Export Controls: Improvements to Commerce's Dual-Use System Needed to Ensure Protection of U.S. Interests in the Post-9/11 Environment
Published: 2006-06-26T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: In regulating exports of dual-use items, which have both commercial and military applications, the Department of Commerce's Bureau of Industry and Security (BIS) seeks to allow U.S. companies to compete globally while minimizing the risk of items falling into the wrong hands. In so doing, BIS faces the challenge of weighing U.S. national security and economic interests, which at times can be divergent or even competing. In light of the September 2001 terror attacks, GAO was asked to examine BIS's dual-use export control system. In response, GAO is reporting on BIS's (1) evaluations of and changes to the system, (2) screening of export license applications against its watchlist, and (3) actions to correct weaknesses previously identified by GAO.
section_title: What GAO Found
paragraphs: Lack of systematic evaluations. Although BIS made some regulatory and operational changes to the dual-use export control system, it has not systematically evaluated the system to determine whether it is meeting its stated goal of protecting U.S. national security and economic interests. Specifically, BIS has not comprehensively analyzed available data to determine what dual-use items have actually been exported. Further, contrary to government management standards, BIS has not established performance measures that would provide an objective basis for assessing how well the system is protecting U.S. interests. Instead, BIS relies on limited measures of efficiency that focus only on narrow aspects of the license application review process to assess the system's performance. BIS officials use intelligence reports and meetings with industry to gauge how the system is operating. Absent systematic evaluations, BIS conducted an ad hoc review of the system to determine if changes were needed after the events of September 2001. BIS officials determined that no fundamental changes were needed but opted to make some adjustments primarily related to controls on chemical and biological agents. GAO was unable to assess the sufficiency of the review and resulting changes because BIS officials did not document their review. Omissions in BIS's watchlist. GAO found omissions in the watchlist BIS uses to screen export license applications. This screening, which is part of the license application review process, is intended to identify ineligible parties or parties warranting more scrutiny. The omissions undermine the list's utility, which increases the risk of dual-use exports falling into the wrong hands. GAO identified 147 parties that had violated U.S. export control requirements, had been determined by BIS to be suspicious end users, or had been reported by the State Department as committing acts of terror, but these parties were not on the watchlist of approximately 50,000 names. Reasons for the omissions include a lack of specific criteria as to who should be on the watchlist and BIS's failure to regularly review the list. In addition, a technical limitation in BIS's computerized screening system results in some parties on license applications not being automatically screened against the watchlist. Some prior GAO recommendations left unaddressed. BIS has implemented several but not all of GAO's recommendations for ensuring that export controls on sensitive items protect U.S. interests. Among weaknesses identified in prior GAO reports is the lack of clarity on whether certain items are under BIS's control, which increases the risk of defense-related items being improperly exported. BIS has yet to take corrective action on this matter.

section_title: Letter
paragraphs: Each year companies in the United States export billions of dollars worth  of dual-use items that have both commercial and military applications. For  example, dual-use materials can be incorporated into golf clubs but can  also help missiles evade radar detection. The Department of Commerce’s  Bureau of Industry and Security (BIS) is responsible for regulating the  export of thousands of dual-use items. In so doing, BIS faces the challenge  of weighing U.S. national security, foreign policy, and economic interests,  which at times are divergent or even competing, to achieve an appropriate  balance that allows U.S. companies to compete globally while minimizing  the risk that exported items could be used against U.S. interests. This  challenge has been heightened by shifts in the security and economic  environment since the late 1970s, when the current statutory framework  for dual-use export controls was put in place. Perhaps most notably, in the  aftermath of the September 2001 terror attacks, the threats facing the  United States have been redefined. Also, over the decades, trade in rapidly  advancing technologies has increased as the economy has become more  globalized.
