text: Background CFIUS was established by executive order in 1975 to monitor the effect of and to coordinate U.S. policy on foreign investment in the United States. In 1988, Congress enacted the Exon-Florio amendment adding section 721 to the Defense Production Act of 1950, which authorized the President to investigate the effect of certain foreign acquisitions of U.S. companies on national security and to suspend or prohibit acquisitions that might threaten to impair national security. The President delegated this investigative authority to CFIUS. The Foreign Investment and National Security Act of 2007 further amended the Defense Production Act and formally established CFIUS in statute. CFIUS is responsible for reviewing and investigating covered transactions to determine the effects of the transaction on national security. The Foreign Investment and National Security Act of 2007 does not formally define national security, but provides a number of factors for consideration by CFIUS and the President in determining whether a covered transaction poses a national security risk. These factors include the potential national security effects on U.S. critical technologies and whether the transaction could result in the control of a U.S. business by a foreign government (for a full list of factors, see Appendix III). CFIUS may also consider other factors in determining whether a transaction poses a national security risk. Chaired by the Secretary of the Treasury, CFIUS includes voting members from the Departments of Commerce, Defense, Energy, State, Justice, and Homeland Security; the Office of the U.S. Trade Representative; and the Office of Science and Technology Policy. Treasury is responsible for a number of tasks. According to Treasury officials, these tasks include coordinating operations of the committee, facilitating information collection from parties involved in the transaction (such as a foreign acquirer and U.S. business owner involved in an acquisition), reviewing and sharing data on mergers and acquisitions with member agencies, and managing CFIUS time frames. Treasury also communicates with the parties on CFIUS’s behalf. The committee generally has three core functions: review and investigate transactions that have been voluntarily submitted—or notified—to the committee by the parties to the transaction and take action as necessary to address potential national security concerns; monitor and enforce compliance with mitigation agreements; and identify transactions of concern that have not been voluntarily notified to CFIUS for review, referred to in this report as non-notified transactions. The Foreign Investment and National Security Act of 2007 does not require that parties notify CFIUS of a transaction. In examining covered transactions, CFIUS members seek to identify and address, as appropriate, any national security concerns that arise as a result of the transaction. CFIUS reviews notices that have been voluntarily submitted—or notified—to the committee by parties to potentially covered transactions. Notices to CFIUS contain information concerning the nature of the transaction and the parties involved, such as the business activities performed by the U.S. business and any products or services supplied to the U.S. government. After receiving a notice, Treasury drafts an analysis to assess whether the transaction submitted is a covered transaction, meaning whether the transaction could result in foreign control of a U.S. business. With limited exceptions, a transaction receives safe harbor—meaning the transaction cannot be reviewed again—when the CFIUS process is completed and the committee has determined that the transaction may proceed. CFIUS does not review every transaction or investment by foreign entities. According to Treasury officials, there are certain transactions by foreign entities that CFIUS does not have the authority to review. These non-covered transactions and investments include the establishment of a business, referred to as a greenfield investment, and acquisitions of assets—such as equipment, intellectual property, or real property—if such assets do not constitute a U.S. business. If CFIUS member agencies become aware of a transaction that might be covered that has not been voluntarily notified to the committee and may raise national security considerations, CFIUS may invite the parties to the transaction to submit a notice. CFIUS may choose to unilaterally review any transaction that could be covered. Treasury, DOD, and several other member agencies have processes for identifying non-notified transactions for CFIUS to potentially review. CFIUS Process The CFIUS process for examining transactions that have been notified to the committee is comprised of up to four stages: national security review (30 days), national security investigation (45 days), and presidential action. In some cases, before a transaction is accepted and reviewed by CFIUS, Treasury may conduct a pre-notice consultation with parties to a transaction. This is not a required part of the process. For the purposes of this review, we focus on three stages—the national security review, national security investigation, and presidential action. For each transaction accepted and reviewed by CFIUS, an agency or agencies with relevant expertise are identified to act as a co-lead with Treasury. Each agency in turn distributes the transaction to various offices within its agency to provide an assessment of the transaction and identify national security risks, which is then provided to CFIUS. For example, the committee may reach consensus that no investigation is required if it is determined that the covered transaction will not impair national security or that the national security concerns are addressed under existing authorities, such as export controls. If these conclusions are reached, the national security review ends, and the transaction proceeds. However, if, for example, an agency identifies an unresolved national security risk, the agency may draft a risk-based analysis and CFIUS may undertake a national security investigation. If during the investigation the committee members reach consensus that a national security risk exists, but the risks can be mitigated, mitigation agreement measures are drafted to address those risks, and these measures are negotiated with the other members of the committee and the parties to the transaction. The CFIUS process may conclude after consensus is reached by all agencies and the co-lead agencies certify to members of Congress that there are no unresolved national security concerns, and the transaction receives safe harbor. At the end of the national security investigation, if the committee does not reach consensus that there are no unresolved national security concerns or the committee concludes by consensus that a foreign investment threatens to impair national security and the threat cannot be mitigated, CFIUS elevates the transaction to the President. The President may prohibit or suspend the transaction. At any point prior to the conclusion of the process, parties may request to withdraw from the CFIUS process. In some cases, the notice is resubmitted once the parties believe that they have addressed the committee’s concerns; in other cases, the companies may choose to withdraw and abandon their transaction. See figure 1 for an overview of the CFIUS process for reviewing and investigating selected transactions. DOD CFIUS Process DOD Instruction 2000.25, Procedures for Reviewing and Monitoring Transactions Filed with the Committee on Foreign Investment in the United States (DOD’s Instruction), provides policy and guidance on the DOD CFIUS process and assigns responsibilities in that process. In March 2011, DOD’s CFIUS responsibilities were reassigned from the Defense Technology Security Administration to the Office of the Under Secretary of Defense for Acquisition, Technology, and Logistics (OUSD (AT&L)). The transfer of responsibilities, effective in fiscal year 2012, was intended to better align CFIUS’s mission with the DOD office responsible for industrial policy. Within OUSD (AT&L), MIBP serves as the lead office for CFIUS, reviews transactions for DOD equities, and distributes them to more than 30 organizations within DOD—referred to in this report as DOD components —to determine whether the transaction poses any national security concerns. These component reviewers include organizations within the Office of the Secretary of Defense, as well as the military departments, among others. For a full list of DOD component reviewers, see appendix I. According to MIBP’s processes, it is responsible for reviewing and compiling comments and input from all DOD component reviewers during the 30-day national security review. When national security concerns with a transaction are identified, MIBP is to coordinate with affected DOD component reviewers to clarify issues and arrive at consensus on the DOD position for the transaction. DOD is typically designated as a co- lead agency for transactions where it has identified equities—such as transactions involving companies that are DOD suppliers—or other potential national security concerns. If no national security concerns are identified by DOD, MIBP will recommend that the transaction proceed. However, if national security concerns are identified by DOD and the committee requires additional time to complete its review, DOD recommends that the transaction proceed to a 45-day national security investigation period. During this period, MIBP coordinates with DOD component reviewers to draft and deliver a risk-based analysis to Treasury within the statutory investigation time frame. The assessment provides a description of the risk—in terms of threat, vulnerability, and consequence—arising from the covered transaction. If the risks can be addressed, DOD develops measures to be included in the mitigation agreement that it is then responsible for monitoring and enforcing as a signatory agency to the mitigation agreement. DOD guidance identifies three basic types of mitigation measures: 1. Technical mitigation measures, which seek to address risks related to vulnerabilities or critical assets with sensitive source codes, cutting- edge technologies, and communications infrastructure. 2. Personnel mitigation measures, which seek to address risks arising from foreign personnel having access to sensitive technology or other critical assets. 