Critical Technologies: Agency Initiatives Address Some Weaknesses, but Additional Interagency Collaboration Is Needed
Published: 2015-02-10T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: Each year, the federal government spends billions of dollars to develop and acquire advanced technologies in order to maintain U.S. superiority in military technology. The U.S. government permits and facilitates the sale and transfer of its technologies to allies in order to promote U.S. national security, foreign policy, and economic interests. However, these technologies can be targets for theft, espionage, reverse engineering, illegal export, and other forms of unauthorized transfer. Accordingly, the U.S. government administers programs to identify and protect its critical technologies.
GAO (1) assessed the progress of the various agencies' efforts and identified implementation challenges, if any, to reform programs and processes to protect critical technologies; and (2) determined the extent to which cognizant agencies are coordinating with stakeholder agencies on their respective reform efforts to ensure effective collaboration. GAO reviewed laws, regulations, and guidance, as well as documentation of agency initiatives to reform programs that protect critical technologies and interviewed officials from lead and stakeholder agencies.
section_title: What GAO Found
paragraphs: The agencies responsible for eight programs designed to protect critical technologies have implemented several initiatives since 2007, but face some implementation challenges. Agencies have made progress addressing previously identified weaknesses in response to changes in law, GAO recommendations, or agencies' own internal identification of them. For instance, the area of export controls has seen significant action for reform, based on an April 2010 framework announced by the administration. Other programs, such as the Committee on Foreign Investment in the United States, have undergone reform through legislative requirements. As shown in the table below, multiple agencies have responsibility for these eight programs designed to protect critical technologies.
However, some of these eight programs have additional challenges that remain to be addressed. For example, the Department of Defense (DOD) has not yet completed an evaluation of the Militarily Critical Technologies List or potential alternatives in response to GAO recommendations regarding the need to determine the best approach for meeting users' requirements for a technical reference. Further, DOD and the Department of Homeland Security still need to take additional actions to improve shipment tracking and verification procedures of arms sales to foreign allies for the Foreign Military Sales program.
Both existing mechanisms and some new initiatives among the critical technologies programs support collaboration, but collaboration among lead and stakeholder agencies remains a challenge. GAO's September 2012 work on interagency collaboration mechanisms notes that many of the meaningful results the federal government seeks to achieve require the coordinated efforts of more than one federal agency. Recent initiatives have resulted in improved interagency collaboration. For example, DOD offices now communicate with non-DOD agencies through a formally instituted group to discuss potential technology transfers to foreign governments. However, current collaboration mechanisms do not involve direct communication among all the programs in the protection of critical technologies portfolio. Improved collaboration among the programs and agencies involved in the protection of critical technologies could help increase their efficiency and effectiveness.
section_title: What GAO Recommends
paragraphs: To ensure a consistent and collaborative approach to the protection of critical technologies, GAO recommends that agencies with lead and stakeholder responsibilities take steps to promote and strengthen collaboration mechanisms among their respective programs.

section_title: Letter
paragraphs: Technological superiority is critical to U.S. military and foreign policy  strategy. Each year, the Department of Defense (DOD) spends billions of  dollars to develop and acquire advanced technologies in order to maintain  U.S. superiority in military technology. The U.S. government permits and  facilitates the sale or transfer of technologies that have military  applications to allies, partners, and other foreign parties in order to  promote U.S. national security, foreign policy, and economic interests.  These technologies can be sold legitimately through U.S. government  programs or by U.S. companies or acquired through foreign investment in  U.S. companies. However, these technologies can also be targets for  forms of unauthorized transfer, such as theft, espionage, reverse  engineering, or illegal export. The U.S. government has established  various programs to identify critical technologies and how they should be  protected to ensure that they are provided to foreign entities only when  doing so is consistent with U.S. interests.
In reports over the past decade, we have identified risks and challenges  for the individual programs within a portfolio of eight programs designed  to protect critical technologies, including inadequate or inefficient  monitoring and enforcement, the need for leadership in determining  strategies for ensuring that programs remain up-to-date and effective, and  limited coordination between programs with similar goals administered by  different agencies.
We have also noted that several of these programs  are inherently complex and that multiple departments and agencies  representing various interests—which at times can be competing and  even divergent—participate in decisions about their implementation; and  we identified poor coordination among the multiple agencies involved. In  January 2007, we added the effective protection of technologies critical to  U.S. national security to our list of agencies and programs that are  considered high risk due to their vulnerabilities to fraud, waste, abuse, or  mismanagement, or the need for broad-based transformations to address  major challenges.
This report, which we prepared under the authority of the Comptroller  General to evaluate government programs as part of our continued effort  to assist Congress with its responsibilities regarding the protection of  critical technologies: (1) assesses the progress of the various agencies’  efforts and identifies implementation challenges, if any, to reform  programs and processes to protect critical technologies; and (2)  determines the extent to which cognizant agencies are coordinating with  stakeholder agencies on their respective reform efforts to ensure effective  collaboration for national security purposes.
To accomplish this, we reviewed laws, regulations, and executive orders  governing the eight programs we identified in 2007 as part of the  protection of critical technologies high-risk area, including the Arms  Export Control Act, Export Administration Act, the Defense Production Act  of 1950 (all as amended), International Traffic in Arms Regulations, and  Export Administration Regulations. We reviewed policy and guidance  documents relating to these programs, such as the Security Assistance  Management Manual, National Industrial Security Program Operating  Manual, and DOD directives and instructions. As part of this review, we  assessed how agencies define key terms, such as technology and critical  technology, to determine whether variance exists. We reviewed  documents and guidance on actions planned and taken by the agencies  responsible for administration of the eight key programs that comprise the  critical technologies portfolio. We also interviewed officials at lead and  stakeholder agencies—including the Departments of Commerce,  Defense, Homeland Security, Justice, State, and Treasury—to determine  progress on these actions for reform. We reviewed findings and  recommendations from our prior reports in this area and assessed  agency actions planned and taken against our past recommendations,  our criteria for assessing high-risk programs, and best practices for  interagency collaboration. We also evaluated potential obstacles and  challenges to reform efforts through interviews with lead agencies as well  as stakeholder agencies for these programs. We assessed coordination  within and among agencies by reviewing policies and guidance  documents and conducting interviews with cognizant agency officials. We  further evaluated coordination between agencies in the context of best  practices work on interagency collaboration.
