, to include illegal 

technology transfers, in accordance with NFS clause 1852.223-75 Major Breach of 

Safety and Security; direct contractors to comply with specific export control 

requirements such as registering with the Directorate of Defense Trade Controls, 

obtaining applicable technical assistance agreements, and requesting commodity 

jurisdictions from the Department of State. 

Evaluation of Management’s Response. Management’s proposed actions are 

responsive to the intent of the recommendation; however, the recommendation 

will remain open until we evaluate the effectiveness of the efforts to increase 

contractor awareness. At that time, we will determine whether the actions taken 

by the Office of Procurement have resulted in an increase in the number of SBIR 

and STTR contractors that are in compliance with export control regulations. 

2. The Assistant Administrator for External Relations should expand current exportcontrol outreach efforts to NASA SBIR/STTR Program Management Office 

personnel, procurement personnel involved in the administration of SBIR/STTR 

contracts, and small business contractors. 
RESULTS

REPORT NO. IG-09-018 13 

Management’s Response. The Assistant Administrator for External Relations 

concurred and stated that the Office of External Relations will provide briefings on 

NASA compliance to the SBIR/STTR contractor community and will work with 

the Office of Procurement and the SBIR/STTR Program management Office to 

schedule export control training. Additionally, the Office of External Relations 

plans to provide the Department of State with a list of NASA small business 

contractors for their outreach efforts. 

Evaluation of Management’s Response. Management’s proposed action is 

responsive. The recommendation is resolved and will be closed upon completion 

and verification of management’s corrective action. 

APPENDIXES

REPORT NO. IG-09-018 15 

APPENDIX A 

Scope and Methodology 

We performed this audit from November 2007 through May 2009 in accordance with 

generally accepted government auditing standards. Those standards require that we plan 

and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable 

basis for our findings and conclusions based on our audit objectives. We believe that the 

evidence obtained provides a reasonable basis for our findings and conclusions based on 

our audit objectives. 

We interviewed NASA procurement officers, contracting officers, COTRs, the NASA 

Export-control Administrator, Center Export-Control Administrators, and Program 

Managers to obtain an understanding of the procedures in place at NASA for controlling 

the access foreign nationals have to export-controlled technology at contractor locations. 

We reviewed relevant NASA criteria, the Federal Acquisition Regulation, the NASA 

Federal Acquisition Regulation Supplement, Export Administration Regulations, and the 

International Traffic in Arms Regulations. We also reviewed export compliance program 

guidelines issued by the Department of State and examined industry best practices. 

We selected contracts that appear to contain critical technologies and technical 

information relevant to NASA based on the North American Industry Classification 

System (NAICS) codes.6

 By querying the Federal Procurement Data System-Next 

Generation, we identified the universe of active contracts performed off-site (i.e., not at a 

NASA Center or facility) and likely to involve export-controlled technology. We 

identified potentially export-controlled technology using the NAICS codes related to 

space vehicles, guides missiles, and related equipment. We systematically selected active 

contracts with a total award value greater than $500,000 that appeared to contain exportcontrolled technology based on the following NAICS codes: 

• 336414 Guided Missile and Space Vehicle Manufacturing 

• 336415 Guided Missile and Space Vehicle Propulsion Unit and Propulsion Unit 

Parts Manufacturing 

• 336419 Other Guided Missile and Space Vehicle Parts and Auxiliary Equipment 

Manufacturing 

• 927110 Space Research and Technology 

 

6 The Office of Management and Budget (OMB) developed the North American Industry Classification 

System (NAICS) as the standard for use by Federal statistical agencies in classifying business 

establishments for the collection, analysis, and publication of statistical data related to the business 

economy of the U.S. A business establishment is assigned one NAICS code, based on its primary 

business activity. 
APPENDIX A 

16 REPORT NO. IG-09-018 

We focused on contracts administered by Goddard, Marshall, and Kennedy based on both 

the number and award value of contracts at those Centers. We also limited the places of 

performance to California, Massachusetts, and Florida. We selected California and 

Massachusetts because these states have largest number of contracts, and we included 

Florida because, based on our query of the Federal Procurement Data System-Next 

Generation, there are a significant number of contracts and several high-dollar awards. 

Using this methodology, we identified 15 contracts that appeared to contain exportcontrolled technology. We obtained and reviewed the 15 contracts to determine whether 

they contained export-controlled technology based on ITAR and NASA guidance. Based 

on our review and consultation with the NASA export-control personnel, we concluded 

that 2 contracts did not contain export-controlled technology. As a result, we eliminated 

these contracts, leaving 13 contracts within the scope of the audit. 

Use of Computer-Processed Data. We used computer-processed data to select the 

contracts but did not use computer-processed data to evaluate the data within those 

contracts. 

Review of Internal Controls. We contacted responsible export-control and contracting 

personnel at each of the contractor locations to obtain an initial understanding of their 

procedures for protecting export-controlled technology. We also visited each of the 

contractor locations for the 13 contracts we reviewed and tested their procedures for 

controlling the access foreign nationals have to export-controlled technology. 