3. Management control mitigation measures, which seek to oversee companies’ ongoing implementation of mitigation agreements related to technical or personnel mitigation measures. DOD, along with other lead agencies, carries out its monitoring responsibilities on behalf of the committee and reports back to the committee on the status of their responsibilities and company compliance on at least a quarterly basis. DOD’s Instruction requires the identification of feasible measures to mitigate or eliminate the risks posed by a transaction and emphasizes that adequate resources, in terms of personnel and budget, should be provided to DOD and the components for monitoring and ensuring compliance with mitigation agreements. Our Prior Work on CFIUS We have conducted prior work related to CFIUS issues, including whether CFIUS has the resources to address its current workload and whether CFIUS is able to address national security concerns related to the proximity of certain real estate transactions to defense test and training ranges. In February 2018, we reported on CFIUS workload and staffing as well as stakeholder perspectives on potential changes to CFIUS. We found that as the volume and complexity of CFIUS reviews have increased in recent years, member agency officials have expressed concerns that current CFIUS staffing levels may not be adequate to complete core functions of the committee. We recommended that Treasury should coordinate member agencies’ efforts to better understand the staffing levels needed to address the current and projected CFIUS workload associated with core committee functions. Treasury agreed with our recommendation. In December 2014, in reviewing DOD’s assessment of foreign encroachment risks on federally managed land, we found that DOD did not have the information it needed to determine whether activities by foreign entities near test and training ranges, such as performing certain sensitive training techniques, could pose a threat to its mission. We also reported that CFIUS is the only formal option in regard to transactions involving foreign companies or entities that accounts for national security concerns related to proximity to military test and training ranges. We recommended that DOD develop and implement guidance for conducting an assessment of risks to test and training ranges from foreign encroachment. We also recommended that DOD collaborate with other federal agencies managing land and transactions adjacent to DOD’s test and training ranges to obtain additional information on transactions near these ranges. DOD agreed with our recommendations and has begun collecting data to identify locations the military services consider to be at risk from foreign encroachment and collaborating with federal land management agencies, as discussed later in the report. Resources and Evolving National Security Risks Pose Challenges for Identifying and Addressing DOD’s Concerns through the CFIUS Process DOD has reviewed hundreds of transactions involving foreign acquirers and U.S. businesses since 2012, but faces several challenges in identifying and addressing national security concerns through the CFIUS process. These challenges are: (1) resources not aligned with an increasing workload; (2) some national security concerns not defined or addressed in DOD’s Instruction; (3) some investments that pose national security concerns not always able to be addressed through the CFIUS process; and (4) current component reviewer responsibilities and CFIUS processes not reflected in DOD’s Instruction. DOD Has Not Assessed Resources to Address a Substantially Increased CFIUS Workload DOD faces challenges addressing an increasing CFIUS workload with its current resources. For example, we found that the number of DOD personnel with CFIUS responsibilities has not kept pace with the growing workload. The number of transactions CFIUS reviewed from 2012 through 2017 more than doubled, increasing from 114 transactions to 238 transactions. During that time, the number of transactions DOD was responsible for co-leading increased by about 57 percent, to 99 transactions in calendar year 2017. From 2016 through 2017 alone, these increases resulted in DOD reviewing almost 65 additional transactions, and co-leading about 30 additional transactions, a substantial increase in workload in one year. DOD also experienced an increase in the cumulative number of mitigation agreements it was responsible for monitoring, more than doubling from 39 in 2012 to 84 in 2017. Figure 2 provides additional information on DOD’s workload and authorized positions in MIBP—the lead DOD office for CFIUS. Based on our review of data on transactions reviewed by CFIUS, DOD’s workload has also been affected by the volume and amount of time spent on the transactions it has reviewed. We found almost half of DOD’s co-led transactions from 2015 through 2016—83 of 136 transactions, or 61 percent—required 45-day national security investigations. According to Treasury officials, the number of transactions requiring national security investigations increases member agencies’ workload because these transactions are usually more complex and require additional resources to review. Further, 9 DOD co-led transactions from 2015 through 2016 were withdrawn and resubmitted to CFIUS, and another 7 were withdrawn and abandoned because of national security concerns or because the committee was going to recommend that the transaction be prohibited. MIBP officials told us that withdrawn and resubmitted or withdrawn and abandoned transactions indicate the complexity of their workload, because a significant number of hours are spent either reviewing resubmitted transactions or justifying the committee’s decision to prohibit the transactions. Moreover, MIBP officials said that depending on the scope and complexity of the national security concerns identified within a transaction, they have had to redirect resources from other functions to support their review responsibilities. As a result, the official said there have been instances where MIBP has had to shift priorities and delay performing other CFIUS tasks in order to assist with reviewing high priority transactions. In addition to reviewing transactions, as a co-lead agency, DOD is also responsible for negotiating any mitigation agreements or other conditions necessary to protect national security, and monitoring compliance with those agreements or conditions. However, according to DOD officials and documents we reviewed, there are limited resources within MIBP and at the DOD component level to do so. For example, MIBP officials said that the volume and complexity of mitigation agreements have increased their workload monitoring these agreements and strained their available resources. Specific details on the effect of mitigation agreement workload increases on MIBP’s resources have been omitted because that information is considered sensitive. In addition, MIBP officials stated that because mitigation agreements typically do not expire, the number of agreements MIBP will be responsible for monitoring will continue to increase in the future. For example, based on our review of MIBP mitigation agreement information, 6 transactions with active mitigation agreements that MIBP is monitoring have been in place for 10 years or more. We also found that MIBP has limited personnel available to identify transactions not voluntarily filed with CFIUS—non-notified transactions— that could pose national security concerns. In the absence of voluntary reporting by the parties involved or independent discovery of the transaction, it is possible that CFIUS may not review a non-notified covered transaction that could pose a risk to national security. To address this concern, MIBP officials began efforts to identify and research non- notified transactions in fiscal year 2016 and, at one point, had up to four personnel involved in this effort. However, according to MIBP officials, three of those personnel were reassigned to help conduct reviews of notified transactions, leaving one person responsible for identifying and researching non-notified transactions relevant to DOD. Specific details on the effect of limited personnel on MIBP’s ability to identify non-notified transactions have been omitted because the information is considered sensitive. To perform its CFIUS responsibilities, OUSD (AT&L) began receiving some funding for CFIUS in fiscal year 2014—on average about $2.4 million dollars a year. However, according to an MIBP official, the funding MIBP receives for CFIUS is typically received after other priorities within OUSD (AT&L) have been addressed. Further, OUSD (AT&L)’s funding does not include CFIUS responsibilities being performed by the other DOD components, which according to MIBP officials do not typically have their own resources for performing CFIUS responsibilities. Among the components we spoke with, the amount of time and personnel dedicated to CFIUS responsibilities varies greatly. According to these components, the amount of time and personnel reviewing transactions ranged from one person dedicating a few hours a month at one component, to a full-time responsibility for six personnel at another component. However, most of the components we spoke with said that CFIUS is a part-time responsibility, and only four of the nine components we spoke with had dedicated personnel to support CFIUS responsibilities. MIBP officials confirmed that the components often have limited personnel and funding to perform CFIUS responsibilities, which can affect the level of involvement components have in reviewing transactions, monitoring mitigation agreements, and researching the non-notified transactions. Recognizing the resource constraints posed by its increased workload, MIBP has taken some steps to assess and adjust its CFIUS resources. For example, MIBP received an increase in its authorized positions in fiscal years 2016 and 2017. Specifically, authorized positions increased from 12 to 17, and according to MIBP officials, 16 of the 17 positions were filled as of October 2017. In January 2017, MIBP requested that component reviewers estimate their CFIUS resource needs to address increases in CFIUS workload. According to an MIBP official, this information was used to support a fiscal year 2019 request for additional funding and personnel to perform CFIUS responsibilities department- wide, and for funding to further develop information technology solutions for managing DOD’s CFIUS process. However, MIBP officials told us their request was only partially funded by the department, and that MIBP would have to determine how to distribute the funding received across the various components to perform its CFIUS responsibilities. DOD’s Instruction states that DOD components shall ensure that adequate resources, in terms of personnel and budget, are available for statutorily required mitigation agreement monitoring and compliance activities. Moreover, federal internal control standards state an agency should establish the organizational structure necessary to achieve its objectives and periodically reevaluate this structure. In this case, this includes the resources needed to accomplish CFIUS responsibilities, such as monitoring mitigation agreements and identifying non-notified transactions. However, according to an MIBP official, prior increases in authorized positions were not added based on any formal review or analysis of resource needs or capability gaps. While MIBP has taken some steps to address its resource limitations, MIBP and some other DOD component officials we spoke with who have CFIUS responsibilities continue to face resource constraints to address their growing workload. Even after receiving approval for some additional funding across DOD to support CFIUS responsibilities, DOD’s resource limitations could be further exacerbated if the number of transactions continues to increase. Without a formal analysis to assess and prioritize the resources necessary for performing its current and future CFIUS responsibilities, DOD will likely face challenges carrying out the duties and responsibilities outlined in its CFIUS policy. In addition to keeping up with the workload involved in reviewing notified transactions, the risks include not knowing whether violations of mitigation agreements or non-notified transactions are occurring that could pose risks to national security. National Security Concerns for Some Investments Are Not Well- Defined in DOD Policy DOD faces evolving national security concerns from foreign investments in U.S. businesses developing emerging technologies and in proximity to critical military locations, but there are inconsistencies in how DOD is reviewing these investments. DOD’s Instruction identifies factors to assess relevant to DOD national security interests, such as whether a firm produces critical technologies or unique defense capabilities, or whether a company being acquired is part of DOD critical infrastructure that is essential to project, support, or sustain military forces. However, DOD’s