We conducted this performance audit from August 2014 to February  2015, in accordance with generally accepted government auditing  standards. Those standards require that we plan and perform the audit to  obtain sufficient, appropriate evidence to provide a reasonable basis for  our findings and conclusions based on our audit objectives. We believe  that the evidence obtained provides a reasonable basis for our findings  and conclusions based on our audit objectives.
subsections: section_title: Background
paragraphs: In 2007, we identified eight key programs that aim to protect critical  technologies: Arms and Dual-Use Export Controls, Anti-Tamper Policy,  the Foreign Military Sales Program, the National Disclosure Policy  Committee, the Militarily Critical Technologies Program, the National  Industrial Security Program, and the Committee on Foreign Investment in  the United States. Responsibilities for these programs are shared among  multiple federal agencies and offices, primarily within the Departments of  Commerce, Defense, Homeland Security, Justice, State, and Treasury.  As shown in table 1, multiple agencies either have the lead or are  stakeholder agencies for the programs for the identification and protection  of critical technologies. In our 2013 high-risk update, we noted that these  programs do not work collectively as a system and that the administration  had not taken steps to re-examine the portfolio of programs to address  their collective effectiveness; any actions to improve programs had largely  focused on addressing challenges in individual programs. Although we  did not previously divide this list of programs into export control and non- export-control programs, an ongoing presidential initiative known as  Export Control Reform has emphasized the relationship between two of  the programs on the list: the Arms Export Control System and the Dual- Use Export Control System. These two programs—which we refer to  collectively as export control programs—impose licensing requirements  on persons that create or trade in specified categories of items and  information. The other programs in the portfolio—which we refer to as  non-export-control programs—are not part of this system for controlling  exports.
section_title: Agencies Have Made Progress in Addressing Previously Identified Weaknesses for Critical Technologies Programs, But Face Some Implementation Challenges
paragraphs: The cognizant agencies have taken actions in each of the programs  designed to protect critical technologies since our January 2007 high-risk  update, in response to changes in law, our prior recommendations, or  their own internal identification of weaknesses. For instance, initiatives  are under way in the area of export controls, which comprises two of the  eight programs, based on an April 2010 framework announced by the  administration. The six non-export-control programs have undergone  changes through internal agency or department initiatives, or through  legislative requirements. However, some of these eight programs are  facing implementation or additional challenges.
subsections: section_title: Export Control Reform Is Under Way, but Challenges to Full Implementation Exist
paragraphs: In 2009, the administration directed an interagency review of the U.S.  export control system that resulted in the establishment of an Export  Control Reform initiative a year later. This initiative is under way and  actions have been implemented using a phased approach, with three  planned phases—Phase I developed plans and made preparations for  Phase II, which is the implementation of steps to reconcile various  definitions, regulations, and policies for export controls, all while building  toward Phase III. This third phase is to result in implementation of major  changes supported by these reconciliations, by consolidating export  control efforts in four reform areas, to create a single, consolidated control  list, a single licensing agency, a primary export enforcement coordination  agency, and a unified information technology system. As we concluded in  our November 2010 review of the Export Control Reform initiative, this  approach has the potential to address weaknesses in the U.S. export  control system, including areas where agencies have not addressed prior   The reform effort is currently in Phase II, and changes are  GAO findings.occurring in each of the four reform areas, to varying degrees. Challenges  are also present in each, such as achieving full implementation of the  Federal Export Enforcement Coordination Center, designed to coordinate  enforcement efforts across all export agencies. Further, delays exist in  agencies’ use of DOD’s USXPORTS system as the unified information  technology system for licensing. Moreover, full implementation of Export  Control Reform in Phase III is dependent upon congressional action to  revise legislation, particularly in licensing and enforcement activities.
subsections: section_title: Steps Toward a Consolidated Export Control List Are Under Way
paragraphs: In order to regulate the export of items and information with military  applications, State and Commerce each maintain a separate control list of  items that require a license before they can be exported—the U.S.  Munitions List, for State, and the Commerce Control List, for Commerce.  Because State and Commerce have different restrictions on the items  they control, determining which agency controls exported items is  fundamental to the effectiveness of the U.S. export control system. Over  10 years ago, we found that both departments had claimed jurisdiction  over the same items, such as certain missile-related technologies, and  the administration noted that these types of jurisdictional issues were still  present in 2010, when they began Export Control Reform. Such  jurisdictional disagreements and problems in the past have often resulted  from the departments’ differing interpretations of the regulations and from  minimal or ineffective coordination among the departments. As part of the  reform initiative, a task force created new export control criteria to  determine which items and technologies should be controlled by  Commerce and which by State, thus helping to reduce uncertainty. In  implementing this process, Commerce, State, and Defense officials  involved in the reform initiative are working to reach agreement on the  appropriate controls over items in the 21 categories of State’s U.S.  Munitions List and the corresponding controls for items Commerce, State,  and Defense officials determine should be moved to the Commerce  Control List.