BIS administers the dual-use export control system through the  requirements contained in the Export Administration Regulations (EAR).  Under these regulations, exporters are to either obtain prior government  authorization in the form of a license from BIS or determine that a license  is not needed before exporting dual-use items. Multiple factors govern  whether an exporter needs a license, including the item to be exported and  the country of ultimate destination. Within the dual-use export control  system, BIS heads an interagency process for reviewing export license  applications. The decision to approve an application is based, in part, on  how the exported item is to be used and who plans to use it. During the  license application review process, BIS screens applications against its  own watchlist of individuals and companies to identify applications  involving parties that are either ineligible or warrant additional scrutiny to  minimize the risk of dual-use items being used against U.S. interests.
In light of the September 2001 terror attacks, you requested that we  examine BIS’s dual-use export control system and whether BIS has made  changes to the system. In response, we (1) assessed whether BIS has  evaluated the dual-use export control system and made changes to the  system, (2) evaluated BIS’s screening of export license applications  against its watchlist, and (3) determined the extent to which BIS has taken  corrective actions in response to weaknesses previously identified by  GAO.
In assessing BIS’s evaluations of the system’s effectiveness and efficiency,  we compared BIS’s annual reports, performance plans, and budget  submissions with performance management and internal control  standards. Through discussions with BIS officials and reviews of  regulatory notices, we identified evaluations conducted by BIS and  resulting changes to the system after the events of September 2001. We  also analyzed data on export license applications, which we determined to  be sufficiently reliable for our purposes. To evaluate BIS’s watchlist  screening process, we compared BIS’s watchlist with government  documents to assess the list’s completeness, reviewed BIS’s internal  guidance for adding parties to the watchlist and screening applications,  and discussed with BIS officials reasons parties were not included on the  list and BIS’s screening process. To determine what actions BIS has taken  during the last 5 years in response to previously identified weaknesses, we  reviewed regulatory changes and information provided by BIS and other  agency officials. We performed our review from July 2005 through May  2006 in accordance with generally accepted government auditing  standards.
subsections: section_title: Background
paragraphs: In regulating dual-use exports, the Commerce Department’s BIS faces the  challenge of weighing various U.S. interests, which can be divergent or  even competing, so U.S. companies can compete globally while minimizing  the risk of controlled dual-use items falling into the wrong hands. Under  the authority granted in the Export Administration Act (EAA), BIS  administers the EAR that require exporters to either obtain a license from  BIS or determine government authorization is not needed before exporting  controlled items. Even when a license is not required, exporters are  required to adhere to the provisions of the EAR when exporting controlled  dual-use items. Whether an export license is required depends on multiple  factors including the    country of ultimate destination,   individual parties involved in the export,    parties’ involvement in proliferation activities, and    planned end use of the item.
Dual-use items specified in the EAR’s Commerce Control List are  controlled for a variety of reasons, including restricting exports that could  significantly enhance a country’s military potential, preventing exports to  countries that sponsor terrorism, and limiting the proliferation of  chemical, biological, and nuclear weapons and their delivery systems. The  U.S. government controls many of these items under its commitments to  multilateral export control regimes, which are voluntary agreements  among supplier countries that seek to restrict trade in sensitive  technologies to peaceful purposes.
For those exports requiring a license, Executive Order 12981 governs the  dual-use license application review process and establishes time frames  for each step in the review process (see fig. 1).
One of the first steps in the license application review process is the  screening of parties on the application, such as the planned exporter or  end user, against BIS’s internal watchlist to identify ineligible parties or  parties that warrant closer scrutiny. Neither the EAA nor the EAR provide  specific criteria as to which parties are to be included on the watchlist.  However, under the EAR, BIS may deny export privileges to persons  convicted of export violations, and the watchlist serves as a mechanism  for identifying parties that have been denied exporting privileges. This  screening process can also serve as a tool for identifying proposed end  users sanctioned for terrorist activities and, therefore, ineligible to receive  certain dual-use items. BIS has the discretion to add other parties to the  watchlist. A match between the watchlist and a party on an application  does not necessarily mean that the application will be denied, but it can  trigger additional scrutiny by BIS officials, including BIS enforcement  officials, during the license application review process.
