June 2, 2008 

AUDIT REPORT

REPORT NO. IG-08-017 (ASSIGNMENT NO. A-06-026-00) 

OFFICE OF AUDITS

ACTIONS NEEDED TO ENSURE SCIENTIFIC AND 

TECHNICAL INFORMATION IS ADEQUATELY REVIEWED 

AT GODDARD SPACE FLIGHT CENTER, JOHNSON 

SPACE CENTER, LANGLEY RESEARCH CENTER, AND 

MARSHALL SPACE FLIGHT CENTER

OFFICE OF INSPECTOR GENERAL

National Aeronautics and 

Space Administration 

 
Final report released by: 

 signed 

 

Evelyn R. Klemstine 

Assistant Inspector General for Auditing 

Acronyms 

CASI Center for AeroSpace Information 

CIO Chief Information Officer 

FY Fiscal Year 

GAO Government Accountability Office 

NPD NASA Policy Directive 

NPR NASA Procedural Requirements 

OIG Office of Inspector General 

STI Scientific and Technical Information 

STIPO Scientific and Technical Information Program Office 

REPORT NO. IG-08-017 
June 2, 2008 

REPORT NO. IG-08-017 

OVERVIEW

ACTIONS NEEDED TO ENSURE SCIENTIFIC AND TECHNICAL 

INFORMATION IS ADEQUATELY REVIEWED AT GODDARD 

SPACE FLIGHT CENTER, JOHNSON SPACE CENTER, LANGLEY 

RESEARCH CENTER, AND MARSHALL SPACE FLIGHT CENTER

The Issue 

This audit was initiated in response to a hotline complaint regarding the review, approval, 

and release of scientific and technical information (STI) at Johnson Space Center. The 

complainant alleged that Johnson personnel conducting export control reviews of STI 

were not fully qualified to conduct those reviews and that the reviews often did not occur 

until after the STI had been publicly released. NASA guidance requires that STI, defined 

as the results of basic and applied scientific, technical, and related engineering research 

and development, undergo certain reviews prior to being released outside of NASA or to 

audiences that include foreign nationals. The process includes technical, national 

security, export control, copyright, and “trade secret” (e.g., proprietary data) reviews. The 

review process was designed to preclude the inappropriate dissemination of sensitive 

information while ensuring that NASA complies with a requirement of the National 

Aeronautics and Space Act of 1958 (the Space Act)1

 to “provide for the widest practicable 

and appropriate dissemination” of information resulting from NASA research activities. 

We focused our audit on evaluating the STI review process: specifically, determining 

whether the roles and responsibilities for the review, approval, and release of STI were 

adequately defined and documented in NASA and Center-level guidance and whether 

that guidance was effectively implemented at Goddard Space Flight Center, Johnson 

Space Center, Langley Research Center, and Marshall Space Flight Center. Johnson was 

included in the review because it was the source of the initial complaint, and Goddard, 

Langley, and Marshall were included because those Centers consistently produce 

significant amounts of STI. 

On September 29, 2006, the Office of Inspector General (OIG) received a request from 

14 U.S. Senators to investigate allegations that NASA was suppressing the release of 

scientific research and censoring its scientists. The OIG’s Office of Investigations 

initiated an administrative investigation to address the specific complaints cited in the 

 

1

 The Space Act established NASA as the civilian agency with the responsibility of exercising control over 

aeronautical and space activities sponsored by the United States, except for those activities primarily 

associated with the development of weapons systems, military operations, or the defense of the United 

States. 
OVERVIEW

ii REPORT NO. IG-08-017 

request, which were the alleged suppression of individual scientists to express their views 

through public appearances or through NASA-sponsored press releases. The results of 

that administrative investigation were reported to Congress separately. This audit does 

not address the specific allegations cited in the congressional request of individual 

scientists who claimed their research was suppressed. Instead, because the release of 

scientific research is contingent upon NASA’s STI review process, we expanded the 

scope of our audit to determine whether the STI review process was used as a means to 

suppress the release of scientific research at Goddard, Johnson, Langley, and Marshall. 

Details of the audit’s scope and methodology are in Appendix A. 

Results 

The roles and responsibilities for the review, approval, and release of NASA STI were 

adequately defined and documented in NASA guidance; however, that guidance had not 

been effectively implemented at Goddard, Johnson, Langley, and Marshall. NASA 

Procedural Requirements (NPR) 2200.2B, “Requirements for Documentation, Approval, 

and Dissemination of NASA Scientific and Technical Information,” March 25, 2005, 

states that only STI that has been reviewed for technical accuracy and conformance with 

applicable law, policy, and publication standards may be publicly released. Out of the 

4,702 STI items included in our review at Goddard, Johnson, Langley, and Marshall, we 

identified 413 STI items2

 that had been publicly released during fiscal year (FY) 2005 

and FY 2006 without the required reviews. Of those 413 items, 363 were released prior 

to completion of the review process, 19 were released after rejection by one or more of 

the reviewing authorities,3 and 31 were never submitted for review. 

Although none of the 413 STI items that we identified were of a restricted nature (for 

example, export-controlled or classified), each time STI is released without the required 

review, the risk of releasing restricted or otherwise sensitive information is increased. 

The STI authors at Goddard, Johnson, Langley, and Marshall provided various reasons as 

to why they released STI without the required reviews. The most common reason 

provided was that because the Agency did not notify the authors whether the STI had 

been approved or rejected for release, the authors released STI assuming that the review 

was complete and the approval had been granted. Other authors stated that they were 

unaware of, had forgotten about, or had never been trained on the NPR requirement. 

 

2

 The actual number of STI items released without the required reviews could be much higher than 413. 

Our sampling methodology, which is discussed in detail in Appendix A, did not allow us to project our 

results from Johnson or Langley. In addition, we identified the 31 STI never submitted for review by 

searching NASA conference Web sites for STI that was presented at the conference. Our search for 

unreviewed STI did not include Web sites for conferences that NASA scientists may have attended but 

which were not NASA or NASA-sponsored conferences. We also did not search scientific journals or 

other media for unreviewed STI. Had we done so, we may have identified additional unreviewed STI. 

3

 Although releasing STI after it was “rejected for release” implies that restricted or sensitive STI may have 

been inappropriately released, the 19 STI were generally rejected for minor clerical or technical errors 

that did not impact the overall content or message of the STI. We did not identify any STI that was 

rejected for release because the STI was of a sensitive nature. 
OVERVIEW

REPORT NO. IG-08-017 iii 

Although we could not specifically validate the authors’ level of awareness, none of the 

four Centers had active programs designed to educate new employees or to periodically 

brief existing employees about the STI review requirement. 

The effectiveness of NASA’s STI review process could be improved if STI authors are 

timely notified of the results of the STI review and if NASA took steps to ensure STI 

authors are aware of their responsibilities under NPR 2200.2B. Those actions would 

remove uncertainty from the process and further reduce NASA’s risk of inappropriately 

releasing restricted or sensitive STI. 