Since the first set of revised rules went into effect in 2013, 15 of the 21  categories of the U.S. Munitions List have been reviewed and final rules  have been issued to clearly identify the jurisdiction of controlled items.  These revisions are intended to move certain less sensitive items from  State’s U.S. Munitions List to the Commerce Control List, while leaving  high-risk and high-priority items and information on State’s list. The  moved items are subject to Commerce’s more flexible Export  Administration Regulations. The aim of these revisions is to enhance  national security by increasing interoperability with allies, maintaining the  U.S. defense industrial base, and enabling the U.S. export control  agencies to focus on items and destinations of greater concern. For  example, military aircraft instrument flight trainers not specially designed  to simulate combat have been transitioned from the U.S. Munitions List to  the Commerce Control List. An additional three categories of the U.S.  Munitions List, pertaining to arms and ammunition, are on hold because  they relate to the politically sensitive issue of gun control policy, according  to senior level export administration officials at both State and Commerce.  The final three categories are still under review.
Current efforts have focused on transitioning less sensitive items from the  U.S. Munitions List to a new section of the Commerce Control List called  the 600 Series, which was added in order to provide a separate  classification for munitions newly under Commerce’s jurisdiction.  According to Commerce’s Assistant Secretary for Export Administration,  the completion of all of these revisions is expected by late 2015. As a  result of the control list revision process, however, licensing staff and  industry are contending with three general types of controls—the U.S.  Munitions List, the 600 Series controls on the Commerce Control List, and  the dual-use controls on the Commerce Control List. This is intended as  an intermediary step on the path to a single list, but an official from  State’s Directorate of Defense Trade Controls noted that, for now, some  exporters are confused by the multiple lists. This confusion among  exporters, although typically expected when there are various lists, could  delay or impair achievement of the Export Control Reform’s goal of  overcoming the inefficiencies of the previous export control system until  the final integration to a single list is completed.
These changes to the lists are also affecting export control enforcement  actions that rely on processing of commodity jurisdictions—which  determine whether an item is controlled by State or Commerce—by the  Department of State, according to enforcement agency officials. Two  officials from the Department of Justice, as well as the Deputy Assistant  Director of the Department of Homeland Security’s (DHS) Homeland  Security Investigations Counter-Proliferation Investigations Program, told  us that it is taking longer for State to issue decisions, including commodity  jurisdiction determinations, because of the recent changes to the control  lists. They stated that the changing jurisdiction of items is resulting in a  greater need for investigators to obtain timely commodity jurisdictions  than in the past. Consequently, these officials noted that, given the time it  is taking to complete the commodity jurisdiction decision—upwards of 6  months in some cases, which is well beyond State’s goal of 60 days—it is  difficult for law enforcement to build a case and receive timely information  to take specific enforcement actions, such as authorization to execute a  search warrant or to obtain criminal indictments. The Deputy Assistant  Director of DHS’s Homeland Security Investigations Counter-Proliferation  Investigations Program also noted that commodity jurisdictions often  involve review by other agencies, such as DOD technical experts in  addition to the licensing agencies of State and Commerce, and that this  involvement, in addition to the limited staff at the State Department  available to conduct commodity jurisdictions for law enforcement  agencies, may be contributing to the length of time taken. Compliance  officials at State indicated that they try to prioritize commodity jurisdiction  requests from law enforcement, but increases in the frequency of these  requests and duplication of requests has made it difficult for them to keep  up with law enforcement needs.
According to the Department of Justice officials, the length of time it takes  to receive the certification necessary from the State Department to  proceed with their enforcement actions, such as search warrants, results  in cases losing momentum. These delays also contribute to increased  difficulty in keeping witnesses interested and available if and when the  case goes to trial. In addition, the Deputy Assistant Director of DHS’s  Homeland Security Investigations Counter-Proliferation Investigations  Program told us that DHS is experiencing the same challenge in  conducting enforcement activities. Officials with both Homeland Security  Investigations and the Executive Office for U.S. Attorneys stated that  these delays are having an adverse effect on numerous cases and  investigations. DHS documents show that the number of requests for  support by State that would include a commodity jurisdiction have  doubled since 2008, reaching more than 250 requests in 2014. Further,  two officials from the Department of Justice told us that in this transitional  period, the revisions to the control list are creating some degree of  confusion and it is becoming more subjective to prosecute cases. The  burden of export control cases is to establish that the individual or entity  willfully and knowingly intended to violate the law, and the increased  confusion can complicate efforts to prove that intent. These officials  stated that they are beginning to collect information on the impact of this  confusion; and according to officials at State, DHS, and Justice, they are  working together to develop updated procedures for requesting  commodity jurisdictions that will facilitate the process on both sides and  reduce confusion. In the meantime, some export control enforcement  actions may continue to be inhibited.
section_title: Streamlining of Licensing Activities May Face Resource Challenges
paragraphs: Efforts to create a single licensing agency are awaiting Phase III  legislative authorization, but Phase II actions are under way. In order to  address the national security risks of controlled items falling into the  wrong hands, the export control programs may require licenses for the  export of controlled items. Under the current export control system, the  Departments of State and Commerce each have the authority to issue  export licenses for items within their respective jurisdictions. In 2010,  licensing agencies within these departments processed over 100,000   For some transactions, exporters were required to apply for  licenses.licenses from both departments, because the transactions contained both  U.S. Munitions List and Commerce Control List items. The goal of the  reform initiative is to create a single licensing agency, which would act as  a single source for businesses seeking an export license and for the U.S.  government to coordinate review of license applications. As one step,  State has been authorized to issue licenses for items subject to  Commerce’s jurisdiction that are used in or with items subject to State’s  jurisdiction. Such action—when combined with the revised control lists— is expected to result in fewer license requests and the use of a greater  number of license exceptions.