Instruction does not address the extent to which emerging technologies and proximity to critical military locations are considered under these factors, or whether and how components should review and prioritize transactions for these concerns. Emerging Technology: Officials at several of the DOD components we spoke with identified challenges addressing concerns related to emerging technology, such as artificial intelligence and robotics, through the CFIUS process and varied as to whether they elevate concerns with transactions involving emerging technology. For example, officials at four components said that it can be difficult to explain the risks associated with foreign investment in U.S. businesses developing emerging technologies, particularly if the technology in question is not already being used in a defense program or not being acquired through a traditional merger or acquisition. Officials from another component noted that it can be difficult to identify vulnerabilities and explain the need to protect early stage technologies through the CFIUS process if the technology is not advanced enough. DOD’s Instruction defines critical technologies based in part on those items that are already subject to export controls, but does not specify the types of emerging technologies that could be of concern for the department. Officials at several components noted that it can be difficult for them to identify which emerging technologies are going to be important to DOD to know whether transactions should be mitigated or prohibited. DOD has several lists identifying critical technologies or assets, but does not have an agreed-upon list of emerging technologies that should be protected from foreign investment, making it difficult for components to know which emerging technologies are of concern to the department. A recent DOD report noted that having an agreed-upon list of critical technologies would provide clarity on which transactions reviewed by CFIUS should be prohibited or suspended. According to MIBP officials, they recently initiated a study to identify leading companies and technology areas critical to the department now and in the future. They intend for the study, planned to be completed in spring of 2018, to identify critical and emerging technology sectors and companies not currently included in the defense industrial base. According to DOD officials knowledgeable of the study, MIBP plans to use the results to work with the department’s Office of Small Business and others on ways to use internal DOD resources to protect emerging technologies and intellectual property that are critical to DOD before they are subject to foreign investment. However, officials did not state how the study would help them address emerging technology through CFIUS-related reviews or whether the results of the study would inform changes to DOD’s Instruction or otherwise be used to help guide components on which emerging technologies are critical to the department. Proximity: Each of the military departments varies in how it reviews transactions for proximity to critical military locations. According to DOD reports, transactions near certain military locations can present encroachment issues or opportunities for persistent surveillance and collection of sensitive information of training procedures or of the integration of certain technological capabilities into major weapon systems. When asked about how transactions are reviewed for proximity concerns, MIBP officials said they defer to the military departments to identify what constitutes a concern and do not limit proximity to certain locations. Moreover, MIBP officials stated that depending on the transaction, proximity concerns can arise regardless of distance to a critical location, and that the circumstances surrounding a transaction should be reviewed on a case-by-case basis to account for those concerns. Proximity is not defined in the current DOD Instruction or listed as a factor that the military departments should consider when reviewing transactions. Officials from two of the military departments we spoke with review every transaction on a case-by-case basis for proximity concerns. According to documentation from the third department, it limits its reviews to acquiring companies from certain countries and only assesses those transactions for proximity concerns if the target location is within a certain distance of designated critical locations or assets. These different approaches for reviewing transactions have resulted in inconsistencies among the military departments in the types of proximity concerns they elevate to CFIUS. For example, in one transaction, we found that officials from the third military department recognized a concern near a training range used by all three military departments. While the transaction was ultimately withdrawn because CFIUS planned to recommend that the President prohibit or suspend the transaction, the third department did not identify a national security risk because it did not meet its criteria. Officials from this military department stated that greater clarification on the types of proximity concerns DOD wants to elevate through the CFIUS process, as well as criteria that component reviewers should use to identify risks, would be helpful. Our prior work has identified challenges DOD faces in identifying risks to foreign encroachment near defense training ranges. In a December 2014 report, we recommended that DOD develop and implement guidance for assessing risks to certain test and training ranges from foreign encroachment based on mission criticalities and level of threat. According to DOD officials, they recently conducted a data call to the military departments to identify the locations that they consider to be at risk from foreign encroachment. DOD plans to use this information to develop guidance, not related to the CFIUS process, to assess the risks that test and training ranges face from foreign encroachment. Federal internal control standards state that agencies should clearly define objectives and risk tolerances; identify, analyze, and respond to risks, and communicate necessary information to achieve their objectives. DOD is taking steps to identify and assess areas of concern related to emerging technology and proximity, but these efforts are not specific to the CFIUS process and have not yet been completed or communicated to components through DOD’s Instruction, or otherwise. As a result, the components lack clear and consistent guidance on how to review transactions for these specific types of national security concerns facing the department. Without clarity on the types of transactions and national security risks that should be addressed, for example by incorporating the results of its efforts into DOD’s Instruction, component reviewers will likely continue to be inconsistent in reviewing transactions and identifying and prioritizing national security concerns. DOD Has Identified Some Investments That Present National Security Concerns but Are Not Addressed through the CFIUS Process In addition to challenges identifying certain national security concerns within DOD, CFIUS officials at Treasury and DOD indicated that national security concerns for some foreign investments—such as those related to critical and emerging technologies and proximity to certain military locations—can arise that the committee does not have the authority to review. For example, pursuant to CFIUS regulations, the purchase of property that does not constitute a U.S. business by a foreign person or the licensing of emerging intellectual property to a foreign person are not covered transactions and therefore not addressed through the CFIUS process. As shown in figure 3, while some foreign investments that may result in national security concerns related to critical and emerging technology and proximity are addressed through the CFIUS process, others are not. According to DOD reports, CFIUS is one of the only tools able to address foreign investment in the United States, but is limited in its ability to address some investments in emerging technology and in proximity to military locations. Without the ability to address national security concerns arising from these investments, DOD is at risk of losing access to technologies, assets, and locations critical to maintaining and advancing U.S. technological superiority. A June 2017 DOD report found that although CFIUS is one of the only tools available to address technology transfers as a result of foreign investment, it is not effective at stopping technology transfer for investments that are not addressed through the CFIUS process, like certain joint ventures and other minority investments that do not result in foreign control. However, according to DOD documents and officials, these investments can result in technology transfers that threaten U.S. national security. For example, according to the DOD report, Chinese investors have been active in emerging technology sectors like artificial intelligence, augmented and virtual reality, and robotics, and Chinese investment in venture-backed start-ups is on the rise. The report also found that China’s continued foreign investment in critical emerging technology companies may have consequences for DOD’s ability to work with these companies in the future and its ability to maintain U.S. technological superiority. DOD officials cited concerns with their inability to address certain investments through the CFIUS process that can result in technology transfers or limit DOD access to emerging technologies. For example, DOD officials from three components cited instances when companies entered into joint ventures or other investment structures after withdrawing their transaction from the CFIUS process. A DOD official at one component cited a 2016 transaction where CFIUS planned to recommend that the President prohibit the transaction to prevent the transfer of a critical technology from a U.S. company to a foreign acquirer. Following the companies’ subsequent withdrawal from the CFIUS process, they entered into a joint venture. While CFIUS is aware of the joint venture and that it could result in the same transfer of technology CFIUS attempted to prevent by proposing to prohibit the original transaction, the committee has not yet determined whether it can be addressed through the CFIUS process because CFIUS is only able to review certain types of joint ventures. According to Treasury officials, when these circumstances arise they are sometimes able to review the joint venture, depending on the structure of the investment and whether it meets the definition of a covered transaction pursuant to law and associated regulations. Yet, even if this joint venture is ultimately reviewed as a covered transaction, the technology that DOD and CFIUS were originally concerned with may have already been transferred to the foreign acquirer. DOD and Treasury officials also identified concerns with broader foreign investment trends in critical and emerging technology that may not be addressed through the CFIUS process. For example, according to MIBP officials, they are concerned about foreign-owned enterprises exploiting critical technologies by structuring investments to avoid the CFIUS process, and noted that multiple investment structures exist that can allow foreign acquirers to gain access and influence over critical capabilities. DOD and Treasury officials acknowledged the importance of critical and emerging technologies and the consequences to DOD’s technological superiority if adversaries are able to use these technologies to advance their own military capabilities. According to Treasury officials, determining whether and how CFIUS should expand its scope to address