The risk of inappropriately releasing restricted or sensitive STI could be further reduced 

if the STI Program Office monitored the effectiveness of the STI review process. NASA 

Policy Directive (NPD) 2200.1, “Management of NASA Scientific and Technical 

Information (STI),” March 28, 2003, requires that the Program Office monitor certain 

elements of the STI Program, such as the quantity of STI received by NASA and the use 

of that STI by NASA and non-NASA personnel. However, the guidance does not require 

that the effectiveness of the STI review process be monitored. Such monitoring would 

enable the Agency to take immediate corrective action if any problem areas are 

identified. 

The ability of the STI Program Office to monitor the effectiveness of the STI review 

process could be improved if the process was automated Agency-wide. Two of the four 

Centers we visited (Johnson and Langley) used automated systems to track STI 

throughout the review process, while the other two Centers (Goddard and Marshall) used 

a paper-based process. The automated systems provided STI managers with more 

comprehensive and timely data when compared with the paper-based systems. 

Implementation of an Agency-wide automated system would improve the STI Program 

Office’s ability to monitor the effectiveness of the STI review process by providing more 

complete and accurate data. 

We found no evidence while conducting our audit that the STI review process was used 

as a means to suppress scientific research at Goddard, Johnson, Langley, and Marshall. 

Because the STI reviewing authorities could use the review process to suppress the 

results of scientific research by rejecting certain STI for public release, we surveyed 

287 NASA STI authors concerning rejected STI. We also conducted further analysis of 

the 19 STI that we identified as having been rejected in FY 2005 and FY 2006 to 

consider whether STI on a specific subject matter or by an individual author had been 

disproportionately rejected. 

We asked the 287 STI authors whether they had ever had an STI item rejected for public 

release and, if so, whether they agreed with the reason for rejection. We received 

responses from 264 authors (a 92 percent response rate), of whom 96 reported that their 

STI had been rejected for release. All 96 authors told us the STI was rejected because of 

errors on the submission form or the need to make minor technical revisions to the STI. 

Although 13 of the authors disagreed with the reason for rejection, those disagreements 
OVERVIEW

iv REPORT NO. IG-08-017 

were based on the STI review process itself (for example, the process took too long, the 

submission form was difficult to understand) or writing style differences between an 

author and the reviewing authorities. None of the authors reported that they believed the 

reviewing authority had rejected the STI in an attempt to suppress the results of their 

research.4

 In addition, our analysis of the 19 STI items rejected in FY 2005 and FY 2006 

at Goddard, Johnson, Langley, and Marshall did not identify any disproportionate 

rejections by subject matter or author. 

Management Action 

To improve the effectiveness of NASA’s STI review process and thereby reduce the risk 

of releasing restricted or sensitive STI, our March 6, 2008, draft of this report contained a 

recommendation that the Center Directors at Goddard, Johnson, Langley, and Marshall 

develop and implement a plan to increase employee awareness of the STI review process. 

We also recommended that the NASA Chief Information Officer (CIO) revise the 

relevant NPR and NPD to require that Center STI Managers timely notify authors when 

STI is approved or rejected for release, require that authors not release STI until they 

receive that notification, and establish an additional performance measure for monitoring 

the effectiveness of the STI review process. 

In a consolidated response to the draft of this report (see Appendix C), management 

concurred with our recommendations and described actions to be taken by the Centers to 

increase awareness of STI review requirements. Goddard planned an outreach initiative 

in April 2008 and Johnson plans to distribute articles on STI review requirements with a 

Web site link to an educational presentation on STI review requirements. Langley plans 

to provide new employees with presentations on STI requirements, and Marshall plans to 

insert quarterly notices in the Center newsletter. 

In response to our recommendations to revise the NPR and NPD, the CIO stated that 

NASA would issue an interim directive by October 7, 2008, that will require timely 

notification of authors, reinforce the requirement to review STI before its release, and 

institute a performance measure for monitoring the effectiveness of the STI review 

process. The interim directive will remain in effect until NPR 2200.2B and NPD 2200.1 

are revised. 

We consider management’s proposed actions to be responsive and no additional 

comments on these recommendations are necessary. The recommendations are resolved 

and will be closed after we verify that all actions have been completed. 

 

4

 A review published by the Government Accountability Office (GAO), “Federal Research: Policies 

Guiding the Dissemination of Scientific Research from Selected Agencies Should Be Clarified and Better 

Communicated” (GAO-07-653, May 2007), reported that NASA dissemination policies could be better 

communicated. GAO estimated that 91 percent of NASA researchers believe that the Agency supports 

dissemination of research results through publications. 
OVERVIEW

REPORT NO. IG-08-017 v 

Although this report concludes that an automated STI tracking system would better 

facilitate data collection for monitoring the effectiveness of the STI review process, we 

did not make a recommendation concerning an automated system in the draft report 

because the STI Program Office had requested “overguidelines” funding5 in FY 2009 for 

the deployment, maintenance, and implementation of an Agency-wide automated 

STI tracking system. However, while we were preparing the final report, the STI 

Program Office informed us that the CIO had denied that funding request. We believe 

that deployment of an automated STI tracking system is critical to ensuring that the STI 

Program Office and the Center STI Managers have the data needed to effectively monitor 

the STI review process and decrease the number of NASA STI items released without 

proper review. Therefore, we have added a recommendation to this report 

(Recommendation 4) that the CIO determine how best to attain the intended benefits of 

an Agency-wide automated STI tracking system and provide an appropriate plan of 

action. We request that the CIO provide comments on the added recommendation by 

July 1, 2008. 

 

5

 According to NASA management, overguidelines funding refers to funds that are above existing program 

financial guidelines. 

June 2, 2008 

REPORT NO. IG-08-017 

CONTENTS

INTRODUCTION

Background __________________________________________ 1 

Objectives ___________________________________________ 3 

RESULTS

STI Released without Required Review _____________________ 4 

APPENDIX A 

Scope and Methodology _______________________________ 15 

Review of Internal Controls _____________________________ 17 

Prior Coverage_______________________________________ 17 

APPENDIX B 

NASA Form 1676 _____________________________________ 18 

APPENDIX C 

Management Comments _______________________________ 22 

APPENDIX D 

Report Distribution ___________________________________ 29 

June 2, 2008 

REPORT NO. IG-08-017 1 

INTRODUCTION

In January 2006, the Office of Inspector General (OIG) received a hotline complaint 

regarding the review, approval, and release of scientific and technical information (STI) 

at Johnson Space Center. The complainant alleged that Johnson personnel responsible 

for conducting export control reviews of STI were not fully qualified to conduct those 

reviews and that the reviews often did not occur until after the STI had been publicly 

released or otherwise disseminated. NASA guidance requires that STI undergo a series 

of reviews before it can be published or otherwise disseminated outside of NASA. One 

of the reviews required is an export control review. 

During an initial inquiry into the complaint, we determined that Johnson personnel were 

adequately trained to conduct export control reviews; however, we identified potential 

problems within the STI review process. Based on the results of our initial inquiry, we 

initiated this audit of the STI review process in September 2006. In addition to reviewing 

the STI review process at Johnson, we reviewed the process at Goddard Space Flight 

Center, Langley Research Center, and Marshall Space Flight Center, because those 

Centers consistently produce significant amounts of STI. 