While BIS is responsible for administering the dual-use export control  system and licensing dual-use exports, other federal agencies play active  roles. As provided for under Executive Order 12981, the Departments of  Defense, Energy, and State have the authority to review any export license  applications submitted to BIS. These departments specify through  delegations of authority to BIS the categories of applications that they  want to review based, for example, on the item to be exported. License  applications can also be referred to the Central Intelligence Agency (CIA)  for review. After reviewing an application, the agencies are to provide the  BIS licensing officer with a recommendation to approve or deny the  application. In addition to reviewing license applications, the Defense,  Energy, and State Departments are also involved in the regulatory process.  Before changes are made to the EAR and the Commerce Control List, such  as the addition of an item to the list, proposals are reviewed through an  interagency review process. BIS is responsible for issuing the regulatory  changes related to dual-use exports.
For fiscal year 2005, BIS had a budget of $67.5 million, of which  $33.9 million was for the administration of the export control system. Of  the 414 positions at BIS in fiscal year 2005, 48 were licensing officers.  These officers are responsible for developing the Commerce Department  position as to whether an application should be approved and responding  to exporter requests for commodity classifications as well as performing  other duties related to administering the dual-use export control system.
section_title: BIS Has Not Systematically Evaluated the Dual- Use Export Control System to Ensure Its Effectiveness and Efficiency
paragraphs: BIS has not systematically evaluated the overall effectiveness and  efficiency of the system to determine whether its stated goal of protecting  U.S. national security and economic interests is being achieved.  Specifically, it has not comprehensively analyzed key data on actual dual- use exports, including unlicensed exports that represent the majority of  exports subject to its controls. Further, contrary to what is called for  under government management standards, BIS has not established  performance measures to assess how effectively the system is protecting  U.S. interests in the existing security and economic environment. While  BIS has established some measures related to the system’s efficiency,  those measures focus on narrow aspects of the licensing process. BIS  officials also rely on intelligence reports and meetings with industry  officials to provide insight into how the system is operating. After the  events of September 2001, BIS conducted an ad hoc review of the system  to determine if changes were needed. According to BIS officials, no  fundamental changes to the system were needed, but they cited the review  as the basis for some adjustments—primarily related to controls on  chemical and biological agents. However, because BIS did not document  its review, we could not assess the sufficiency of the review and the  resulting changes.
subsections: section_title: BIS’s Assessment of the Dual-Use Export Control System Has Been Limited
paragraphs: In managing the dual-use export control system, BIS has not conducted  comprehensive analyses of available data on items under its control that  have been exported. According to BIS officials, they recently began  conducting limited analyses of export data to evaluate the potential effects  of proposed regulatory changes on U.S. industry. While BIS is cognizant of  dual-use exports authorized through the license application review  process, it has not analyzed export data to determine the extent to which  approved licenses resulted in actual exports. BIS also does not routinely  analyze data on the items and destinations for unlicensed exports, which  represent the majority of exports subject to BIS’s controls.
BIS has not established measures to assess whether it is effectively  achieving its goal of protecting national security and economic interests.  Under the performance management framework established by the  Government Performance and Results Act of 1993, federal agencies are to  develop objective performance measures for assessing how well they are  achieving their goals over time. These measures should focus on an  agency’s outcomes as opposed to its processes. BIS’s lack of effectiveness  measures was noted in a 2005 review by the Office of Management and  Budget (OMB). In response to OMB’s review, BIS indicated plans for  developing measures to assess the system’s effects on national security  and economic interests in consultation with the other agencies involved in  the export control system. BIS officials informed us that their attempt to  devise effectiveness measures did not succeed due to a lack of  cooperation and that they opted not to independently pursue the  development of effectiveness measures.