these concerns is one of the challenges they have encountered when they have considered potential legislative changes to the CFIUS process. For example, they said that if the scope of the law was expanded, it could pose additional resource challenges, as CFIUS agencies would be required to review an expanded number of potentially complex transactions. According to federal internal control standards, agencies should identify, analyze, and respond to significant changes that could affect their operations. As noted earlier, DOD is in the process of identifying emerging technologies that will be essential to the defense industrial base, an important step towards informing future decision-making within the department. However, according to MIBP officials, the study will primarily be focused on identifying specific technology companies of importance to the department. As noted earlier, the study is not specific to CFIUS, and as a result plans for the study do not indicate that it will identify and assess other limitations facing MIBP, like those encountered addressing certain types of foreign investments that are not addressed through the CFIUS process but that pose risks to DOD’s technological and military superiority. Given the importance of critical and emerging technology to DOD, assessing any challenges DOD faces addressing certain foreign investments in critical and emerging technologies through the CFIUS process, and considering whether additional authority is needed, would better position DOD to address any unresolved national security concerns associated with these types of foreign investments. Without such an assessment, DOD remains at risk of not having the necessary tools and authorities to prevent the transfer of critical and emerging technologies to foreign acquirers, which is important for maintaining a viable defense industrial base and U.S. technological superiority. Some Foreign Investments Not Addressed through CFIUS Process Pose Proximity Concerns near Critical Military Locations Some proximity concerns near critical military locations can be addressed by CFIUS, but DOD also identified challenges addressing proximity concerns with investments that are not able to be addressed through the CFIUS process. For example, the establishment of businesses (which may include land purchases) in the United States that do not include an existing U.S. business—referred to as greenfield investments—are not considered covered transactions, but can pose proximity concerns when near certain military locations. Officials at MIBP and several other components expressed concerns with their inability to address proximity concerns arising from these investments, which can pose significant national security risks and limit DOD’s ability to perform necessary test and training activities. We identified at least two greenfield investments that have occurred since 2016 that have posed proximity concerns near critical military locations, and were not able to be addressed through the CFIUS process. One investment involving a purchase of land presented risks due to its proximity to an Air Force base. According to DOD’s Report to Congress 2017 Sustainable Ranges, the investment involved a U.S. company with substantial foreign financing, potentially subjecting training range missions performed at the base to persistent monitoring by a foreign government. According to officials, although the Air Force identified concerns with the investment, because it did not result in foreign control of a U.S. business, it was determined to not be a covered transaction. Officials from another military department identified an investment that was not voluntarily filed with CFIUS and posed proximity issues near a training range. According to military department officials, the investment involved the same foreign acquirer that had been a source of concern in other voluntarily filed CFIUS transactions. The military department elevated its concerns to CFIUS through the non-notified process, but, according to officials, Treasury ultimately determined that it was not a covered transaction because there was no foreign control over a U.S. business. Moreover, because the investment was already completed, the company had started construction that threatened to encroach upon a training range that is one of only two in the country available to perform certain types of training. Military department officials said it was too soon to determine the effect that this investment would have on their ability to perform training, but emphasized the criticality of protecting unique testing and training range spaces. Our prior work on defense training ranges also identified limitations DOD faces in addressing proximity and encroachment concerns from foreign investment. For example, we found in 2014 that officials from the Navy and Air Force, in particular, had concerns about the number of investment-related projects by foreign entities near their ranges (such as leases for mining or oil or natural gas exploration), which could pose potential security risks. However, we reported that DOD does not have access to the information needed to determine whether foreign investment activities near testing and training ranges pose a threat because other civilian federal agencies, such as the Departments of Interior and Transportation, that are responsible for approving these transactions face legal, regulatory, or resource challenges that prevent them from collecting information unrelated to their missions. We found that, although DOD has had some success obtaining information on foreign investment near test and training ranges, these efforts have been based on informal coordination between military liaisons at certain bases and local Department of Interior representatives. In addition to our recommendation that DOD develop and implement guidance for assessing risks to certain test and training ranges from foreign encroachment, we recommended that DOD collaborate with these other federal agencies to gather additional information needed for transactions in proximity to DOD test and training ranges, and seek legislative relief if needed. DOD concurred with our recommendations and has taken some steps to address them. For example, as noted earlier, DOD is in the process of developing guidance to assess risks to test and training ranges based on its identification of locations it considers to be at risk from foreign encroachment. According to DOD officials, they have also drafted legislative proposals to address limitations to their ability to gather information from the land management agencies on foreign investments in proximity to critical military locations. According to DOD officials, these proposals have not been submitted to Congress due to concerns raised by the federal land management agencies, but DOD continues to explore the possibility of legislative action to address these concerns. We also reported that DOD uses multiple methods, in coordination with other federal agencies, to identify potential business activities near DOD test and training ranges. But CFIUS is the only formal option in regard to transactions involving foreign companies or entities that accounts for national security concerns. A 2015 DOD report to Congress on security risks related to foreign investment in the United States found that there are no authorities in the current federal land management framework that would require federal land management agencies to prevent a transaction from occurring if DOD identified a national security concern. The report further states that CFIUS and the Foreign Investment and National Security Act of 2007 are the only federal authorities available to DOD to assess national security risks posed by foreign investment in the vicinity of critical military locations, like DOD training and test ranges, but that the CFIUS process is not intended to address such national security risks. While CFIUS is able to address proximity concerns that arise through covered transactions, DOD has reported that it has limited ability to identify, assess, and mitigate national security concerns for investments that are not considered covered transactions through CFIUS, such as greenfield investments. However, DOD’s report does not identify, assess, or make recommendations about what additional DOD authority, if any, would be necessary to address these concerns, and as noted earlier, DOD’s efforts to develop and implement guidance based on its identification of locations that they consider to be at risk from foreign encroachment are still in progress. According to federal internal control standards, agencies should establish policies and procedures to respond to risks; and identify, analyze, and respond to significant changes that could affect their operations. DOD is in the process of identifying locations it considers to be at risk from foreign encroachment, which can eventually be used to inform its review of foreign investments for proximity concerns, but DOD states that it is currently unable to address concerns related to greenfield investments through the CFIUS process because they are not considered covered transactions. Moreover, DOD reported that CFIUS is not a DOD-led process, and DOD is just one of nine member agencies. Members of Congress have recently proposed legislation that would expand the definition of covered transactions to include foreign acquisitions or leases of real estate in proximity to U.S. military locations, but the legislation is pending. Taking additional steps to assess what authority, if any, is needed to address foreign investment in proximity to certain critical military locations and raising these concerns to Congress, as necessary, would better position DOD to address its concerns. Until DOD completes efforts to develop and implement guidance assessing risks to critical locations that should be protected from foreign encroachment, and assesses what authority, if any, is necessary to independently address concerns with investments near these areas, it remains at risk of not protecting these locations from the national security risks posed by foreign adversaries. Detailed Location Information Not Included in Notices Submitted to CFIUS Detailed location information is not always included in notices submitted to CFIUS, which can affect DOD’s ability to review transactions for their proximity to critical military locations. Some CFIUS transactions can involve numerous properties or locations, and information on the geographic coordinates of these locations is used by MIBP and the components when determining if there could be national security concerns with a transaction. Specific details on the use of geographic coordinates to identify whether a transaction may pose proximity concerns near critical military locations have been omitted because the information is sensitive. According to Treasury officials, DOD often requests geographic coordinates once a notice is submitted, and Treasury officials said they have attempted to gather more detailed location information as part of notices. However, officials at one military department said that while there have been improvements in the availability of this information in notices, there are still some companies that do not include the geographic coordinate information. Treasury officials stated that CFIUS has the authority to require this information from companies and has considered revising its regulations to require this information. However, Treasury has not yet done so. Federal internal control standards state that agencies should establish policies and procedures to respond to risk and use quality information to achieve its objectives. Requiring information on geographic coordinates for all target locations