On September 29, 2006, the OIG received a request from 14 U.S. Senators to investigate 

allegations that NASA was suppressing the release of scientific research and censoring its 

scientists. The OIG’s Office of Investigations initiated an administrative investigation to 

address the specific allegations cited in the request, the results of which were separately 

reported to Congress. Because the release of scientific research is contingent upon 

successful completion of the STI review process, we expanded the scope of our audit to 

evaluate whether the process was used as a means to suppress the release of scientific 

research at Goddard, Johnson, Langley, and Marshall. 

Background 

STI. NASA defines STI as the results (facts, analyses, and conclusions) of basic and 

applied scientific, technical, and related engineering research and development. STI also 

includes relevant management, industry, and economic information. Examples of STI 

produced by NASA include research reports, journal articles, conference proceedings, 

presentations, technical videos, laboratory notes, and scientific and technical operational 

information. NASA researchers, contractors, and grantees use STI to keep abreast of 

national and international advances in science and engineering, to reduce unnecessary 

duplication of effort, and to promote the productivity and cost-effectiveness of NASA 

research activities. 
INTRODUCTION

2 REPORT NO. IG-08-017 

STI Program. NASA’s STI Program provides for public and internal distribution of 

information produced by and for NASA, fulfilling the requirement of the National 

Aeronautics and Space Act of 1958 (the Space Act)6

 to “provide for the widest 

practicable and appropriate dissemination” of information resulting from NASA research 

activities. To meet that requirement, NASA collects, manages, publishes, and provides 

for long-term retention of STI. NASA provides access to the STI through a database 

containing approximately 4 million citations and an increasing number of full-text digital 

NASA documents. The database, accessible at http://www.sti.nasa.gov, is operated for 

NASA by the Center for AeroSpace Information (CASI), a contractor that acquires, 

organizes, disseminates, and archives the STI. 

The STI Program is responsible for ensuring that NASA protects STI that may contain 

information for which publication or distribution is restricted by law, regulation, or 

policy. This includes STI containing information that is restricted because it is exportcontrolled, classified, proprietary, copyrighted, or patented, as well as information 

protected by the Privacy Act. To preclude the distribution of restricted or sensitive STI, 

authors must submit STI through a review process, which includes reviews for technical 

accuracy, export-controlled information, classified information, copyright violations, and 

proprietary data (i.e., “trade secrets”). 

STI Program Management. NASA’s Chief Information Officer (CIO) is responsible 

for planning and managing the implementation of NASA’s STI Program and assessing its 

effectiveness. The CIO has delegated responsibility for STI policy and program 

operations to the Scientific and Technical Information Program Office (STIPO). STIPO, 

which organizationally reports to the CIO, is located at Langley and has a staff of 

five personnel. STIPO’s specific responsibilities include 

• developing and implementing policies and procedures for NASA’s STI Program; 

• operating and managing NASA’s STI Program in accordance with Federal laws 

and regulations and NASA’s policies and procedures; 

• streamlining Agency and Center processes, procedures, and systems for 

identifying, acquiring, tracking, and disseminating STI; and 

• overseeing the CASI database. 

Although the CIO is responsible for the overall STI Program, the Center Directors, who 

are organizationally outside of the CIO’s chain of command, are responsible for ensuring 

that Center personnel comply with STI Program guidance. The Center Directors 

designate a Center STI Manager, who is responsible for the STI review process and for 

 

6

 The Space Act established NASA as the civilian agency with the responsibility of exercising control over 

aeronautical and space activities sponsored by the United States, except for those activities primarily 

associated with the development of weapons systems, military operations, or the defense of the United 

States. 
INTRODUCTION

REPORT NO. IG-08-017 3 

maintaining records of all Center-produced STI that is released or published external to 

NASA. At the operational level, NASA managers, contracting officers, contracting 

officer’s technical representatives, and authors are responsible for coordinating with 

Center STI Managers to ensure that STI is properly reviewed and approved prior to its 

release. 

STI Guidance. The primary guidance for NASA’s STI Program is NASA Policy 

Directive (NPD) 2200.1, “Management of NASA Scientific and Technical Information 

(STI),” March 28, 2003, and NASA Procedural Requirements (NPR) 2200.2B, 

“Requirements for Documentation, Approval, and Dissemination of NASA Scientific and 

Technical Information,” March 25, 2005. The NASA Centers may issue supplementary 

guidance or implementing instructions based on those documents. 

Objectives 

Our overall audit objective was to evaluate NASA’s policies and procedures for the 

review, approval, and release of STI. Specifically, we determined whether the roles and 

responsibilities for the review, approval, and release of STI were adequately defined and 

documented in NASA guidance and whether NASA had effectively implemented that 

guidance at Goddard, Johnson, Langley, and Marshall. We also determined whether the 

STI review process was used as a means to suppress the release of scientific research at 

those four Centers. See Appendix A for details of the audit’s scope and methodology, 

our review of internal controls, and prior coverage. 
RESULTS

4 REPORT NO. IG-08-017 

STI RELEASED WITHOUT 

REQUIRED REVIEW

The roles and responsibilities for the review, approval, and release of NASA STI 

were adequately defined and documented in NASA guidance; however, that 

guidance had not been effectively implemented at Goddard, Johnson, Langley, and 

Marshall. NPR 2200.2B states that only STI that has been reviewed for technical 

accuracy and conformance with applicable law, policy, and publication standards 

may be publicly released. Out of the 4,702 STI items included in our review at 

Goddard, Johnson, Langley, and Marshall, we determined that STI authors had 

publicly released 413 STI items7 during fiscal year (FY) 2005 and FY 2006 without 

obtaining the required reviews. Of those 413 items, 363 were released prior to 

completion of the review process, 19 were released after rejection by one or more of 

the reviewing authorities,8

 and 31 were never submitted for review. The STI was 

released without the required reviews because 

• Center STI Managers were not required to notify the STI authors as to 

whether the STI was approved or rejected for release, 

• the review requirement was not adequately communicated to Center 

personnel, and 

• STIPO did not monitor the effectiveness of the STI review process. 

Although our audit did not identify any restricted STI that was inappropriately 

released, each time STI is released without the required review, the risk of releasing 

restricted or otherwise sensitive information is increased. More significantly, 

noncompliance could result in the release of restricted STI to prohibited sources, 

including countries or persons, which could negatively impact national security. 

 

7

 The actual number of STI items released without the required reviews could be much higher than 413. 

Our sampling methodology, which is discussed in detail in Appendix A, did not allow us to project our 

results from Johnson or Langley. In addition, we identified the 31 STI never submitted for review by 

searching NASA conference Web sites for STI that was presented at the conference. Our search for 

unreviewed STI did not include Web sites for conferences that NASA scientists may have attended but 

which were not NASA or NASA-sponsored conferences. We also did not search scientific journals or 

other media for unreviewed STI. Had we done so, we may have identified additional unreviewed STI. 