GAO, Export Controls: U.S. Agencies Need to Assess Control List Reform’s Impact on  Compliance Activities, GAO-12-613 (Washington, D.C.: Apr. 23, 2012).
U.S. Munitions List to the Commerce Control List is completed.assessment of licensing resources is important, but does not fully address  our 2012 recommendation that Commerce review its resource needs for  all of its compliance activities.
section_title: Steps Toward a Primary Enforcement Export Coordination Agency Have Expanded Interagency Communication, but Efficiency and Coordination Challenges Remain
paragraphs: GAO, Export Controls: Challenges Exist in Enforcement of an Inherently Complex  System, GAO-07-265 (Washington, D.C.: Dec. 20, 2006). goal of limiting duplicative or counterproductive activities. The Director of  the E2C2 provided data showing that over 3,000 submissions have been  made through the deconfliction process, and slightly over half have  resulted in additional information-sharing of some kind. Enforcement  officials at multiple agencies described positive effects of the E2C2  deconfliction process in enabling coordination amongst the agencies.  According to key enforcement officials that we spoke with at the E2C2,  DHS, and at the Departments of Justice and Commerce, this is a  resource intensive process, in part, because it is still managed manually,  which slows down their ability to quickly deconflict information. Initial  steps to address these inefficiencies by automating the deconfliction  process are under way. These efforts taken by the E2C2 are not yet  complete, but they are a good start to achieving a more coordinated  approach to the enforcement of export controls.
section_title: State and DOD Have Implemented Efforts to Move Towards a Unified Information Technology System, but Commerce Faces Delays
paragraphs: Finally, the Export Control Reform initiative proposes a single information  technology system to administer the export control system and share  information regarding licensing and related actions among the export  control agencies. According to administration Export Control Reform  plans, DOD’s USXPORTS database will eventually serve as the single  electronic system to process export licensing. Several agencies, including  State and DOD, are using USXPORTS for export control licensing;  however, Commerce is not yet using this system—a more than 2-year  delay from the originally anticipated migration date of May 2012; which,  according to the Assistant Secretary for Export Administration, was  largely a result of sequestration and budget issues. According to  Commerce officials, Commerce is working with the DOD contractor to  mitigate issues with two major system requirements concerning crossover  from classified to unclassified domains and interface between  Commerce’s licensing and enforcement databases. The Commerce  officials stated that once these issues have been addressed, Commerce’s  export licensing process will transfer to the USXPORTS system.
Additionally, the unified information technology system may not address  all the information technology needs of the export control enforcement  agencies. The other agencies that conduct export enforcement activities,  within DHS and Justice, are not presently using USXPORTS because it is  not intended as a repository of enforcement information, but stated that  the licensing data it will contain may be a useful tool for them in the  future. Moreover, in November 2010, we found that the Export Control  Reform initiative for information technology did not fully address findings  from our previous work. In addition, in October 2007, we found that  export control enforcement agencies lack a system to identify all parties  that engage in nuclear proliferation and are impaired from judging their  progress in preventing nuclear networks because they cannot readily  identify basic information on the number, nature, or details of all their  enforcement activities involving nuclear proliferation. Since that report  was issued, Commerce has implemented procedures to address a  recommendation on this issue, but Treasury has not.
section_title: Single Licensing and Primary Export Enforcement Coordination Agencies Expected in Phase III
paragraphs: Across all four areas of Export Control Reform, full implementation is  expected to occur in its third and final phase—Phase III—which focuses  on implementing the reform proposals that are dependent upon  congressional action, such as creating a single licensing agency and a  primary export enforcement coordination agency. For example, because  there are separate statutory bases for State and Commerce to review and  issue export licenses, legislation will be required to consolidate the  current system into a single licensing agency. Further, Phase III of the  reform initiative plans to merge export control investigative resources  from Commerce into DHS’s Immigration and Customs Enforcement.  Moreover, officials from Justice’s National Security Division noted that the  enforcement agencies at Commerce, DHS, and the Federal Bureau of  Investigation currently provide for a diverse group of investigators with  varying, but valuable assets to the prosecutorial community, which they  hope will be sustained through the Phase III effort. For these reasons,  significant collaboration by the participating agencies is essential to the  Phase III consolidation efforts.
section_title: Non-Export-Control Programs Designed to Protect Critical Technologies Have Also Undergone Positive Changes, But Implementation is Not Yet Complete
paragraphs: The remaining programs that have a role in protecting critical  technologies—designated as non-export-control—have also undergone  individual changes in response to previously identified weaknesses. Four  of the major programs in the portfolio are led by offices at DOD—Anti- Tamper Policy, the National Disclosure Policy Committee, the Militarily  Critical Technologies Program, and the National Industrial Security  Program—with a fifth, the Foreign Military Sales Program, led by State in  approving the transfers and administered by DOD. Another program, the  Committee on Foreign Investment in the United States (CFIUS), is led by  Treasury, with participation from several other agencies, and has  undergone changes in response to legislative action in 2007. We found  that some of these programs have processes in place for sharing  information on potential threats or needed actions between the programs,  but these actions have not yet been completed.