Without measures of effectiveness to assess it performance, BIS relies on  measures related to the efficiency of the dual-use export control system.  These efficiency-related measures generally focus on the first steps in the  license application review process—how long it takes to review a license  application internally and refer an application to another agency. Over  the last 3 fiscal years, BIS has reported meeting its licensing-related time  frames. However, BIS does not have efficiency-related measures for other  steps in the license application review process, such as how quickly a  license should be issued or denied once other agencies provide their input,  or for the review process as a whole. BIS also does not evaluate the  efficiency of other aspects of the system. Most notably, it does not  measure whether it is meeting the regulatory time frame for the processing  of commodity classification requests, of which there were 5,370 in fiscal  year 2005 or about 24 percent of licensing officers’ workload (see app. I  for additional information on BIS’s processing times).
BIS officials acknowledged that they have not systematically evaluated the  dual-use export control system. Instead, BIS officials informed us that they  regularly review intelligence reports and meet with industry officials to  gauge how well the system is working. A senior BIS official stated there  are no anecdotal indications that the system is not effective. The official  added that “it stands to reason” that BIS’s controls have limited various  parties’ access to U.S. dual-use technologies but that it is difficult to  determine how controls are affecting U.S. industry. Also, as evidence of  how the system is operating, BIS officials referred us to BIS’s annual  report on its foreign policy-based controls. This report summarizes  various regulatory changes from the previous year and what the newly  imposed controls were intended to achieve. However, this report does not  contain an assessment of the impact these controls have had on U.S.  interests. To address its lack of evaluations, BIS officials informed us that  they are in the process of establishing an Office of Technology Evaluation.  BIS is hiring analysts to evaluate topics including how dual-use items  should be controlled and how export controls have affected industry.
Absent systematic evaluations, BIS conducted an ad hoc review after the  September 2001 attacks to determine what changes, if any, needed to be  made to the system in light of the new security environment. However,  according to BIS officials, they did not produce a report or other  documentation regarding their review. Therefore, we could not assess the  validity or sufficiency of BIS’s review and the resulting changes. BIS  officials told us they determined that, other than some adjustments to its  controls, no fundamental changes to the system were needed because they  already had controls and procedures in place to deny terrorists access to  dual-use technologies. Of the hundreds of regulatory changes made since  September 2001, BIS officials identified the following specific changes as  stemming from their ad hoc review    establishing a worldwide licensing requirement for exports of    changing the licensing requirement for biological agent fermenters  from fermenters larger than 100 liters to those larger than 20 liters;    controlling components that can be used in the manufacture of  chemical agents;  including additional precursors for the development of chemical  agents on the Commerce Control List;  revising licensing requirements to further restrict U.S. persons from  designing, developing, producing, stockpiling, or using chemical or  biological weapons;  requiring licenses for exports of equipment related to the  production of chemical or biological agents to countries that are not  members of the Australia Group;  imposing controls on exports of unmanned aerial vehicles capable  of dispersing more than 20 liters of chemical or biological agents;  and    adding amorphous silicon plane arrays, which can be used in night  vision or thermal imaging equipment, to the Commerce Control List.
According to BIS officials, their review did not result in changes to the  license application review process after the events of September 2001.  However, decisions by other agencies—namely the Energy Department  and the CIA—have resulted in BIS referring more license applications to  them. Specifically, in response to Energy’s request, BIS began referring  applications related to missile technologies and chemical or biological  agents, in addition to the nuclear-related applications Energy was already  reviewing. Similarly, based on discussions between BIS and the CIA, the  decision was made to refer more applications to the CIA for review to  determine whether foreign parties of concern may be involved in the  proposed export (see app. I for information on BIS referral rates).