8

 Although releasing STI after it was “rejected for release” implies that restricted or sensitive STI may have 

been inappropriately released, the 19 STI were generally rejected for minor clerical or technical errors 

that did not impact the overall content or message of the STI. We did not identify any STI that was 

rejected for release because the STI was of a sensitive nature. 
RESULTS

REPORT NO. IG-08-017 5 

Roles and Responsibilities Adequately Defined 

The roles and responsibilities for the review, approval, and release of NASA STI were 

adequately defined and documented in NPD 2200.1 and NPR 2200.2B. NPD 2200.1 

requires NASA to publish, or otherwise release external to NASA, only STI that has been 

reviewed at the appropriate organizational level for technical accuracy and conformance 

with applicable law, policy, and publication standards. The NPD assigns the Center 

Directors the responsibility that STI review and approval is undertaken as appropriate, 

based on the nature of the STI. NPR 2200.2B contains a description of the STI review 

types: 

• Technical review – performed by peers of the author who have expertise in the 

technical discipline of the research. The review is primarily for technical 

accuracy, quality, and data integrity. 

• National security review – performed by the original classification authority9

 to 

determine whether the information is subject to security classification. 

• Export control review – performed by the Center Export Control Administrators 

or their designees to ensure that export-controlled information is not exported or 

disclosed to foreign nationals without proper authority.10

• Copyright review – performed by the Headquarters and Center patent or 

intellectual property counsel to ensure that information is not used or reproduced 

without protecting the exclusive rights reserved by a copyright owner.11

• Proprietary and confidential commercial information review – performed by 

Headquarters and Center patent or intellectual property counsel to ensure that the 

proprietary data is properly identified and marked to indicate restricted 

dissemination. 

The STI Managers are responsible for ensuring that personnel at their Centers are aware 

of the requirements contained in NPD 2200.1 and NPR 2200.2B. STI Managers are also 

responsible for coordinating with program or project managers who approve STI at the 

Centers, and authors of STI, to ensure that STI is reviewed before being published, 

disseminated, or otherwise released external to NASA. 

 

9

 The original classification authority is the individual authorized in writing, either by the President or by 

agency heads or other senior Government officials designated by the President, to classify information in 

the first instance. 

10Department of Commerce’s Export Administration Regulations, 15 Code of Federal Regulations, parts 

730-774, and the Department of State’s International Traffic in Arms Regulations, 22 Code of Federal 

Regulations, parts 120-130, contain the restrictions on the release of export-controlled technology. 

11Title 17, United States Code, Chapters 1-13, contain the copyright law that protects the exclusive rights 

reserved by a copyright owner. 
RESULTS

6 REPORT NO. IG-08-017 

The STI authors are responsible for initiating the STI review process by completing 

NASA Form 1676, “NASA Scientific and Technical Information (STI) Document 

Availability Authorization (DAA),” or a Center version of that form (see Appendix B for 

a copy of NASA Form 1676). Once all required reviews are completed and the STI is 

approved for full or restricted release, it may be published or presented at a meeting, 

conference, or other forum and is forwarded to CASI to be added to the CASI database. 

If the STI is rejected for release, the author can revise the STI and resubmit it. 

Guidance Not Adequately Implemented 

Although NASA’s guidance clearly states that a review is required before STI may be 

publicly released, that guidance was not adequately implemented at Goddard, Johnson, 

Langley, and Marshall. Out of the 4,702 STI items included in our review at those four 

Centers, we determined that STI authors had publicly released 413 STI items during 

FY 2005 and FY 2006 without obtaining the required reviews (Goddard, 123; 

Johnson, 87; Langley, 70; and Marshall, 133). Of the 413 items, 363 were released prior 

to completion of the review process, 19 were released after rejection by one or more of 

the reviewing authorities, and 31 were never submitted for review. 

All four Centers had established an STI review process, and we reviewed each of those 

processes. We were able to review more robust sets of information at Johnson and 

Langley because those Centers had automated their review process. Although 

NPR 2200.2B requires Centers to establish an STI review process, it does not require an 

automated tracking system. The automated systems contained the date the author 

submitted the STI for review, the completion date for each review, whether the reviewer 

approved or rejected the STI for release, and the STI release date. Therefore, the STI 

Manager had visibility over each step in the review process. In contrast, the use of paperbased systems at Goddard and Marshall limited their (and our) visibility over the ongoing 

STI reviews because the STI Managers had no record of when a review was initiated or 

how many STI reviews were in process at any one time. In addition, since the Goddard 

and Marshall STI Managers were only provided copies of STI that had been fully 

approved, they had no knowledge of STI that was rejected at some point in the review 

process, nor could they effectively track or trend any historical data. 

Because neither the automated or paper-based systems would have a record of STI that 

had never been submitted for review, we performed a limited Internet search of NASA 

and NASA-sponsored conferences looking for publicly available conference 

presentations that might include unreviewed STI. Our search for unreviewed STI did not 

include Web sites for conferences that NASA scientists may have attended but which 

were not NASA or NASA-sponsored conferences. We also did not search scientific 

journals or other media for unreviewed STI. Had we done so, we may have identified 

additional STI that had been released without the required review. 
RESULTS

REPORT NO. IG-08-017 7 

Centers with an Automated System. The automated systems used at Johnson and 

Langley allowed us to perform a more robust STI review because we could easily 

identify the review and release dates for all STI processed in FY 2005 and FY 2006. We 

were also able to identify STI that had been rejected for release at some point during the 

review process. 

Johnson. We identified 87 STI items that were released by Johnson personnel 

during FY 2005 and FY 2006 without obtaining the required reviews. Of those 87 items, 

64 were released prior to completion of the review process, 11 were released after 

rejection by one or more of the reviewing authorities, and 12 were never submitted for 

review. 

Our initial review of all records contained in Johnson’s automated system 

indicated that 478 of the 1,369 STI items released in FY 2005 and FY 2006 were either 

released prior to approval or after rejection. Because the STI authors or reviewers could 

have posted incorrect dates in the automated system, we performed an in-depth review to 

validate the dates for a discovery sample12 of 160 of the 478 STI items. That in-depth 

review consisted of verifying the release date by obtaining a copy of the STI or 

contacting the STI author. Of those 160 STI items, we found that 55 had never been 

released or had incorrect dates in the automated system and, therefore, had not been 

inappropriately released. The release dates for another 30 items could not be verified 

because neither the STI nor the author could be located. We validated that Johnson 

personnel released the remaining 75 items without the required reviews. Of those 

75 items, 64 were released before the review process had been completed and 11 were 

released after being rejected. Those 75 STI and the 12 STI that we found on conference 

Web sites are the 87 items that we identified at Johnson as having been released without 

the required reviews. 

 Langley. We identified 70 STI items that were released by Langley personnel 

during FY 2005 and FY 2006 without obtaining the required reviews. Of those 70 items, 

57 were released prior to completion of the review process, 8 were released after 

rejection by one or more of the reviewing authorities, and 5 were never submitted for 

review. 