in notices submitted to CFIUS will improve DOD’s ability to more efficiently identify and address proximity concerns with covered transactions. DOD Has Not Updated Policy to Reflect Changes in Components’ Review Responsibilities and Processes DOD’s Instruction identifies CFIUS-related responsibilities and processes for reviewing transactions, but that policy has not been updated to reflect current component reviewer roles and responsibilities or processes for addressing non-notified transactions that may pose national security concerns for the department. The current DOD Instruction was issued in 2010—prior to the transfer of CFIUS responsibilities from the Defense Technology Security Administration to MIBP—but has not been updated to reflect the change. Moreover, the Instruction includes a list of the types of information components should provide to request a non-notified transaction be submitted to CFIUS for further action but has no guidance or expectations for whether or how components should identify and research them. In addition to DOD’s Instruction, which is the guiding policy for DOD’s CFIUS procedures, in June 2016, MIBP developed an internal process document describing its process for reviewing CFIUS transactions; developing and monitoring mitigation agreements; and identifying and reviewing non-notified transactions. While MIBP officials said the process document is based on the DOD Instruction and is more up-to-date, it is intended to be an internal reference document for MIBP employees and contractors, and it has not been distributed more broadly to the components involved in reviewing transactions for CFIUS. Moreover, the DOD Instruction does not reflect the department’s responsibilities for reviewing transactions. For example, MIBP’s internal process document identifies advisory and primary reviewers who are responsible for providing inputs on transactions. However, based on our review of the DOD Instruction, advisory and primary component responsibilities are not differentiated, and several of the advisory reviewers that are identified in MIBP’s internal process document are not listed as reviewers in the current Instruction. For example, according to DOD documentation and officials, the Assistant Secretary of Defense for Research and Engineering is an advisory reviewer for CFIUS cases and coordinates input from several other reviewers—including the Defense MicroElectronics Activity and Defense Advanced Research Projects Agency—to determine if a transaction involves a critical technology. However, the Assistant Secretary of Defense for Research and Engineering’s responsibilities for coordinating these inputs are not identified in the current DOD Instruction, nor is this office listed as a reviewer. Our review of DOD’s Instruction, internal guidance, and other documentation identified several other discrepancies between component responsibilities identified in the Instruction and what is occurring in practice. For example, the Under Secretary of Defense for Personnel and Readiness, among other things, coordinates with OUSD (AT&L) and the Director of Operational Test and Evaluation on the effects of encroachment on DOD test and training areas. While MIBP officials identified the Office of the Under Secretary of Defense for Personnel and Readiness as a CFIUS reviewer, this office is not identified as a reviewer in the DOD Instruction or internal MIBP process document. In addition to not having up-to-date information on reviewer roles and responsibilities, the DOD Instruction does not include guidance on how MIBP and the components should identify and research non-notified transactions that may pose national security concerns. As discussed above, because the CFIUS process is based on voluntary notices submitted by parties to transactions, DOD and Treasury officials stated that it is important to monitor foreign acquisitions of U.S. companies that are not filed with CFIUS to determine if any may present national security concerns. As shown in figure 4, there were approximately 1,680 mergers and acquisitions involving foreign acquisitions of U.S. companies in 2016. While not all foreign acquisitions of U.S companies pose national security concerns that would warrant them being reviewed by CFIUS, DOD officials acknowledged challenges with their ability to identify and research these transactions. Specific details on the challenges DOD faces identifying non-notified transactions have been omitted because the information is considered sensitive. In addition to challenges identifying non-notified transactions within MIBP, DOD component reviewers’ awareness of the non-notified transaction process varied across the components that we spoke with, and participation in this part of the process is ad hoc. For example, five of the nine components in our sample said they do not have processes in place to identify transactions that have not been voluntarily filed but present risks to national security that could warrant CFIUS review. Officials from four components we spoke with said they have identified non-notified transactions. However, officials from most other DOD components told us they either are not involved or occasionally review non-notified transactions once MIBP identifies them, and they do not proactively perform non-notified transaction research, in part due to resource constraints. Officials from some components were also uncertain about whether they should elevate some non-notified transactions of concern. For example, DOD’s Instruction does not explain when, pursuant to CFIUS regulations, joint ventures are covered transactions. It also does not explain that, even if a non-notified transaction has been completed—meaning a foreign acquirer has already finalized the purchase of a U.S. company—CFIUS can still recommend that the President suspend or prohibit the transaction. Officials from two components said that they are aware of completed joint ventures or other transactions that were of concern but not voluntarily filed, and that they did not elevate them. According to these officials, they assumed the joint ventures would not be covered or that there was nothing CFIUS could do to address their concerns. In May 2017, the MIBP official responsible for non-notified transactions began a DOD pilot working group for researching non-notified transactions. According to the official, the working group is intended to leverage component reviewer resources and involve them in performing research on non-notified transactions identified by MIBP. However, as of June 2017, participation in the group was limited to 5 of the more than 30 DOD component reviewers, and its processes for reviewing and distributing transactions are still evolving. While this action represents a positive step towards establishing and formalizing efforts to identify non- notified transactions, MIBP officials expressed concern that their ability to identify transactions that may pose risks is not as developed as they would like it to be. Specific details on MIBP’s ability to identify transactions that may pose risks have been omitted because the information is considered sensitive. In contrast to DOD’s limited non-notified guidance, the Department of Homeland Security, another member agency of CFIUS, has guidance for reviewing non-notified transactions in its Instruction for Department of Homeland Security Participation in the Committee on Foreign Investment in the United States. According to the Instruction, each week a digest of non-notified transactions is to be sent to Department of Homeland Security components for review, and selected components are required to provide any concerns with the transaction within 7 days. The Department of Homeland Security then determines whether to prepare a non-notified request to forward the transaction on to CFIUS so that the committee can determine whether the transaction merits further action. Federal internal control standards state that agencies should identify and document agency responsibilities and processes in policy, and periodically review and update policies based on changes. According to MIBP officials, they have been revising DOD’s Instruction for over 3 years, and recently began the formal department-wide review process. MIBP officials said they had not released updated guidance to reflect changes in responsibilities and processes sooner because of challenges with employee attrition and leadership changes, which have resulted in multiple rewrites. However, several components we spoke with referenced the need for updated or standardized guidance to inform their CFIUS review responsibilities and the development of their own component-level guidance. It has been over 5 years since MIBP was assigned responsibility for CFIUS, raising questions about the prioritization of CFIUS within the department. Without clear and updated guidance on reviewer responsibilities and established processes and guidance on the identification and review of non-notified transactions, DOD is at risk of inconsistencies in its review of transactions, and it may be unable to address non-notified transactions that pose national security concerns in a timely and efficient manner. DOD Faces Several Challenges Developing and Monitoring CFIUS Mitigation Agreements As noted above, mitigation agreements address any threats to national security posed by a transaction. DOD is responsible for most of the CFIUS mitigation agreements, but faces a variety of challenges when taking action to mitigate national security concerns and ensure the effectiveness of the agreements. These challenges relate to insufficient personnel resources compared to MIBP’s workload, and unclear communication about the delineation of responsibilities between MIBP and the DOD components. Moreover, DOD has not reported to Congress on its responsibilities for monitoring and enforcing mitigation agreements. DOD Is Responsible for Most CFIUS Mitigation Agreements DOD is responsible for more mitigation agreements than other CFIUS member agencies, monitoring 84 of the total of 141 mitigation agreements for CFIUS, or about 60 percent as of the end of calendar year 2017. DOD’s responsibility for mitigation agreements more than doubled between 2012 and 2017. Figure 5 shows how DOD’s CFIUS mitigation agreement-related responsibilities have increased since 2000. We reviewed Treasury data on transactions from January 2015 through December 2016 to identify the types of national security concerns DOD mitigated through the CFIUS process. We found that the 22 mitigation agreements implemented by DOD during this period included acquisitions of U.S. companies in the aerospace, energy, real estate, and information technology industries, among others. Seventeen of these agreements were implemented to address either supply assurance—DOD’s access to certain products or services—or proximity issues. Based on the Committee on Foreign Investment in the United States Annual Report to Congress for Calendar Year 2015 and our review of DOD documentation, the mitigation measures that have been negotiated and adopted since 2015 may require the parties to the transaction to take actions such as: Ensuring that only authorized persons have access to certain technology and information; Appointing a U.S. government approved security officer; Providing annual reports and independent audits; Notifying security officers or relevant U.S. government parties in advance of foreign national visits to the U.S. business for approval; Providing written notification when additional assets are purchased; Providing written notification and obtaining CFIUS approval of other parties joining the joint venture; and Requiring supply assurance for products or services being provided to the