Additionally, in response to the changing security environment after  September 2001, BIS reprioritized its enforcement activities. Specifically,  BIS enforcement officials are to give highest priority to dual-use export  control violations involving the proliferation of weapons of mass  destruction, terrorist organizations, and exports for unauthorized military  or government uses. Further, senior BIS officials noted that they have  made regulatory changes to reflect the dynamic geopolitical environment,  such as changing licensing requirements for exports to India, Iraq, Libya,  and Syria.
section_title: Omissions and Weaknesses Undermine BIS’s Screening of Applications against the Watchlist
paragraphs: BIS’s watchlist is intended to facilitate the identification of license  applications involving individuals and companies representing an export  control concern. However, BIS’s watchlist is incomplete, as numerous  export control violators and terrorists are not included on the list. Further,  BIS’s process for screening applications does not ensure that all parties on  all applications are screened against the watchlist. As a result, the  watchlist’s utility in the license application review process is undermined,  which increases the risk of dual-use items falling into the wrong hands.
subsections: section_title: BIS’s Watchlist Is Incomplete
paragraphs: BIS’s watchlist does not include certain companies, organizations, and  individuals that are known entities of export control concern and,  therefore, warrant inclusion on the watchlist. Based on our comparison of  the watchlist to publicly available U.S. government documents, including  ones available through BIS’s Web site, we identified 147 parties that had  either violated U.S. export control requirements, been determined to be  suspicious end users, or committed acts of terror but were not on BIS’s  watchlist. BIS officials confirmed that, at the time of our review, the  parties we identified were not on BIS’s watchlist. Specifically, we  identified    5 export control violators that have been denied dual-use export    60 companies and individuals that had committed export control  violations and were, therefore, barred by the State Department from  being involved in the export of defense items;    52 additional companies and individuals that have been  investigated, charged, and, in most cases, convicted of export  control violations;    2 overseas companies whose legitimacy as end users could not be  established by BIS; and    28 organizations identified by the State Department as committing  acts of terror.
The above individuals and companies we identified as not being on the BIS  watchlist include those that have exported or attempted to export  weapons to terrorist organizations, night vision technologies to embargoed  countries, and materials that can be used in biological and missile  programs. The terrorist organizations include one that has staged attacks  against U.S. and coalition forces in Afghanistan and another that has  attacked and abducted large numbers of civilians, including children.
BIS’s standard for including a party on its watchlist is that the party  represents an export control concern. BIS does not have an official  definition or explanation as to what constitutes an export control concern.  As a result, the decision as to whether a party should be added to the  watchlist is left to the judgment of the BIS personnel responsible for  maintaining the watchlist. The only specific guidance BIS provides is that  parties under investigation by BIS enforcement officials must be added to  the watchlist. BIS officials told us that the reasons a company,  organization, or individual should be added to the watchlist include  previous violations of U.S. export control regulations, inability to  determine a party’s legitimacy, possible support of international terrorism,  and possible involvement with missile programs of concern. The  147 parties we identified fall within these categories. In addition, BIS  officials do not regularly review the watchlist to ensure its completeness.  BIS officials said they do not conduct periodic checks as to whether  particular parties have been added to the list. They also do not compare  the BIS watchlist to other federal agencies’ lists or databases used for  similar purposes to determine whether the BIS watchlist is missing  pertinent parties.
BIS officials offered several explanations for why the 147 parties were not  on the watchlist. First, they acknowledged it was an oversight on their part  not to include several of the parties on the watchlist. For example, at least  two parties were not added to the watchlist because the BIS personnel  involved thought they had been added by someone else. Second, for some  of the parties, BIS did not receive information from another agency about  export control-related investigations. However, these parties could have  been identified through publicly available reports. Third, BIS relies on  limited sources to identify parties involved in terrorist activities. The  officials explained that their primary source for identifying terrorist  organizations is the Treasury Department’s public listing of designated  terrorists. While Treasury maintains a list of terrorists, its list is not  exhaustive and therefore, does not include all known terrorist  organizations. Finally, BIS officials noted that many of the parties we  identified were individuals and that they do not typically add individuals to  the watchlist because applications generally contain names of companies.  However, we found numerous individuals included on the watchlist and  individuals can and do appear on license applications.