Our initial review of all records contained in Langley’s automated system 

indicated that 441 of the 3,260 STI items released in FY 2005 and FY 2006 were either 

released prior to approval or after rejection. We then performed an in-depth review to 

validate the dates for a discovery sample of 153 of those 441 STI items. Of those 

153 STI items, 7 had incorrect dates in the automated system and the release dates for 

81 could not be verified: 12 because neither the STI nor the author could be located; 

 

12Discovery sampling methodology produces a minimal sample size and can be used to accept a population 

if the sample is error free. The use of discovery sampling allowed us to reduce the number of STI 

required for in-depth review at Johnson and Langley. If we had not identified errors within the discovery 

sample, we could have projected our results. Details concerning our sampling methodology are discussed 

in Appendix A. 
RESULTS

8 REPORT NO. IG-08-017 

68 because the STI was recalled by the author; and 1 because it was entered into the 

system as a test. We validated that Langley personnel released the remaining 65 items 

without the required reviews. Of those 65 items, 57 were released before the required 

review process had been completed and 8 were released after being rejected. Those 

65 STI items and the 5 that we found on conference Web sites are the 70 items that we 

identified at Langley as having been released without the required reviews. 

Centers with a Paper-Based System. The paper-based systems used at Goddard and 

Marshall limited our ability to evaluate all STI processed in FY 2005 and FY 2006. The 

Center STI Managers only maintained copies of STI and the Document Availability 

Authorization (NASA Form 1676) for approved STI items; consequently, we could not 

identify STI that had been rejected for release. We also could not identify STI that was 

still in the process of being reviewed but may have been released already. Because we 

did not have visibility over all STI submitted for review in FY 2005 and FY 2006, we 

used random sampling to select STI items for reviews.

Goddard. We determined that Goddard personnel released 123 STI items 

without obtaining the required reviews during FY 2005 and FY 2006. The 123 STI 

comprise 114 projected STI items and 9 that we found through our Internet search. Our 

projection of 114 STI items was obtained by applying 5.2 percent to the 2,196 STI items 

maintained in the STI Manager’s file for FY 2005 and FY 2006. Using a random sample 

of 290 STI items, we validated that 15 (5.2 percent) had been released prior to 

completing the review process. The 114 projected STI items and the 9 that we found on 

conference Web sites are the 123 items that we identified at Goddard as having been 

released without the required reviews. 

Marshall. We determined that Marshall personnel released 133 STI items 

without obtaining the required reviews during FY 2005 and FY 2006. The 133 STI 

comprise 128 projected STI items and 5 that we found through our Internet search. Our 

projection of 128 STI items was obtained by applying 8.2 percent to the 1,556 STI items 

maintained in the STI Manager’s file for FY 2005 and FY 2006. Using a random sample 

of 280 STI items, we validated that 23 (8.2 percent) had been released prior to 

completing the review process. The 128 projected STI items and the 5 that we found on 

conference Web sites are the 133 items that we identified at Marshall as having been 

released without the required reviews. 

STI Authors Not Notified of Review Process Completion 

The STI review process, as defined in NPR 2200.2B, does not require the Center STI 

Managers to notify authors that their STI was approved or rejected for release. We 

followed up with the STI authors who either had issued their STI before the review 

process was complete or had released STI after it had been rejected for release. The most 

common reason provided by those STI authors for releasing the STI was that they had 

assumed the STI was approved for release because they were never notified otherwise. 
RESULTS

REPORT NO. IG-08-017 9 

Processes such as STI reviews should be “closed loop” processes. A closed loop process 

is one in which the process ends at the same point that it begins. Applied to an STI 

review, a closed loop process would require notification to the STI author that the STI 

was either approved or rejected for release. This would help prevent authors from 

releasing STI before it was adequately reviewed. Implementing a closed loop process 

can be accomplished by revising NPR 2200.2B to require Center STI Managers to 

develop and implement a process to notify STI authors as to whether their STI was 

approved or rejected for release. The NPR should also be revised to prohibit STI authors 

from releasing STI until notified of approval. Those revisions would remove uncertainty 

from the process and provide both STI Managers and authors a record of the STI’s 

approval or rejection. 

STI Review Requirement Not Adequately Communicated 

Although NPR 2200.2B clearly states that the STI authors are responsible for ensuring 

that STI is adequately reviewed prior to being released, not all STI authors were aware of 

the requirement. We followed up with the authors who had publicly released STI without 

submitting it for review. Those authors told us that they were unaware of, had forgotten 

about, or had never been trained on the review requirement. While we could not 

specifically validate the authors’ level of awareness of the STI review requirement, none 

of the four Centers included in our audit had active programs designed to educate new 

employees or periodically brief existing employees about the STI review requirement. 

The lack of training is consistent with our finding in “NASA Should Improve Employee 

Awareness of Requirements for Identifying and Handling Sensitive But Unclassified 

Information” (IG-06-010-Redacted, May 9, 2006). We found that NASA personnel had 

not been adequately trained to identify and handle Sensitive But Unclassified 

information. Sensitive But Unclassified STI should be identified as such during the STI 

review process to ensure that it is not inadvertently disseminated. 

NPR 2200.2B states that the Center Directors are responsible for ensuring that Center 

personnel comply with the NPR and that the Center STI Managers are responsible for 

ensuring that Center personnel are aware of the STI policies and procedures. However, 

STI Managers at Goddard, Johnson, Langley, and Marshall generally relied on export 

control personnel to inform Center personnel about the STI review process during new 

employee orientation or other periodic export control briefings. To improve compliance 

with the STI review process, the Center STI Managers need to ensure that employees are 

aware of and fully understand the process and their associated roles and responsibilities. 

The Center Directors at Goddard, Johnson, Langley, and Marshall should work in 

conjunction with the STI Managers to develop and implement an awareness plan 

concerning the STI review process. That plan could include periodic Center-wide 

e-mails and required annual training that inform and educate STI authors on the 

requirements contained in NPR 2200.2B. 
RESULTS

10 REPORT NO. IG-08-017 

Effectiveness of STI Review Process Not Monitored 

Although STIPO monitored certain elements of the STI Program, its efforts were focused 

primarily on productivity and not the effectiveness of the STI review process. 

NPD 2200.1 requires that the effectiveness of the STI collection and dissemination 

process be monitored by use of the following metrics: 

• Capture NASA STI – NASA will increase the quantity of NASA STI and nonNASA STI captured for the CASI database. 

• Access and disseminate STI – NASA will track the number of primary and 

secondary distributions or access of STI, including electronic searches 

(e.g., Internet searches), to determine the usage of its products and services. 

• Acquire external STI – NASA will compare the subject matter requirements of 

users against STI access to global sources (other agencies, domestic and 

international sources) in order to provide relevant information for NASA’s 

missions and programs. 

• Measure customer satisfaction – NASA will routinely analyze user comments 

regarding the timeliness of service and usefulness of information. 

STIPO collects this data and reports it annually to the Agency. However, NPD 2200.1 

does not require STIPO to have metrics or other monitoring activities designed to 

measure the effectiveness of the STI review process. Because the review process is the 

primary method NASA has for ensuring that only approved STI is released, it is 

imperative that its effectiveness be monitored and that corrective action be taken in 

response to any problems identified. In conducting such monitoring activities, STIPO 

should work with the Center Directors and Center STI Managers to collect data 

concerning the review, approval, and release of STI. STIPO and the Centers should then 

be able to identify those authors who are not complying with NPR 2200.2B. 