subsections: section_title: Anti-Tamper Policy Has Undergone Positive Changes
paragraphs: DOD established its Anti-Tamper Policy in 1999, requiring the military  departments to implement techniques to protect critical technologies that  might be vulnerable to exploitation—through such means as reverse  engineering—when weapons leave U.S. control through export or loss on  the battlefield. Examples of anti-tamper techniques include software  encryption, which scrambles software instructions to make them  unintelligible without first being reprocessed through a deciphering  technique, and hardware protective coatings designed to make it difficult  to extract or dissect components without damaging them. We reviewed  this program in 2008, and at that time we found that, although DOD  program managers were ultimately responsible for implementing its anti- tamper policy, a lack of direction, information, and tools created  significant challenges for them. Since 2008, in response to our  recommendation that DOD identify and provide additional tools to assist  program managers in the anti-tamper decision process, DOD’s Anti- Tamper Executive Agent’s Office has improved the training for anti- tamper policies that it offers to program managers. In addition, DOD’s  acquisition reform initiatives of Better Buying Power 2.0, including the  Defense Exportability Features, are building anti-tamper features into the  design phase of a weapon system’s development process—much earlier  than in the past.these changes, but they represent positive actions to improve past  weaknesses in this program.
section_title: A Newly Created Steering Group Supports the Foreign Military Sales Program and National Disclosure Policy Process
paragraphs: Each year, the U.S. government sells billions of dollars of defense articles  and services to foreign governments through the Foreign Military Sales  program.  The Arms Export Control Act authorizes the sale of defense  articles and services to eligible foreign customers by the President under  the Foreign Military Sales program. The President has delegated transfer  approval to State under the Foreign Military Sales program and  implementation authority to DOD to administer it. Both agencies have  taken steps to reform the program in response to some, but not all, of our  findings and recommendations from multiple prior reports examining this  program. Specifically, in May 2009, we recommended that DOD take  actions to improve its verification and tracking of Foreign Military Sales  shipments, which led to DOD improvements in its systems to expand the  available information for tracking Foreign Military Sales shipments, as  well as its guidance on how to verify those shipments. However,  although the agencies generally concurred with it, our interagency  recommendation on ensuring Customs and Border Protection officials  have the necessary information to verify shipments remains unaddressed.  Based on recommendations from a report we issued in November 2012,  the Defense Security Cooperation Agency has updated its policies to  improve the quality of information sharing and to better track timeliness of  shipments. However, additional recommendations on metrics for  assessing timeliness of other aspects of the shipping process have not  yet been implemented, although DOD concurred with these  recommendations and told us it is working to collect the necessary  information to better measure timeliness.
The National Disclosure Policy Committee determines the releasability of  classified military information, including classified weapons and military  technologies, to foreign governments. As members of the Committee,  each military department has its own administrative process for reviewing  requests for transfers of classified weapons and information, within the  parameters of the National Disclosure Policy. Since 2008, in support of its  portfolio of security cooperation programs, which include the Foreign  Military Sales program and the National Disclosure Policy Committee, a  DOD coordinating body has met monthly to discuss potential technology  transfers to foreign governments and improve processes for reviewing  transactions that implicate critical technologies protection issues. The  Arms Transfer and Technology Release Senior Steering Group (ATTR  SSG) brings together representatives from numerous DOD offices. It is  co-chaired by the Office of the Under Secretary of Defense for  Acquisition, Technology and Logistics and the Office of the Under  Secretary of Defense for Policy, and members include the Defense  Security Cooperation Agency, the military departments, the Joint Staff,  and other DOD agencies with technology security and foreign disclosure  responsibilities. Additionally, due to their shared responsibilities on  Foreign Military Sales and export controls, two offices from the  Department of State participate in the ATTR SSG, as well. A  representative of State’s Office of Regional Security and Arms Transfers  was formally added as an observer to the ATTR SSG in 2012 and a  representative from the Directorate of Defense Trade Controls has been  added more recently.
section_title: The Militarily Critical Technologies Program Remains Underutilized
paragraphs: In response to the Export Administration Act of 1979, DOD established  the Militarily Critical Technologies Program in 1980 to develop the  Militarily Critical Technologies List (MCTL) of technologies possessed by  sources in the U.S. that, if exported, would permit a significant advance in   Its original purpose was to inform  the military system of another country.export licensing determinations, and it was to be integrated into the  Commerce Control List on an ongoing basis. Since then, the list has  expanded to capture technology capabilities developed worldwide. In  January 2013, we found that the MCTL was out-of-date and was no  longer being published online, but that widespread requirements to know  what is militarily critical remained. We recommended that the Secretary of  Defense (1) determine the best approach to meeting users’ needs for a  technical reference, whether it be MCTL, other alternatives being used, or  some combination thereof; and (2) ensure that resources are coordinated  and efficiently devoted to sustain the approach chosen. We further  recommended that if DOD determines that the MCTL is not the optimal  solution for aiding programs’ efforts to identify militarily critical  technologies, the Secretary of Defense seek necessary relief from DOD’s  current responsibility. According to DOD officials responsible for the  MCTL, they are no longer updating the list, and are in the process of  determining whether it is appropriate to seek relief from the requirement  to maintain the list. They stated that alternatives to the MCTL are being  employed based on the specific needs of each agency, and DOD offices  are using the U.S. Munitions List, the Commerce Control List 600 Series,  and the Industrial Base Technology List as alternatives to the MCTL. For  example, officials in the Office of the Under Secretary of Defense for  Acquisition, Technology and Logistics stated that DOD offices and  agencies are using the U.S. Munitions List in support of export license  processing and foreign disclosure decisions. However, DOD has not  formally determined the best approach to meet users’ needs for a  technical reference and to ensure that resources are coordinated and  efficiently devoted to sustain the approach chosen.