section_title: BIS’s Process Does Not Ensure That All Parties Are Screened against the Watchlist
paragraphs: BIS’s process for screening applications does not ensure that all parties  are screened against the watchlist. To screen parties on applications  against the watchlist, BIS relies on a computerized process. The computer  system recognizes parties that are identified in one of five specified fields  and automatically screens the parties identified in those fields against the  watchlist. If there are multiple parties, BIS’s regulations direct the  applicant to list the additional parties in the “Additional Information” field.  However, the computer system does not recognize the parties listed in that  field, which means the parties are not automatically screened against the  watchlist. While BIS officials told us that they may identify applications  involving multiple parties and manually screen them against the watchlist,  they do not have a systematic means of identifying applications involving  parties listed in the “Additional Information” field. As a result, BIS cannot  ensure that all parties on all applications have been screened. Based on  our review of licensing data for the past 8 years, we identified at least  1,187 applications involving multiple parties that would not have been  automatically screened. BIS officials informed us that they are aware of  this limitation, but have not conducted reviews to determine the number  of applications affected.
According to BIS officials, since most applications are reviewed by other  agencies, the risk of not screening all parties is lessened. However, a  senior BIS official acknowledged that by not screening all applications  against the BIS watchlist, applications involving parties that are the  subject of BIS enforcement investigations would not be identified as that  information only resides on the BIS watchlist. Defense and State officials,  to whom most license applications are referred, stated that they do not  maintain watchlists for the screening of dual-use export license  applications and expect BIS to have already screened all parties before  referring applications to them. BIS officials informed us of their plans to  develop a new computerized screening system to ensure that all parties on  applications are screened against the watchlist. However, the new system  will not be operational for several years.
section_title: BIS Has Not Corrected Some Weaknesses Identified In Prior GAO Reports
paragraphs: In the years since the September 2001 terror attacks, GAO has issued a  number of reports identifying weaknesses in the dual-use export control  system. The weaknesses identified in many of the prior reports relate to  ensuring that export controls on sensitive items protect U.S. interests and  are consistent with U.S. law. Some of our recommendations to correct  those weaknesses remain unimplemented (see app. II for more detailed  information on these reports and the status of recommendations).
Among the weaknesses identified in prior GAO reports is the lack of  clarity as to which items are controlled and whether they are controlled by  the Commerce Department or the State Department. A lack of clarity as to  whether an item is Commerce-controlled or State-controlled increases  the risk that defense-related items will be improperly exported and U.S.  interests will be harmed as a result. In most cases, State’s controls over  arms exports are more restrictive than Commerce’s controls over dual-use  items. For example, a State-issued license is generally required for arms  exports, whereas many dual-use items do not require licenses for export to  most destinations. Further, most arms exports to China are prohibited,  while dual-use items may be exported to China.
In 2002, we reported that BIS had improperly informed exporters through  the commodity classification process that their items were subject to  Commerce’s export control requirements, when in fact the items were  subject to State’s requirements. BIS made improper determinations  because it rarely obtained input from the Departments of State or Defense  during the commodity classification process on which department had  jurisdiction over the items in question. We recommended that the  Commerce Department, together with the Departments of State and  Defense, develop agreed-upon criteria for determining which classification  requests should be referred to the other departments, which would  minimize the risk of improper determinations. However, BIS has not  implemented our recommendation and continues to refer only a few  commodity classifications to the Departments of State and Defense. In  fiscal year 2005, BIS processed 5,370 commodity classification requests  and referred only 10 to State and Defense. Additionally, in 2001, we  reported that export control jurisdiction between the Departments of State  and Commerce had not been clearly established for almost 25 percent of  the items the U.S. government has agreed to control as part of its  commitments to the multilateral Missile Technology Control Regime. The  two departments have yet to take action to clarify which department has  jurisdiction over these sensitive missile technology items. As a result, the  U.S. government has left the determination of jurisdiction to the exporter,  who by default can then determine which national policy interests are to  be considered and acted upon when defense-related items are exported.