Agency-wide Automation Should Facilitate Monitoring 

The Centers with automated systems have access to more comprehensive and timely data 

with which to monitor the effectiveness of the STI review process. An automated system 

can be periodically queried to identify inappropriately released STI, while a paper-based 

system cannot. STI Managers using paper-based systems must review each individual 

NASA Form 1676 to identify inappropriately released STI, which, depending on the 

number reviewed, could be a time-consuming task. In addition, those STI Managers do 

not have a comprehensive data set because they are only provided copies of fully 

approved STI; they have no knowledge of STI that is still being reviewed or STI that was 

rejected at some point during the review. 
RESULTS

REPORT NO. IG-08-017 11 

NASA’s CIO and STIPO began to address the automation issue and, in February 2007, 

commissioned a study of the automated STI review systems at Ames Research Center, 

Johnson, Langley, Stennis Space Center, and the Environmental Protection Agency. The 

study, which was issued June 28, 2007, recommended that NASA partially centralize the 

STI review and approval process to provide for maximum benefit at minimum cost. The 

study also recommended that NASA use the Ames automated system as a baseline and 

incorporate the user functionality of Langley’s system. Based on the results of the study, 

STIPO requested funding for a centralized STI automated system, the justification of 

which is a reduction in long-term program costs. STIPO has since adapted the Ames 

system for Agency-wide use, but STIPO’s baseline funding for FY 2009 will not allow 

for system rollout, maintenance, and implementation. As a result, STIPO initiated a 

request for overguidelines funding13 for FY 2009 and beyond for the automation. 

The actions taken by STIPO to pursue an automated system will provide management 

with more complete and accurate data, which should improve the Agency’s ability to 

monitor the effectiveness of the STI review process. Improved monitoring should also 

decrease the number of NASA STI items released without proper review. In the draft of 

this report, we did not make a recommendation concerning an automated system because 

STIPO had requested the overguidelines funding. While we were preparing the final 

report, STIPO informed us that the CIO had denied that funding request. Therefore, we 

have added a recommendation in this final report (Recommendation 4) that the CIO 

determine how to best attain the intended benefits of an Agency-wide automated STI 

tracking system and provide an appropriate plan of action. 

Increased Risk of Releasing Restricted or Sensitive STI 

Although we did not identify any restricted STI that was inappropriately released, we 

believe this area presents significant risk for NASA because authors can easily release 

STI without complying with the required review process. Each time NASA releases STI 

before it is appropriately reviewed, the risk of violating export control laws, national 

security regulations, or copyright restrictions increases. In addition, NASA does not 

have reasonable assurance that it is fully compliant with the laws and regulations 

governing the release of restricted information or with the Space Act. More significantly, 

noncompliance could result in the release of restricted STI to prohibited sources, 

including countries or persons, which could negatively impact national security. 

NASA strives for the widest practicable and appropriate dissemination of information 

concerning its activities and pursues ever-greater levels of partnership and cooperation in 

national and international space activities. However, “appropriate” dissemination 

encompasses the need for NASA to protect U.S. interests by reducing risk and restricting 

access to sensitive material, such as export-controlled technical data and industry 

 

13According to NASA management, overguidelines funding refers to funds that are above existing program 

financial guidelines. 
RESULTS

12 REPORT NO. IG-08-017 

proprietary information. Compliance with the STI review process helps NASA achieve 

its mission while maintaining national security and limiting access to sensitive space 

technologies. 

No Evidence to Support Suppression of Scientific Research within 

the STI Review Process 

We found no evidence that the STI review process at Goddard, Johnson, Langley, or 

Marshall was used as a means to suppress the results of scientific research, and therefore, 

the report contains no recommendations concerning this issue. Because the STI 

reviewing authorities could use the review process to suppress the results of scientific 

research by rejecting certain STI for public release, we surveyed 287 NASA STI authors 

concerning rejected STI. We also conducted further analysis of the 19 STI that we 

identified as having been rejected in FY 2005 and FY 2006 to consider whether STI on a 

specific topic or by an individual author had been disproportionately rejected. 

STI Author Survey. Our survey results did not indicate that the reviewing authorities 

were using the STI review process as a means to suppress the release of NASA’s 

scientific research. We elected to survey those authors who, based on our initial review 

of STI, appeared to have released STI prior to approval or after rejection, since we were 

already following up with those authors concerning those specific reviews. Of the 

287 authors surveyed, 264 responded to our questions (92 percent response rate). 

We asked the authors whether they had ever had an STI item rejected for public release. 

Of the 264 authors who responded, 96 responded “yes,” and 168 responded “no.”14 We 

followed up with the 96 authors who responded yes to determine the reason for rejection 

and whether the author agreed with the reason given by the reviewing authority. All 

96 authors told us the STI was rejected because of errors on the submission form or the 

need to make minor technical revisions to the STI. Of the 96 authors, only 13 disagreed 

with the reason for rejection; however, the disagreements were based on the STI process 

itself (for example, the process took too long, the submission form was difficult to 

understand) or writing style differences between an author and the reviewing authority. 

None of the authors reported that they believed the reviewing authority had rejected the 

STI in an attempt to suppress the results of their research.15 Therefore, based on our 

survey results, we could not support that a relationship existed between rejected STI and 

suppression of scientific research. 

 

14The 96 includes 18 authors who were unaware that their STI had been rejected for release until we 

notified them of the rejection. 

15A review published by the Government Accountability Office (GAO), “Federal Research: Policies 

Guiding the Dissemination of Scientific Research from Selected Agencies Should Be Clarified and Better 

Communicated” (GAO-07-653, May 2007), reported that NASA dissemination policies could be better 

communicated. GAO estimated that 91 percent of NASA researchers believe that the Agency supports 

dissemination of research results through publications. 
RESULTS

REPORT NO. IG-08-017 13 

Analysis of Rejected STI. Our analysis of the 19 STI items that we identified as 

rejected during FY 2005 and FY 2006 did not indicate that STI on a specific topic or by 

an individual author was disproportionately rejected. The titles of the STI varied greatly, 

including “Space Medicine,” “Wireless Communication and Interfaces Aboard the 

Spacecraft,” “A New Method for Acquiring Measurements,” and “Recertification of 

Liquid Oxygen (LOX) Run Tank.” We were unable to identify any trends that indicated 

a single topic or specific author’s work was routinely rejected for release. 

Recommendations, Management’s Response, and Evaluation of 

Management’s Response 

Recommendation 1. The Center Directors at Goddard, Johnson, Langley, and Marshall, in 

coordination with the Center STI Managers, should establish and implement a plan to 

increase awareness of the STI review requirements contained in NPR 2200.2B. 

Management’s Response. The Center Directors at Goddard, Johnson, Langley, and 

Marshall concurred with the recommendation, as described in the comments provided by 

the CIO (see Appendix C). 

Goddard will issue Center STI policy by October 7, 2008. The Goddard STI Program 

Office conducted outreach initiatives to promote awareness in May and August 2007 and 

planned a third initiative for April 2008. In addition, the Center STI Program Office is 

publishing a brochure for Center-wide distribution that will serve as an STI reference 

tool, focusing on key aspects of the STI Program. Additionally, in February 2008, the 

Center STI Program Office implemented a process to notify authors in writing if requests 

for authorization to distribute STI are incomplete or improperly prepared. 