government. Based on our review of a non-generalizable sample of nine mitigation agreements provided by one of the DOD component reviewers, mitigation agreements typically have more than one measure. For example, there were between 4 and 10 different measures in each agreement we reviewed, and in one agreement, one measure required the submission of more than 100 reports. While some of the mitigation measures require the parties to the agreement to take action and report to DOD, MIBP also monitors and enforces compliance with mitigation measures by conducting on-site compliance reviews and investigations if violations are discovered. If a company violates a mitigation agreement, CFIUS has the authority to impose penalties, although, according to Treasury and DOD officials, the committee has not taken action to enforce penalties for non-compliance with a mitigation agreement. CFIUS regulations state that any person who intentionally or through gross negligence violates a material provision of a mitigation agreement may be liable for a civil penalty not to exceed $250,000 per violation or the value of the transaction, whichever is greater. DOD officials and the Deputy Assistant Secretary for Investment Security at Treasury stated that the regulatory standard regarding taking action against a company that has violated a mitigation agreement is high. They noted it is difficult to prove that a company violated a mitigation agreement intentionally or through gross negligence, and that the national security effect may exist even if the cause of the violation is ordinary negligence. In October 2017, MIBP officials reported six instances since 2013 where companies were not in compliance with their mitigation agreements, but stated that none of these instances were the result of intentional or grossly negligent actions. They told us that DOD has not recommended that CFIUS take action to impose penalties in these cases. In general, according to Treasury and MIBP officials, CFIUS member agencies work with companies to establish a culture of compliance and correct violations of the mitigation agreements as opposed to imposing fines or penalties. DOD Faces Challenges in Developing and Monitoring CFIUS Mitigation Agreements MIBP and the DOD components face a variety of challenges, to include developing and monitoring mitigation agreements as a result of limited personnel resources compared to an increasing workload; and communicating about mitigation agreement responsibilities between DOD and the components. Some of the specific details on personnel resource challenges and communication between MIBP and the components have been omitted because the information is sensitive. In addition to resource challenges within MIBP, resources for mitigation agreement-related activities within the DOD components are also limited and can vary. Officials from at least one component stated that they are not involved in developing or monitoring mitigation agreements because they do not have the resources to do so. Further, citing concerns with DOD’s ability to effectively oversee mitigation agreements, officials from three DOD components stated that DOD should recommend prohibiting transactions more often than imposing mitigation agreements. For example, an official from one DOD component with CFIUS responsibilities stated that it is not plausible that these agreements can be properly executed because adversaries have the resources to conceal the fact that they are not complying with the mitigation agreement. Officials from another DOD component also expressed concerns with mitigation agreement enforcement, and stated that they were likely to recommend prohibiting transactions in the future instead of negotiating mitigation agreements in transactions where a national security risk has been identified. A June 2017 DOD report on technology transfer and emerging technology found that given concerns about the cost and effectiveness of mitigation agreements, if the mitigation agreements cannot be simple, CFIUS should recommend that the President suspend or prohibit the transaction. Similarly, officials at the Navy stated that mitigation measures are more effective if they can be fully implemented before the transaction is closed, as opposed to those that require ongoing monitoring. MIBP officials stated that if resource shortfalls continue, they run the risk of having to recommend that the President prohibit transactions because they are unable to implement or monitor additional mitigation agreements. To bolster available DOD resources for monitoring mitigation agreements, MIBP is in the process of expanding on a case-by-case basis its use of third-party monitors—private auditing and consulting firms approved by DOD and CFIUS but paid for by the foreign acquirer. In these instances, the acquirer is responsible for contracting with qualified third-party independent monitors, which MIBP officials stated they believe could result in cost savings to the government by reducing the resources it uses to respond to routine notifications and requests for approval. MIBP officials stated that this concept would allow MIBP to better extend control over the range of agreements by focusing on monitoring the third-party monitors. However, these officials also acknowledged that the use of third-party monitors can present an inherent conflict of interest by having foreign acquirers funding their own compliance and mitigation agreement monitoring. It is too soon to assess the effect of the expansion of third- party monitoring on improving MIBP’s ability to oversee compliance with mitigation agreements. In addition, we found that MIBP has not clearly communicated expectations and responsibilities for developing and monitoring mitigation agreements to some DOD components. This has led to confusion about what is expected of the components during this part of the process and raised uncertainty within the components we met with about the effectiveness of the mitigation agreements. For example, DOD’s Instruction requires components to identify, as applicable, mitigation agreement measures as part of their risk-based analysis and participate in monitoring the mitigation agreements in instances when they have identified a risk. However, officials from several DOD components said that they either do not include mitigation measures in their risk-based analysis or have been asked not to by MIBP. According to Treasury officials, the CFIUS process has been updated and the proposal of mitigation measures can occur before or during the development of an agency’s risk-based analysis, but this information is not reflected in DOD’s Instruction, and DOD officials could not identify whether or how this change in process had been communicated to the components. In addition, officials at one DOD component cited examples of unclear communication regarding their responsibilities for mitigation agreement documentation. For example, these officials told us they requested, but did not receive, documentation from MIBP to ensure compliance with four of the nine mitigation agreements it is responsible for monitoring. According to documentation from this component, it had not received approximately 110 of 133 documents and other reporting requirements that were necessary to determine whether the company was in compliance with the mitigation agreement. According to MIBP officials, they had received the required documentation from the company but did not share it with the component because they were not related to the mitigation agreement measures that the component was responsible for monitoring. As a result of this miscommunication, the component thought that it was responsible for reviewing the missing documentation. MIBP officials stated that they plan to expand and improve their capability to provide DOD components access to the necessary documentation in the future. Officials from MIBP and the component said MIBP currently maintains a shared drive where it stores mitigation agreement documentation, but not all components have access to this documentation. Additionally, while DOD’s Instruction states that DOD components that propose mitigation measures should participate in overseeing those measures, two of the nine components in our sample reported being actively involved in ensuring compliance with mitigation agreements or performing site visits. Two components have allocated several full-time personnel to the task and another has guidance that directs its involvement in CFIUS mitigation agreement monitoring. For example, Navy officials said they have established an office to review transactions that may pose proximity-related risks and monitor proximity-related mitigation agreements, but they have not been given the authority by MIBP to make a final determination regarding whether parties are in compliance with the agreements or to participate in all discussions with the parties. MIBP officials stated that they seek component input on all mitigation agreements, but that MIBP has taken the lead in developing and monitoring DOD mitigation agreements and ensuring compliance because the DOD components have not historically had the resources to dedicate to this responsibility. DOD’s Instruction identifies oversight and communication mechanisms that have not been implemented, but could assist the department in addressing challenges monitoring and ensuring compliance with its CFIUS mitigation agreements. For example, DOD’s Instruction establishes a CFIUS Monitoring Committee, made up of relevant DOD component reviewers, to serve as the focal point for DOD monitoring. Among other things, the CFIUS Monitoring Committee was intended to meet quarterly. DOD’s Instruction also calls for the development of a DOD CFIUS Strategic Mitigation Plan to include things such as: identification of strategic policy for mitigation and monitoring efforts, taking into account resource management and filing trends; identification of methods to substantiate and document company compliance with mitigation agreements and maintain records of that compliance; and annual analysis of past mitigation in order to determine if past approaches to monitoring and mitigation can be improved. However, according to MIBP officials, the CFIUS Monitoring Committee and the Strategic Mitigation Plan were not implemented because MIBP did not have the resources to do so. MIBP officials also said they did not see the establishment of the CFIUS Monitoring Committee with relevant DOD components as necessary because MIBP has taken primary responsibility for monitoring mitigation agreements. In addition to not implementing these oversight and communication mechanisms, MIBP has not updated DOD’s Instruction to account for policies that are no longer practiced, such as requiring proposed mitigation measures as part of the risk-based analysis, or having components take responsibility for monitoring the mitigation measures they recommend. According to federal internal control standards, to achieve an entity’s objectives, management assigns responsibility and delegates authority to key roles throughout the entity. In addition, management should internally communicate the necessary quality information to achieve the entity’s objectives. Updated and improved guidance, including communication about MIBP’s management of mitigation agreements and component involvement in developing and monitoring them, could help provide additional oversight of DOD’s mitigation agreements and address resource challenges associated with an increasing workload. DOD Has Not Reported on Review of Mitigation Agreement Monitoring Responsibilities DOD has not reported its findings to Congress on a review regarding monitoring and enforcing mitigation agreements. A 2013 House Report