BIS has taken actions to address other weaknesses identified in GAO  reports. For example, in response to a 2004 GAO report, BIS expanded its  licensing requirements for the export of missile technology items to  address missile proliferation by nonstate actors. Similarly, BIS  implemented GAO’s recommendation to require exporters to inform end  users in writing of any conditions placed on licenses to help ensure that  the end users abide by those restrictions.
section_title: Conclusions
paragraphs: Exports of dual-use items are important to a strong U.S. economy, but in  the wrong hands, they could pose a threat to U.S. security and foreign  policy interests. However, BIS has not demonstrated whether the dual-use  export control system is achieving its goal of protecting national security  and economic interests in the post-September 2001 environment. Without  systematic evaluations, BIS cannot readily identify weaknesses in the  system and implement corrective measures that allow U.S. companies to  compete in the global marketplace while minimizing the risk to other U.S.  interests. Further, the absence of known parties of concern on the BIS  watchlist and limitations in the screening process create vulnerabilities  and are illustrative of what can happen when there is not an emphasis on  evaluating how well a system is operating and taking corrective action to  address known deficiencies. Also, the weaknesses and associated risks  identified in prior GAO reports will persist until the remaining  recommendations are implemented. Until corrective actions are taken, the  United States will continue to rely on BIS’s management of the dual-use  export control system with known vulnerabilities and little assurance that  U.S. interests are being protected.
section_title: Recommendations for Executive Action
paragraphs: To ensure that the dual-use export control system is effective as well as  efficient in protecting U.S. interests, we recommend that the Secretary of  Commerce direct the Under Secretary for Industry and Security to take the  following four actions  identify and obtain data needed to evaluate the system;  review existing measures of efficiency to determine their  appropriateness and develop measures that address commodity  classifications;    develop, in consultation with other agencies that participate in the  system, measures of effectiveness that provide an objective basis  for assessing whether progress is being made in achieving the goal  of protecting U.S. interests; and  implement a plan for conducting regular assessments of the dual- use export control system to identify weaknesses in the system and  corrective actions.
To ensure that BIS has a process that effectively identifies parties of  concern during the export license application review process, we  recommend that the Secretary of Commerce direct the Under Secretary  for Industry and Security to take the following three actions    develop criteria for determining which parties should be on the  watchlist;  implement regular reviews of the watchlist to help ensure its  completeness; and    establish interim measures for screening all parties until the  planned upgrade of the computerized screening system eliminates  current technical limitations.
To mitigate the risks identified in prior GAO reports related to the dual-use  export control system, we recommend that the Secretary of Commerce  direct the Under Secretary for Industry and Security to report to Congress  on the status of GAO recommendations, the reasons why  recommendations have not been implemented, and what other actions, if  any, are being taken to address the identified weaknesses.
section_title: Agency Comments and Our Evaluation
paragraphs: We provided a draft of this report to the Departments of Commerce,  Defense, and State. In its comments on the draft, the Commerce  Department did not respond to any of our recommendations and disagreed  with our findings and characterizations of the U.S. dual-use export control  system following the September 2001 terror attacks. The Departments of  Defense and State had no comments on the draft report. The Energy  Department declined the opportunity to review and comment on the draft  report.
In introducing its overall comments, the Commerce Department raises  concerns regarding the report’s scope. Commerce states that we expanded  the initial scope of our audit from narrowly looking at BIS’s response to  the September 2001 terror attacks to the three issues we address in our  report. In fact, the scope of our audit has remained the same. To examine  BIS’s dual-use export control system and whether changes to the system  were made, we focused on three specific issues related to how well the  system is operating in the post-September 2001 environment. Based on our  examination of these issues, we concluded that there are vulnerabilities in  the dual-use export control system and that BIS can provide few  assurances that the system is protecting U.S. interests in the current  environment. After considering the Commerce Department’s extensive  comments, our report’s findings, conclusions, and resulting  recommendations remain unchanged.