Johnson disagreed with the number of STI items that we stated were released by Johnson 

authors prior to review or approval, but stated that Johnson continues to improve its 

automated tracking system and Center-wide awareness of STI review requirements. 

Johnson distributed articles on STI requirements, dated January 3 and 11, 2008, via a 

Center-wide e-mail and is implementing a plan to increase awareness that should be in 

place by October 7, 2008. Johnson expects to distribute regular articles on STI 

requirements, with a Web site link to an educational presentation on STI requirements; 

give an educational presentation quarterly; add STI education to new employee 

orientation; and meet directly with those organizations with the largest percentage of 

total STI items released. 

Langley has developed and will be implementing an STI awareness plan by October 7, 

2008. The plan includes the Langley Center Director issuing a Center-wide e-mail 

regarding STI requirements and the Langley STI Manager providing presentations to new 

employees. 
RESULTS

14 REPORT NO. IG-08-017 

Marshall stated that it implemented an STI awareness plan in March 2008. Additional 

steps to increase awareness include a memorandum to all employees clarifying STI 

requirements, quarterly notices via “Inside Marshall” or Center-wide television, and 

required training. 

Evaluation of Management’s Response. We consider management’s proposed actions 

to be responsive. The recommendation is resolved, and we will close the 

recommendation after we verify that all actions have been completed. 

We did not revise the report based on Johnson’s disagreement with the number of STI 

items released prior to review or approval. The specific disagreement concerns the 

11 Johnson STI that were released after rejection. We had initially identified 12 such 

STI, but based on documentation provided by the Johnson STI Manager, we revised the 

number to 9 STI. We subsequently identified two additional STI items that were released 

after rejection, which accounts for the 11 STI cited in this report. We provided the 

Johnson STI Manager with detailed information on those STI items, but did not receive 

any response; therefore, we did not revise the report. 

Recommendation 2. The CIO should revise NPR 2200.2B to require that Center STI 

Managers timely notify STI authors as to whether their STI was approved or rejected for 

release and to prohibit STI authors from publicly releasing STI before approval notification 

is received. 

Recommendation 3. The CIO should revise NPD 2200.1 to include “effectiveness of the 

STI review process” as one of the annual performance measures used to determine whether 

NASA is achieving compliance with the policy directive. 

Management’s Response to Recommendations 2 and 3. The CIO concurred with both 

recommendations, stating that the STI Program will issue a NASA Interim Directive by 

October 7, 2008, requiring timely notification of authors and instituting an annual 

performance measure to determine the effectiveness of the STI review process. In 

addition, both NPR 2200.2B and NPD 2200.1 will be updated in the next full regular 

revision to include these requirements. 

Evaluation of Management’s Response. We consider management’s proposed actions 

to be responsive. The recommendations are resolved and will be closed after we verify 

that all actions have been completed. 

Recommendation 4. The CIO should determine how to best attain the intended benefits of 

an Agency-wide automated STI tracking system and provide an appropriate plan of action to 

do so. 
APPENDIXES

REPORT NO. IG-08-017 15 

APPENDIX A 

Scope and Methodology 

We performed this audit from September 2006 through April 2008 in accordance with 

generally accepted government auditing standards. Those standards require that we plan 

and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable 

basis for our findings and conclusions based on our audit objectives. We believe that the 

evidence obtained provides a reasonable basis for our findings and conclusions based on 

our audit objectives. 

We collected, reviewed, and analyzed NASA guidance pertaining to STI, to include 

NPD 2200.1, NPR 2200.2B, and Center supplements to that guidance. Three of the four 

Centers we visited had supplemental guidance: Johnson, Langley, and Marshall. 

Goddard follows the NPR. 

We met with personnel from STIPO to obtain an overview of the program, to gain an 

in-depth understanding of the STI review process, and to obtain an understanding of the 

CASI database. We met with the STI Managers at Goddard, Johnson, Langley, and 

Marshall to obtain an understanding of local STI policies and procedures. We also met 

with Directorate managers at those Centers to obtain an understanding of the procedures 

for rejecting the release of STI. 

We evaluated the STI review process at Goddard, Johnson, Langley, and Marshall. We 

evaluated Johnson’s process because the initial hotline complaint originated from 

Johnson personnel that were responsible for conducting the STI export control reviews. 

We evaluated the processes at Goddard, Langley, and Marshall because STIPO records 

indicated that those Centers consistently produced significant amounts of STI. Our 

evaluation and sampling procedures varied depending on whether the Center used an 

automated or a paper-based system to track the review process. 

To address the congressional request, we surveyed 287 STI authors concerning 

suppression of NASA research at the four Centers included in our audit. We also 

reviewed the 19 STI items at Johnson and Langley that were released after being rejected 

and searched for trends, such as high instances of rejection for any individual STI topic 

or author. The scope of this audit was limited to the STI review process that is required 

by NASA. This audit did not address specific allegations that NASA scientists were not 

allowed to express their views through public appearances or through NASA-sponsored 

press releases. These specific allegations were addressed in an administrative 

investigation and the results of that investigation were reported separately. 
APPENDIX A 

16 REPORT NO. IG-08-017 

Sampling Methodology. For Johnson and Langley, the Centers using an automated 

tracking system, we initially analyzed the review and approval dates for all STI processed 

in FY 2005 and FY 2006. We performed this analysis to identify STI that, according to 

the dates in the automated system, were released prior to the completion of the review 

process. Our initial analysis of the records contained in Johnson’s automated system 

indicated that 1,369 STI items were released in FY 2005 and FY 2006, and 478 of those 

appeared to have been released either prior to approval or after rejection. Our initial 

analysis of the records contained in Langley’s automated system indicated that 3,260 STI 

items were released in FY 2005 and FY 2006, and 441 of those items appeared to have 

been released either prior to approval or after rejection. To verify the results of our initial 

analysis, we applied the Discovery Acceptance Sampling Approach (discovery 

sampling), under the guidance of the Defense Contract Audit Agency. 

Discovery sampling is an acceptance sampling approach that produces a minimal sample 

size and can be used to accept a population if the sample is error free. This approach 

allowed us to obtain a statistical sample of only those items that appeared to have been 

released prior to approval, or after rejection, based on the information contained in the 

automated systems. We used EZ-Quant sampling software to determine the discovery 

sample size and to generate random numbers. We selected an error rate of 5 percent and 

a precision range of 5 percent, which generated a confidence level of 95 percent. Using 

discovery sampling methodology and the attributes mentioned above, we sampled 160 of 

the 478 STI items at Johnson. Of the 160 items we sampled at Johnson, we identified 

data errors with 55 items and were unable to verify the data for an additional 30 items. 

At Langley, we sampled 153 of the 441 STI items and identified data errors or were 

unable to verify the data for 88 items. We were unable to verify the data because we 

could not locate the author or obtain a copy of the STI, or the author recalled the STI. 

Because we could not verify the data for all of the sampled items, we could not project 

the results of the discovery samples. 