asked the Secretary of Defense to review the role of the Deputy Assistant Secretary of MIBP in monitoring CFIUS mitigation agreements in which DOD was the lead or co-lead and determine if the Defense Security Service is suited to perform these functions, and report the findings. The House Armed Services Committee noted concerns over whether MIBP, as a policy organization, has the resources and technical expertise to provide reasonable oversight of implementation and compliance with mitigation agreements. The House Report stated that DOD may benefit from leveraging the capabilities of the Defense Security Service, which already reviews every CFIUS filing on behalf of the National Industrial Security Program, and monitors compliance with its own mitigation agreements as part of that program. DOD was to report on the findings on the review in 2013, but, according to MIBP officials, it has been delayed because disagreement exists within DOD regarding where responsibility for monitoring mitigation agreements should reside. Both MIBP and Defense Security Service officials we spoke with said that their office is the best equipped to perform CFIUS mitigation agreement responsibilities. As a result, formal coordination of the department’s response has not been completed. As of January 2018, MIBP officials said that while they recognize the need to complete the response, DOD has not committed to a specific time frame for the response. Reporting the findings to the congressional defense committees will facilitate the identification of current challenges related to CFIUS mitigation agreement oversight, and could address questions about the capabilities and responsibilities necessary to effectively monitor and enforce CFIUS mitigation agreements. Conclusions Growing foreign direct investment in the United States provides important economic benefits, but can also pose national security risks when that investment comes from potential adversaries. Ensuring that DOD has the resources, processes, and information necessary to perform its responsibilities under CFIUS is essential at a time when the number and complexity of transactions being reviewed by CFIUS has grown significantly. According to officials, the types of investments that pose risks have evolved, making questions about foreign control difficult to determine and mitigate, including investments involving important emerging technologies or real estate purchases in close proximity to sensitive military locations. In light of these issues, assessing CFIUS resource requirements across the department, completing efforts to identify and communicate critical national security concerns, assessing whether DOD has the necessary authority to address these concerns, and ensuring its policies and practices reflect current DOD component reviewers and processes will be essential to DOD’s ability to address the evolving risks it faces from foreign investment. For national security concerns that DOD determines it does not have the authority to address, it may be necessary for DOD to seek legislative action. Further, without updating DOD’s CFIUS guidance to reflect current requirements and reporting on reviews requested by a committee of Congress on the department’s responsibilities for monitoring mitigation agreements, DOD will likely continue to face challenges facilitating intra-departmental communication and questions about the prioritization of CFIUS within DOD. Recommendations for Executive Action We are making a total of eight recommendations: four to the Secretary of Defense, three to the Deputy Assistant Secretary of Defense for MIBP, and one to the Secretary of the Treasury. Specifically: The Secretary of Defense should assess CFIUS resource requirements within MIBP and DOD component reviewers in light of increasing workload, and prioritize personnel and funding resources accordingly to review, mitigate, and monitor transactions that are of concern to the department. (Recommendation 1) The Secretary of Defense, in coordination with the Deputy Assistant Secretary of Defense for MIBP and Office of the Under Secretary of Defense, Personnel and Readiness, should incorporate the results of its efforts to identify, assess, and prioritize national security concerns related to foreign investment in emerging technologies and in proximity to certain critical military locations, into DOD Instruction 2000.25 and communicate the results to DOD component reviewers. (Recommendation 2) Following the completion of its emerging technology study, the Deputy Assistant Secretary of Defense for MIBP should assess what additional authorities may be necessary to address risks related to foreign investment in critical and emerging technologies, and seek legislative action to address risks posed by these investments as appropriate. (Recommendation 3) Following the department’s efforts to identify critical locations and develop and implement guidance assessing risks to these locations from foreign encroachment, the Secretary of Defense should assess what additional authorities, if any, may be necessary to address national security risks from foreign investments in proximity to these locations, and seek legislative action as appropriate. (Recommendation 4) The Secretary of the Treasury should provide clarification to parties filing a notice of a transaction with CFIUS that for filings involving multiple locations, geographic coordinates are required to be part of the notification. (Recommendation 5) The Deputy Assistant Secretary of Defense for MIBP should update DOD Instruction 2000.25, to include additional guidance and clarification regarding DOD component responsibilities during the CFIUS process and DOD processes for identifying non-notified transactions. (Recommendation 6) The Deputy Assistant Secretary of Defense for MIBP should update and implement requirements identified in DOD Instruction 2000.25 regarding management and oversight of mitigation agreements, such as taking into account the resources needed to effectively monitor agreements, improving communication methods between MIBP and the DOD components, and clarifying component responsibilities in developing and monitoring mitigation agreements. (Recommendation 7) The Secretary of Defense should submit the response to the House Report reviewing the role of the Deputy Assistant Secretary of Defense for MIBP in monitoring CFIUS mitigation agreements, and determining if the Defense Security Service is suited to perform these functions. (Recommendation 8) Agency Comments and Our Evaluation DOD and Treasury provided written comments on a draft of the sensitive report. These comments are reprinted in appendixes IV and V, respectively. We also received technical comments from both agencies, which we incorporated as appropriate. Both departments concurred with our recommendations. In its written comments, DOD agreed to use a recent assessment of CFIUS resource needs to inform its upcoming budget requests. We acknowledge MIBP’s recent efforts to identify and prioritize resource needs in support of its CFIUS responsibilities. As DOD develops its budget request, we encourage the department to consider increases in DOD’s CFIUS workload and the resources required to support essential CFIUS functions, like monitoring mitigation agreements and identifying non-notified transactions that may pose national security risks. DOD also agreed to update its guidance related to CFIUS procedures and responsibilities, and complete assessments about additional authorities the department may need to address national security concerns related to foreign investments in U.S. companies developing critical and emerging technologies or in proximity to critical military locations. In its comments, DOD stated it has identified over 40 critical military locations and expects to develop guidance for assessing the risks posed by foreign investments in proximity to these locations. DOD also agreed to complete its response to the House Report reviewing MIBP’s role in monitoring CFIUS mitigation agreements. In its comments, DOD stated it is continuing to explore the implementation of third-party monitors as an alternative solution for monitoring CFIUS mitigation agreements. In its written comments, Treasury concurred with our recommendation to provide clarification that parties filing a notice with CFIUS should include geographic coordinates as part of their notice. Treasury has updated information on its website to clarify that addresses and/or geographic coordinates are required for a CFIUS filing to be considered complete. We are sending copies of this report to the appropriate congressional committees, the Secretary of Defense, the Deputy Assistant Secretary of Defense for MIBP, and the Secretary of the Treasury. In addition, the report is available at no charge on the GAO website at http://www.gao.gov. If you or your staff have any questions about this report, please contact me at (202) 512-4841 or makm@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix VI. Appendix I: Department of Defense (DOD) Offices and Organizations with Committee on Foreign Investment in the Unites States (CFIUS) Review Responsibilities Appendix II: Objectives, Scope and Methodology This report assesses factors, if any, that affect the Department of Defense’s (DOD) ability to (1) identify and address national security concerns through the Committee on Foreign Investment in the United States (CFIUS) process, and (2) develop and monitor mitigation agreements through the CFIUS process. This report is a public version of a sensitive report that we issued on April 5, 2018. DOD and the Department of the Treasury (Treasury) deemed some of the information in our April report to be sensitive, which must be protected from public disclosure. Therefore, this report omits sensitive information related to (1) DOD’s resources to perform certain CFIUS functions, like monitoring mitigation agreements and identifying non- notified transactions; (2) the availability of location information as part of notices that companies file with CFIUS; and (3) the resources and communication required between DOD and the components to develop and monitor mitigation agreements through the CFIUS process. Although the information provided in this report is more limited, this report addresses the same objectives and uses the same methodology as the sensitive report. To assess what factors, if any, affect DOD’s ability to identify and address national security concerns through the CFIUS process, we reviewed relevant documentation, including: CFIUS-related laws and Department of the Treasury (Treasury) regulations; DOD policies and guidance; and DOD and CFIUS internal reports to identify DOD’s responsibilities and processes for identifying and addressing national security concerns through the CFIUS process. While there are other authorities, including export controls such as the International Traffic in Arms Regulations and Export Administration Regulations, which in certain circumstances may be used to address national security concerns that arise through foreign investment, our review focused on the DOD’s responsibilities addressing national security concerns through the CFIUS process. To assess DOD’s efforts to identify and address national security concerns it identified, we gathered and analyzed data on transactions that DOD was responsible for co-leading from January 1, 2012, through December 31, 2017, the most recent data available. To identify resources dedicated to supporting CFIUS activities within the Office of Manufacturing and Industrial Base Policy (MIBP)—the DOD office responsible for coordinating the CFIUS process on behalf of DOD—we analyzed MIBP data from 2012 through 2017 on DOD personnel resources, and reviewed