section_title: National Industrial Security Program Reports Significantly Reducing a Backlog of Cases
paragraphs: DOD’s National Industrial Security Program (NISP) was established in  1993 to ensure that federal contractors cleared for classified information,  including information associated with critical technologies, are taking the  proper steps to appropriately safeguard that information. DOD’s Defense  Security Service administers NISP by reviewing contractor applications  for clearance and overseeing cleared facilities. NISP’s role within the  critical technologies portfolio relates to its review of contractors under  foreign ownership, control, or influence (FOCI). In our previous work on  this topic, we found insufficient oversight to ensure the security of  classified information (including critical technology information) from  foreign interests and cited lengthy delays in security reviews. In 2004,  we reviewed the NISP program and recommended improvements to  oversight of contractor protection of classified information. Although DOD  concurred with these recommendations, they were not implemented. In  2005, we made a number of recommendations for better administration of  FOCI oversight, including two, which DOD subsequently implemented, on  efforts to develop a human capital strategy that would better serve the  needs of FOCI security representatives. In a recent interview with officials  in charge of this program, they told us that they have increased their staff  resources approximately from 5 people in 2004 to 40 people presently;  and also implemented a risk-based decision-making and evaluation  process for overseeing facilities that handle classified information. This  risk-based approach to reviewing facilities includes an annual update of  the list of facilities in the United States that conduct classified work, and a  prioritization of which facilities will be visited based on criteria and input  from key stakeholders within DOD and the intelligence community. Prior  to these changes, many cases were taking upwards of one year to  conduct reviews and put FOCI measures in place for companies that  conduct classified work for the U.S. government. According to the head of  the Defense Security Service’s FOCI Operations Division, these changes  in staffing and taking a risk-based approach have reduced the backlog of  reviews of new companies handling classified information. The Analytic  Division now conducts FOCI reviews of all of the roughly 1300 new  companies seeking clearance each year. For previously cleared facilities,  officials stated that this risk-based approach allowed Defense Security  Service staff to complete security vulnerability assessments at about half  of the roughly 13,500 cleared facilities under their purview in 2014. They  told us that this process also allows staff to prioritize and target those  reviews to higher risk facilities; for example, in 2014, they conducted  reviews at 586 of the roughly 600 cleared facilities that have FOCI  mitigation in place.
NISP had previously used the MCTL to categorize the types of classified  information by technology that was being targeted in cleared facilities by  foreign entities. However, according to the officials with Defense Security  Service’s Counterintelligence Directorate, MCTL was not broad enough to  cover non-defense-related technologies, in fields such as agriculture.  With the transition away from MCTL, the Defense Security Service  developed the Industrial Base Technology List to better cover the range  of categories of concern to NISP; and according to these officials,  Counterintelligence continually updates this list to include new  technologies requiring oversight as they are developed, as well as  including non-defense technologies that fall under the purview of NISP.
section_title: The Committee on Foreign Investment in the United States Faces Changes in the Risks It Must Address
paragraphs: CFIUS is an interagency committee that serves the President by  overseeing the national security implications of foreign investment in the  U.S. economy. CFIUS is chaired by Treasury, and includes members  from other federal agencies such as Commerce, Defense, Energy,  Homeland Security, Justice, and State, among others. CFIUS reviews  foreign acquisitions, mergers, or takeovers of a U.S. business to  determine whether it poses a threat to the national security of the United  States. CFIUS may also enter into an agreement with, or impose  conditions on, parties to mitigate national security risks. One component  of this review involves discussion of any relevant critical technologies and  the potential impacts of foreign ownership of, or access to, such  technologies. In 2008, in response to Congressional action partially driven  by findings and recommendations that we raised in earlier reports,  CFIUS implemented reforms increasing its efforts on national security- related topics and defining categories of transactions subject to review,  such as those resulting in control of critical U.S. infrastructure by a foreign  person. In 2012, the growing number of investments in the United States  by Chinese firms sparked concerns by a number of groups over the  economic and security impact of the investments, according to a report by  the Congressional Research Service.
The scope of potential national security risks presented by foreign  investment in the United States has evolved beyond ownership and  control concerns. Specifically, the issue of proximity has broadened to  consideration of the geographic location of foreign-owned businesses and  their capability to collect intelligence on U.S. military installations. For  example, the CFIUS review process came under increased scrutiny after  the attempted purchase by a Dubai company, Dubai Ports World, of a  company that operated various U.S. port facilities. Although initially  allowed to proceed by CFIUS in 2006, subsequent congressional and  media attention ultimately caused the company to sell the U.S. portion of  the business to another U.S. company. In addition to the Dubai Ports  case, according to a Congressional Research Service report, an  investment by a Chinese firm in a wind farm project in Oregon recently  attracted public and congressional attention. CFIUS recommended that  the company stop operations until an investigation could be completed as  a result of objections by the U.S. Navy over the placement of wind  turbines near or within restricted Naval Weapons Systems Training  Facility airspace where unmanned aerial vehicles are tested. After a full  investigation, CFIUS recommended that the President block the  investment and he issued an Administrative Order stating that there was  credible evidence that the acquisition threatened to impair U.S. national  security; the case is under appeal. Further, in December 2014, we  issued a report that examined DOD military installations and critical  infrastructure which included information on the proximity of foreign- owned businesses near military bases. Although this report did not have  any findings or recommendations related to the CFIUS process, it  identifies foreign-owned businesses near military bases as another  potential area for CFIUS consideration.
section_title: Interagency Collaboration Exists among Agencies but Improvements Could Be Made
paragraphs: Recent initiatives in response to identified weaknesses in the critical  technologies programs have resulted in improved interagency  collaboration. Some programs have developed mechanisms for  interagency collaboration across the participating agencies for their  individual program. However, current collaboration mechanisms do not  involve direct communication among all the programs in the protection of  critical technologies portfolio.