For Goddard and Marshall, the Centers using a paper-based process to review STI, 

we obtained a list of STI approved for release in FY 2005 and FY 2006 from the 

STI Managers and applied a statistical random sampling methodology to select specific 

STI for in-depth review. The in-depth review consisted of verifying the dates contained 

on the NASA Form 1676. We verified those dates by surveying the authors and 

obtaining copies of the STI items. At both Goddard and Marshall, we selected an error 

rate of 5 percent and a precision range of 5 percent, which generated a confidence level 

of 95 percent. During FY 2005 and FY 2006, Goddard approved 2,196 STI items for 

release and Marshall approved 1,556 STI items for release. Using random sampling, we 

selected for review 290 of Goddard’s 2,196 STI items and 280 of Marshall’s 1,556 STI 

items. 

To identify STI that had never been submitted for review, we selected 20 conferences 

held during FY 2005 and FY 2006 where NASA STI was released. We reviewed the 

conference agendas, abstract books, and program guides contained on the conference 

Web sites to identify NASA STI that may have been presented. We obtained the title, 
APPENDIX A 

REPORT NO. IG-08-017 17 

author’s name, and author’s Center for each item of NASA STI. When possible, we also 

obtained a copy of the STI. We limited our search to STI presented by NASA personnel 

who worked at Goddard, Johnson, Langley, or Marshall. To determine whether the STI 

had been submitted for review, we searched the Centers’ STI records and the CASI 

database. We also contacted the authors in some cases. 

Use of Computer-Processed Data. During the audit, we used computer-processed data 

from the CASI STI database and the Johnson and Langley automated systems. We 

primarily used the CASI database to obtain hardcopy documentation of STI items. We 

verified the data we obtained from CASI with outside sources. If we could not verify the 

data, the STI item was not included in our audit. We used the Centers’ automated 

systems to perform preliminary reviews, but verified system data with outside sources. 

We considered the data in the Johnson and Langley systems to be unreliable because of 

incorrect dates for STI approval and release that we identified. However, because we 

used only the information that could be verified, the reliability of the data does not affect 

our findings.

Review of Internal Controls 

To assess whether internal controls were adequate to identify and prevent the 

inappropriate release of STI, we reviewed controls over the STI review process at 

Goddard, Johnson, Langley, and Marshall. Specifically, we reviewed internal controls 

associated with STI submitted through the review process and controls associated with 

monitoring for STI that was never submitted through the process. We identified internal 

control weaknesses with communicating STI guidance, with notifying authors that the 

STI review process was completed, and with oversight activities that should ensure the 

STI review process is operating effectively. The internal control weaknesses are 

discussed in this report, and corrective actions taken in response to our recommendations 

should improve internal controls over the STI review process and oversight activities. 

Prior Coverage 

During the last 5 years, GAO issued one report of particular relevance to the subject of 

our audit, “Federal Research: Policies Guiding the Dissemination of Scientific Research 

from Selected Agencies Should Be Clarified and Better Communicated” (GAO-07-653, 

May 2007). Unrestricted GAO reports can be accessed over the Internet at 

http://www.gao.gov. 
APPENDIX B 

18 REPORT NO. IG-08-017 

NASA FORM 1676 
APPENDIX B 

REPORT NO. IG-08-017 19 
APPENDIX B 

20 REPORT NO. IG-08-017 
APPENDIX B 

REPORT NO. IG-08-017 21 
APPENDIX C 

22 REPORT NO. IG-08-017 

MANAGEMENT COMMENTS
APPENDIX C 

REPORT NO. IG-08-017 23 
APPENDIX C 

24 REPORT NO. IG-08-017 
APPENDIX C 

REPORT NO. IG-08-017 25 
APPENDIX C 

26 REPORT NO. IG-08-017 
APPENDIX C 

REPORT NO. IG-08-017 27 
APPENDIX C 

28 REPORT NO. IG-08-017 
APPENDIX D 

REPORT NO. IG-08-017 29 

REPORT DISTRIBUTION

National Aeronautics and Space Administration 

Administrator 

Deputy Administrator 

Chief of Staff 

Chief Information Officer 

Head, Scientific and Technical Information Program Office 

Director, Goddard Space Flight Center 

Scientific and Technical Information Program Manager 

Director, Johnson Space Center 

Scientific and Technical Information Manager/Information Management Team Lead 

Director, Langley Research Center 

Scientific and Technical Information Manager 

Director, Marshall Space Flight Center 

Scientific and Technical Information Manager 

Non-NASA Organizations and Individuals 

Office of Management and Budget 

Deputy Associate Director, Energy and Science Division 

Branch Chief, Science and Space Programs Branch 

Government Accountability Office 

Director, Defense, State, and NASA Financial Management, Office of Financial 

Management and Assurance 

Director, NASA Issues, Office of Acquisition and Sourcing Management 

Congressional Committees and Subcommittees, Chairman and 

Ranking Member 

Senate Committee on Appropriations 

Subcommittee on Commerce, Justice, Science, and Related Agencies 

Senate Committee on Commerce, Science, and Transportation 

Subcommittee on Space, Aeronautics, and Related Sciences 

Senate Committee on Homeland Security and Governmental Affairs 

House Committee on Appropriations 

Subcommittee on Commerce, Justice, Science, and Related Agencies 

House Committee on Oversight and Government Reform 

Subcommittee on Government Management, Organization, and Procurement 
APPENDIX D 

30 REPORT NO. IG-08-017 

Congressional Committees and Subcommittees, Chairman and 

Ranking Member (continued)

House Committee on Science and Technology 

Subcommittee on Investigations and Oversight 

Subcommittee on Space and Aeronautics 
Major Contributors to the Report: 

Carol Gorman, Director, Space Operations and Exploration Directorate 

Paul Johnson, Project Manager 

Julia Eggert, Management Analyst 

Nicole Ellis, Management Analyst 

Jim Richards, Auditor 

Elizabeth Shifflett, Report Process Manager 

REPORT NO. IG-08-017 31 
June 2, 2008 

REPORT No. IG-08-017 

OFFICE OF AUDITS

OFFICE OF INSPECTOR GENERAL

ADDITIONAL COPIES

Visit www.hq.nasa.gov/office/oig/hq/audits/reports/FY08/index.html to obtain additional copies of this 

report, or contact the Assistant Inspector General for Auditing at 202-358-1232. 

COMMENTS ON THIS REPORT

In order to help us improve the quality of our products, if you wish to comment on the quality or 

usefulness of this report, please send your comments to Ms. Jacqueline White, Director of Quality 

Assurance, at Jacqueline.White@nasa.gov or call 202-358-0203. 

SUGGESTIONS FOR FUTURE AUDITS

To suggest ideas for or to request future audits, contact the Assistant Inspector General for Auditing. 

Ideas and requests can also be mailed to: 

Assistant Inspector General for Auditing 

NASA Headquarters 

Washington, DC 20546-0001 

NASA HOTLINE

To report fraud, waste, abuse, or mismanagement, contact the NASA OIG Hotline at 800-424-9183 or 

800-535-8134 (TDD). You may also write to the NASA Inspector General, P.O. Box 23089, L’Enfant 

Plaza Station, Washington, DC 20026, or use http://www.hq.nasa.gov/office/oig/hq/hotline.html#form. 

The identity of each writer and caller can be kept confidential, upon request, to the extent permitted 

by law.