budget amounts from 2012 through 2016 for DOD CFIUS activities from DOD budget documents. To identify the outcomes of transactions not voluntarily filed with CFIUS—known as non-notified transactions—we gathered and analyzed data on the number of non-notified transactions MIBP has identified and researched since the beginning of fiscal year 2016, when they started formally tracking that information. Based on information on the collection and management of Treasury and DOD transaction data, our review of related documentation, and interviews with relevant Treasury and DOD officials, we determined that these data were sufficiently reliable for the purposes of this report. To identify challenges DOD faces addressing certain national security concerns, such as protecting emerging and critical technology and foreign investments in proximity to certain critical military locations, we reviewed a non- generalizable sample of CFIUS case file information for seven transactions. We selected these transactions based on examples identified by DOD components, and the types of national security concerns, including those related to emerging technology and proximity, that DOD officials identified throughout the review. We interviewed officials at Treasury, MIBP, and selected DOD component reviewers to discuss DOD’s CFIUS workload and resources. In this report, we define resources as the authorized positions, assigned personnel, personnel performing contract services related to CFIUS functions, and CFIUS- related costs. We also discussed with these officials any limitations to addressing certain national security concerns—like protecting emerging technology and foreign investment in proximity to critical military locations—through CFIUS, and guidance for the CFIUS process and identifying non-notified transactions. Additional information on the DOD components included in this review can be found below. To identify calendar year 2016 mergers and acquisitions involving U.S. businesses, and the proportion of those mergers and acquisitions involving foreign acquirers, we reviewed data available from the Bloomberg Terminal, which is a commercial database containing data on mergers and acquisitions. We gathered data on total 2016 mergers and acquisitions involving U.S. companies that were announced, pending, or completed. We also gathered data on 2016 mergers and acquisitions that were announced, pending, or completed involving U.S. companies and foreign acquirers to illustrate the number of potentially covered transactions that may not be voluntarily notified to CFIUS. We assessed the reliability of these data by reviewing relevant documentation and ensuring the data gathered aligned with the search criteria identified. We determined the data were sufficiently reliable for our purposes of displaying total U.S. mergers and acquisitions and the proportion of those transactions that involve foreign acquirers and thus could be potentially covered transactions by CFIUS. To assess what factors, if any, affect DOD’s ability to develop and monitor mitigation agreements through the CFIUS process, we reviewed CFIUS- related laws and regulations and DOD policies and guidance to identify DOD and its component reviewers’ responsibilities and processes for developing and monitoring compliance with mitigation agreements. We also reviewed the Committee on Foreign Investment in the United States Annual Report to Congress for Calendar Years 2014 and 2015. To identify actions DOD has taken to mitigate national security concerns, we analyzed data to identify the number of mitigation agreements DOD is responsible for and actions DOD has taken to mitigate and monitor transactions with national security concerns from January 1, 2012 through December 31, 2017, the most recent data available. Based on information on the collection and management of Treasury and DOD CFIUS mitigation agreement data, our review of related documentation, and interviews with relevant Treasury and DOD officials, we determined that these data were sufficiently reliable for the purposes of this report. We also reviewed executive summaries compiled by MIBP of the DOD-co-led transactions with mitigation agreements, as well as selected CFIUS case file documentation for seven transactions. We interviewed officials at Treasury, MIBP, and DOD component reviewers to identify any challenges they face developing and enforcing mitigation agreements. To provide illustrative examples of the types of measures included in CFIUS mitigation agreements, we reviewed all of the active mitigation agreements from one component with responsibilities for monitoring mitigation agreements involving proximity issues. These agreements are not generalizable to other components. To gather a range of views on issues related to both objectives, we selected a non-generalizable sample of nine DOD component reviewers responsible for identifying, reviewing, and investigating transactions. These components included officials from: the Departments of the Army, Air Force, and Navy; the DOD Chief Information Officer, the Defense Information Systems Agency; the Defense MicroElectronics Activity; the Defense Advanced Research Projects Agency; the National Security Agency; and the Office of Manufacturing and Industrial Base Policy, Industrial Base Assessments. Our selection was based primarily on these components’ responsibilities for reviewing and investigating transactions for key issues DOD identified as relevant to its review of transactions, including risks related to emerging technology and proximity risks. We also solicited MIBP’s recommendations to identify components with varying levels of participation and input into the CFIUS process. We interviewed all nine components and in some cases also received written responses from them to identify similarities and differences in their processes, any challenges they face identifying and addressing national security concerns through CFIUS, and their involvement and any challenges they face developing or monitoring mitigation agreements. Findings based on information collected from the nine components cannot be generalized to all DOD components. In addition to the components included in our sample, we also interviewed and received documentation from other DOD organizations about the CFIUS process. These organizations included officials from: the Defense Innovation Unit Experimental; the Defense Security Service; the Defense Technology Security Administration; the Assistant Secretary of Defense for Research and Engineering; and the Office of the Under Secretary of Defense for Intelligence. We do not include information gathered from these other components in statements based on our non-generalizable sample. The performance audit upon which this report is based was conducted from January 2017 to April 2018 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. We subsequently worked with DOD and Treasury from April 2018 to July 2018 to prepare this unclassified version of the original sensitive report for public release. This public version was also prepared in accordance with these standards. Appendix III: Factors the Committee on Foreign Investment in the United States Considers to Determine Whether Submitted Transactions Pose a National Security Risk Appendix IV: Comments from the Department of Defense Appendix V: Comments from the Department of the Treasury Appendix VI: GAO Contact and Staff Acknowledgments GAO Contact Staff Acknowledgments In addition to the contact names above, W. William Russell (Assistant Director), Katherine Trimble (Assistant Director), Meghan Perez (Analyst- in-Charge), and Heather B. Miller were principal contributors to this report. In addition, the following people made contributions to this report: Justin Fisher, Stephanie Gustafson, Kate Lenane, Alyssa Weir, and Robin Wilson.
target: Foreign acquisitions of U.S. companies can pose challenges for the U.S. government as it balances the economic benefits of foreign direct investment with the need to protect national security. CFIUS is an interagency group, led by Treasury, that reviews certain transactions—foreign acquisitions or mergers of U.S. businesses—to determine their effect on U.S. national security and whether the transaction may proceed. GAO was asked to review DOD's ability, as a member of CFIUS, to address defense issues. This report assesses factors, if any, that affect DOD's ability to identify and address national security concerns through the CFIUS process, among other objectives. GAO analyzed data on DOD co-led transactions from January 2012 through December 2017, the most recent data available. GAO also interviewed DOD and Treasury officials and reviewed documentation to identify DOD's CFIUS processes, resources, and responsibilities and selected a non-generalizable sample of nine DOD component reviewers, based on their participation in the CFIUS process. The Department of Defense (DOD) faces challenges identifying and addressing evolving national security concerns posed by some foreign investments in the United States. Resources: DOD's Office of Manufacturing and Industrial Base Policy represents the department and coordinates DOD's participation on the Committee on Foreign Investment in the United States (CFIUS). As a committee member, DOD co-leads CFIUS's review and investigation of transactions between foreign acquirers and U.S. businesses where it has expertise. DOD co-led 99 transactions in calendar year 2017, or 57 percent more transactions than it co-led in 2012, while the annual authorized positions increased from 12 to 17 during that same time period. DOD's workload has also been affected by the volume and complexity of the transactions it is responsible for co-leading, in addition to other CFIUS responsibilities, such as identifying transactions that foreign acquirers do not voluntarily file with CFIUS. DOD has taken some steps to address its resource limitations, but has not fully assessed the department-wide resources needed to address its growing workload. Emerging Technology and Proximity: DOD officials identified some investments that pose national security concerns from foreign acquirers gaining access to emerging technologies or being in close proximity to critical military locations, which, according to officials, cannot always be addressed through CFIUS because the investments would not result in foreign control of a U.S. business. DOD and Department of the Treasury (Treasury) officials said addressing these investments may require legislative action. DOD is taking steps to identify critical emerging technologies and military locations that should be protected from foreign investment. However, DOD has not fully assessed risks from these types of foreign investment or what additional authorities, if any, may be necessary for it to address them. Policy: DOD's CFIUS Instruction does not clearly identify some reviewer responsibilities or processes for identifying transactions that foreign acquirers do not voluntarily file with CFIUS. The policy is also outdated and inconsistent with current practices. DOD's CFIUS Instruction and federal internal control standards emphasize the importance of assessing organizational structures, policies, and procedures to respond to risks. Without assessing resources needed to address its CFIUS workload and risks from foreign investment in emerging technologies or in proximity to critical military locations, and ensuring its policies and processes clearly reflect the issues facing the department, DOD is at risk of being unable to respond to evolving national security concerns. This is a public version of a sensitive report that GAO issued in April 2018. Information that DOD and Treasury deemed sensitive has been omitted.