subsections: section_title: Some Agencies’ Policies and Mechanisms Support Interagency Collaboration in the Critical Technologies Portfolio
paragraphs: There are both existing mechanisms and new initiatives among the critical  technologies programs that support collaboration. In some cases, these  programs promote interagency collaboration through formal and long- standing mechanisms. Most notably, CFIUS was established as an  interagency body to review transactions that could result in a foreign  party’s gaining control over a U.S. company. Under the CFIUS process,  CFIUS member agencies work toward reaching a consensus on  decisions. The consensus-based decision-making process ensures that  representatives of each stakeholder agency are aware of the basis of the  decision, including any future actions that CFIUS might be relying on  each agency to take to address national security risks. CFIUS, or a lead  agency, may negotiate agreements with any party to a covered  transaction in order to mitigate the national security risks that may result  from the transaction, when other provisions of law do not adequately  address these risks. The CFIUS lead agency on the transaction is  responsible for monitoring the agreement to ensure compliance with it.  GAO has not recently examined CFIUS agencies’ efforts to enforce these  security agreements, and we are not aware of any ongoing changes or  initiatives that involve CFIUS.
We also found that agencies have fostered new opportunities to promote  interagency collaboration in their shared goal of protecting critical  technologies. For example, the creation of the ATTR SSG created new  opportunities for regular communication, through monthly meetings,  among DOD offices and between DOD and State, while preserving  DOD’s control over the coordinating body. A new office, the Technology  Security and Foreign Disclosure Office, serves as the administrative arm  of the ATTR SSG and participates in creating and disseminating policies  in this area. State Department officials from the Regional Security and  Arms Transfers office and the Directorate of Defense Trade Controls  participate in the ATTR SSG as observers. These State representatives  have raised concerns about individual transactions at the ATTR SSG and  initiated policy discussions, but are considered non-DOD participants;  therefore they do not have voting rights within the group.
In 2014, DOD organized a new office within the Office of the Under  Secretary of Defense for Policy, devoted to improving the strategic  posture of DOD security cooperation activities by, among other things,  coordinating DOD’s use of legal authorities, including Foreign Military  Sales and the National Disclosure Policy, for transfers to foreign partners.  To this end, the office facilitates the inclusion of key stakeholders in its  strategic initiatives, including those involved in critical technologies  protection and foreign disclosure within DOD, as well as at State. At this  point, it is too early to determine what effects this office will have on intra-  and inter-agency coordination.
In addition to the formal coordinating bodies discussed above, the  agencies also make use of informal processes to ensure an ongoing flow  of information. As part of the administration’s Export Control Reform  initiative, State and Commerce regularly consult with DOD officials and  subject matter experts about revisions to export control regulations. DOD  and State also have plans to detail staff to their counterpart’s offices in  order to improve communication on their shared programs, particularly  Foreign Military Sales. Officials stated that this should enable them to  learn about how information is handled at the other agency and about one  another’s practices.
section_title: Collaboration among Lead and Stakeholder Agencies Remains a Challenge Across the Critical Technologies Portfolio
paragraphs: Agencies have taken steps to collaborate with other agencies to manage  their individual critical technologies programs; however, current  collaboration mechanisms do not involve direct communication among all  the programs in the protection of critical technologies portfolio. For  example, although the ATTR SSG has developed processes for  interagency collaboration on security cooperation programs, it does not  provide a forum for direct communication among all programs with critical  technologies responsibilities, such as Commerce’s export control officials.  All of the eight critical technology programs in this portfolio share a goal of  protecting national security. In January 2007, when we designated the  protection of critical technologies as high risk, our body of work on  programs designed to protect critical technologies showed fragmentation,  including poor coordination among the multiple agencies involved. The  agencies responsible for many of these programs have since made  progress toward improving coordination and reducing fragmentation,  individually, and in some instances collectively. Past work on interagency  collaboration notes that many of the results that the federal government  seeks to achieve require the coordinated efforts of more than one federal  agency and often more than one sector and level of government.
Both Congress and the executive branch have recognized the need for  improved collaboration across the federal government, as stated in our  September 2012 report on interagency collaboration. In a June 2010  report on interagency collaboration in national security, we also  concluded that when multiple agencies are managing similar information,  challenges may exist among agencies regarding redundancies in  information sharing, unclear roles and responsibilities, and data  comparability.including differences in agencies’ structures, planning processes, and  funding sources—can hinder interagency collaboration.
That report also noted that organizational differences— According to officials involved in administering critical technologies  programs, different programs use different terminology, and the usage  and understanding of terms can vary. Under the administration’s Export  Control Reform initiative, State and Commerce have worked together to  revise regulatory definitions of key terms, and this collaboration is  ongoing. Across the broader portfolio of critical technologies programs,  however, definitions may not always be clearly aligned, and categories  such as critical technologies may be understood in different ways at  different programs. Best practices for interagency collaboration include  using consistent terminology to establish a common understanding and  improve collaboration among the various programs. In some cases, distinct uses of the same or similar terms may be appropriate, but make it  more important that the programs have a plan for sharing these  distinctions to ensure a common understanding. As the use of the U.S.  Munitions List and the Commerce Control List expands to areas beyond  export controls, taking steps to apply the concepts and terms used by the  lists consistently would help eliminate confusion and facilitate  collaboration. State’s export compliance officials noted that the U.S.  Munitions List sets out a procedure for assessing items to determine  whether they are subject to State’s export control regulations, and that  other potential users of this list need to understand how this procedure  works in order to avoid confusion.