Specifically, we reviewed the contractor’s export-control program, observed and tested 

the procedures for controlling physical access and IT access, and reviewed the 

procedures the contractors had in place to verify the citizenship of all employees. We 

also obtained and reviewed the contractor’s technical assistance agreements, Directorate 

of Defense Trade Controls registration number, and export licenses and exceptions. As 

stated in the report, we identified internal control weaknesses with NASA’s procedures 

for overseeing and monitoring small business contractor transfers of potentially critical 

technology and technical information to foreign nationals and countries of concern need 

improvement. We also referred one small business contract to the OIG Office of 

Investigations to determine whether an export-control violation had occurred. 
APPENDIX A 

REPORT NO. IG-09-018 17 

Prior Coverage 

During the last 5 years, the Government Accountability Office (GAO) and the NASA 

Office of Inspector General (OIG) have issued four reports of particular relevance to the 

subject of this report. Unrestricted reports can be accessed over the Internet at 

http://www.gao.gov (GAO) and http://oig.nasa.gov/audits/reports/FY09 (NASA). 

Government Accountability Office

“Agencies Should Assess Vulnerabilities and Improve Guidance for Protecting ExportControlled Information at Universities” (GAO-07-70, December 2006) 

“Agencies Should Assess Vulnerabilities and Improve Guidance for Protecting ExportControlled Information at Companies” (GAO-07-69, December 2006) 

National Aeronautics and Space Administration

“NASA Can Improve Its Mitigation of Risks Associated with International Agreements 

With Japan for Science Projects” (IG-06-020, September 2006)

“Final Memorandum on NASA’s Policies for Protecting Technology Exported to Foreign 

Entities” (IG-06-006, March 2006) 
APPENDIX B 

18 REPORT NO. IG-09-018 

MANAGEMENT COMMENTS
APPENDIX B 

REPORT NO. IG-09-018 19 
APPENDIX B 

20 REPORT NO. IG-09-018 
APPENDIX C 

REPORT NO. IG-09-018 21 

REPORT DISTRIBUTION

National Aeronautics and Space Administration 

Administrator 

Deputy Administrator 

Chief of Staff 

Assistant Administrator for Procurement 

Assistant Administrator for External Relations 

Non-NASA Organizations and Individuals 

Office of Management and Budget 

Deputy Associate Director, Energy and Science Division 

Branch Chief, Science and Space Programs Branch 

Government Accountability Office 

Director, Defense, State, and NASA Financial Management, Office of Financial 

Management and Assurance 

Director, NASA Issues, Office of Acquisition and Sourcing Management 

Congressional Committees and Subcommittees, Chairman and 

Ranking Member 

Senate Committee on Appropriations 

Subcommittee on Commerce, Justice, Science, and Related Agencies 

Senate Committee on Commerce, Science, and Transportation 

Subcommittee on Space, Aeronautics, and Related Sciences 

Senate Committee on Homeland Security and Governmental Affairs 

House Committee on Appropriations 

Subcommittee on Commerce, Justice, Science, and Related Agencies 

House Committee on Oversight and Government Reform 

Subcommittee on Government Management, Organization, and Procurement 

House Committee on Science and Technology 

Subcommittee on Investigations and Oversight 

Subcommittee on Space and Aeronautics 

REPORT NO. IG-09-018 23 

Major Contributors to the Report: 

Raymond Tolomeo, Director, Space Operations (Acting) 

G. Paul Johnson, Project Manager 

Mark J. Benson, Auditor 

Julia K. Eggert, Management and Program Analyst 

James E. Richards, Auditor 

Janet Overton, Editor 
JULY 14, 2009 

REPORT No. IG-09-018 

OFFICE OF AUDITS

OFFICE OF INSPECTOR GENERAL

ADDITIONAL COPIES

Visit http://oig.nasa.gov/audits/reports/FY09 to obtain additional copies of this report, or contact the 

Assistant Inspector General for Auditing at 202-358-1232. 

COMMENTS ON THIS REPORT

In order to help us improve the quality of our products, if you wish to comment on the quality or 

usefulness of this report, please send your comments to Ms. Jacqueline White, Quality Assurance 

Director, at Jacqueline.White@nasa.gov or call 202-358-0203. 

SUGGESTIONS FOR FUTURE AUDITS

To suggest ideas for or to request future audits, contact the Assistant Inspector General for Auditing. 

Ideas and requests can also be mailed to: 

Assistant Inspector General for Auditing 

NASA Headquarters 

Washington, DC 20546-0001 

NASA HOTLINE

To report fraud, waste, abuse, or mismanagement, contact the NASA OIG Hotline at 800-424-9183 or 

800-535-8134 (TDD). You may also write to the NASA Inspector General, P.O. Box 23089, L’Enfant 

Plaza Station, Washington, DC 20026, or use http://oig.nasa.gov/hotline.html#form. The identity of 

each writer and caller can be kept confidential, upon request, to the extent permitted by law.