Some impediments to collaboration could be addressed when the  implementation of certain initiatives is completed. For example, DOD’s  use of Better Buying Power 2.0’s Defense Exportability Features enables  DOD to more clearly inform acquisition programs about their  responsibilities for critical technologies programs such as Anti-Tamper  Policy and Foreign Military Sales at the design stage, rather than waiting  until decisions are made about where to deploy or sell a system. DOD  plans to continue the Defense Exportability Features initiative in Better  Buying Power 3.0, which launched in September 2014. In addition, the  establishment of the E2C2 was a step toward addressing concerns about  collaboration we had raised in prior reports, and the E2C2’s deconfliction  process provides significant opportunities for improved information  sharing. However, the full benefit of export enforcement coordination is  limited until all of the standard operating procedures are completed,  including the one that allows for greater collaboration between the  enforcement and intelligence communities.
In a September 2014 meeting with senior representatives of the agencies  involved in the protection of critical technologies, we discussed their  efforts to address our designation of this area as high risk and also  discussed the possibility of having one agency in charge of this area.  These agencies expressed concern over their distinct roles and  responsibilities and which agency would take the lead for coordinating  efforts to protect critical technologies. In subsequent discussions with  these agencies, the officials responsible for the operations of these  programs generally agreed with the need for better collaboration among  the programs, including actions not currently being taken. Such actions  could include holding an annual meeting of the programs designed to  protect critical technologies to discuss the technologies they are  protecting, their programs’ intent, and any new developments or changes  planned for their programs. For example, the Director of DOD’s Defense  Technology Security Administration stated that, even within DOD, these  programs expand beyond any one organization and initiatives are  occurring within these programs. Interagency collaboration mechanisms  for various agencies involved in common goals, such as the protection of  critical technologies, are essential to avoid the potential for a patchwork of  activities that could waste scarce funds and limit the overall effectiveness  of federal efforts. Cross agency collaboration may strengthen the alliance  of these programs and create common understanding of these  technologies and better ensure that they are provided to foreign entities in  a manner consistent with U.S. interests. For these reasons, it is important  that the agencies responsible for the protection of critical technologies  continue to promote and strengthen mechanisms for effective  collaboration, both within their programs and agencies, as well as across  the interagency community.
section_title: Conclusions
paragraphs: In the 8 years since critical technologies programs were added to the  GAO high-risk list, the agencies responsible for their implementation have  taken positive steps and developed a number of initiatives to improve  their individual programs. The critical technologies portfolio is a complex  array of programs, subject to a myriad of laws, regulations, and policies,  and administered by multiple offices across several departments.  Effective coordination across the portfolio of programs is important to  mitigate national security risks, and interagency collaboration is essential  to realizing the potential effectiveness of the programs. This is especially  true in light of the initiatives under way and the changing nature of issues  related to the protection of critical technologies. It is important that  collaboration and information sharing is optimized among agencies, not  just within each agency. Doing so would improve their ability to protect  critical technologies and national security interests. Within individual or  closely related programs, ensuring that a consistent approach is taken by  the lead and stakeholder agencies in meeting the program goals would  help coordinating bodies to ensure that the protecting of critical  technologies remains up to date and effective. Ongoing improvements to  the individual programs may help to address some of these coordination  issues, but interagency collaboration across the portfolio remains an  important challenge as these changes occur.
section_title: Recommendation for Executive Action
paragraphs: To ensure a consistent and more collaborative approach to the protection  of critical technologies, we recommend that the Secretaries of  Commerce, Defense, Homeland Security, State, and the Treasury; as  well as the Attorney General of the United States, who have lead and  stakeholder responsibilities for the eight programs within the critical  technologies portfolio, take steps to promote and strengthen collaboration  mechanisms among their respective programs while ongoing initiatives  are implemented and assessed. These steps need not be onerous; for  example, they could include conducting an annual meeting to discuss  their programs, including the technologies they are protecting, their  programs’ intent, any new developments or changes planned for their  programs, as well as defining consistent critical technologies terminology  and sharing important updates.
section_title: Agency Comments
paragraphs: We provided a draft copy of this product to the Departments of  Commerce, Defense, Homeland Security, Justice, State, and the  Treasury for comment. Each concurred with our recommendation that  they take steps to promote and strengthen collaboration mechanisms  among their respective programs. Justice and Treasury stated their  concurrence with our recommendation in e-mailed comments.   Commerce, Defense, Homeland Security, and State provided written  comments and identified approaches to implementing our  recommendation, including continuing existing collaborative initiatives as  well as working with other departments to seek new opportunities for  collaboration; and these are reproduced in Appendixes I, II, III, and IV,  respectively. Commerce, Defense, and Homeland Security also provided  technical comments that were integrated into the report, as appropriate.
We are sending copies of this report to appropriate congressional  committees; the Secretaries of Commerce, Defense, Homeland Security,  State, and the Treasury; the Attorney General of the United States; and  other interested parties. This report will also be available at no charge on  GAO’s website at http://www.gao.gov.
If you or your staff have any questions about this report, please contact  me at (202) 512-4841 or makm@gao.gov. Contact points for our Offices  of Congressional Relations and Public Affairs may be found on the last  page of this report. GAO staff who made key contributions to this report  are listed in appendix V.
section_title: Appendix I: Comments from the Department of Commerce
section_title: Appendix II: Comments from the Department of Defense
section_title: Appendix III: Comments from the Department of Homeland Security
section_title: Appendix IV: Comments from the Department of State
section_title: Appendix V: GAO Contact and Staff Acknowledgments
subsections: section_title: GAO Contact
paragraphs: Marie A. Mak, (202) 512-4841, or makm@gao.gov.
section_title: Staff Acknowledgments
paragraphs: In addition to the contact named above, Lisa Gardner, Assistant Director;  Scott Purdy; Ted Alexander; Robert Swierczek; Susan Ditto; Marie  Ahearn; Kenneth Patton; and Hai Tran made key contributions to this  report.
section_title: Related GAO Products