In commenting on our findings, the Commerce Department states that our  report presumes BIS must develop a national security strategy to  administer the dual-use export control system. Our report does not  presume this as our recommendations address the need for BIS to develop  performance measures and conduct systematic evaluations for  determining the extent to which the system is meeting its stated goal of  protecting both national security and economic interests. The Commerce  Department further states that BIS represents the “gold standard” for its  rigorous process of defining priorities, implementing plans, and measuring  success. To support this statement, Commerce lists several actions that  BIS has taken since September 2001 and cites BIS’s “Game Plan” as  identifying BIS’s priorities and providing a basis for measuring BIS’s  performance. However, BIS has not evaluated what effects these actions  have had on U.S. interests. Also, the “Game Plan” provided to us at the end  of our review did not contain performance measures for assessing how  dual-use export controls affect national security or economic interests.  Further, OMB determined in its 2005 Program Assessment Rating Tool that  BIS lacked measures related to its fundamental purpose. Absent  performance measures and systematic evaluations, it is unclear what the  basis was for the various actions taken by BIS, what the impact of these  actions has been on national security and economic interests, whether  these actions are sufficient to protect U.S. interests in the current  environment, or how BIS represents the gold standard.
The Commerce Department also comments that our report is misleading  and does not provide sufficient context for our findings related to BIS’s  watchlist. According to Commerce, the 147 parties we identified as not  being on the list should be placed in the context of the approximately  50,000 names that are on BIS’s watchlist, and no licenses were issued to  the 147 parties. Commerce’s comment does not address our basic point. It  was not our intent to identify every party that should be on BIS’s watchlist.  Nor did we seek to determine whether licenses were issued to parties not  on the watchlist, in part, because BIS’s regulations permit the approval of  license applications involving parties on the watchlist. Instead, the point of  our finding and our related recommendations is that BIS does not have  mechanisms for ensuring a robust watchlist and screening process. To  provide additional context, we adjusted the text to reflect the number of  names on the watchlist. The Commerce Department also notes that the  watchlist is only one check during the license application review process  and that there are multiple layers and agencies involved—a fact we  address in our report. According to Commerce, the built-in redundancies  in the review process minimize the possibility of a party slipping through  the cracks. We agree that having multiple layers of review can create an  effective system of checks and balances, but only if each agency is  fulfilling its responsibilities at each stage in the review. The other agencies  involved in the process clearly expect BIS to have a robust watchlist  screening process. BIS’s stated reliance on others to compensate for  weaknesses in its watchlist creates gaps in the review process and,  therefore, undermines the ability of the system to effectively protect U.S.  interests. While the Commerce Department cites some measures BIS has  taken recently to refine the watchlist, these measures do not address the  weaknesses created by the lack of criteria and reviews of who should be  on the watchlist or the technical limitations that result in some parties not  being screened against the watchlist.
Regarding its implementation of GAO’s prior recommendations, the  Commerce Department states that BIS has met most of the  recommendations and maintains that none of the outstanding  recommendations puts BIS’s mission at risk. We disagree since BIS has not  implemented recommendations that address the most basic aspects of the  export control system. Specifically, BIS’s failure to implement  recommendations that would provide for clear, transparent decisions  about export control jurisdiction increases the risk that sensitive defense- related items will be improperly exported and that some exporters will be  placed at a competitive disadvantage—undermining BIS’s goal of  protecting national security and economic interests.
The Commerce Department also provided technical comments, which we  incorporated into our report as appropriate. Commerce’s comments are  reprinted in appendix III, along with our supplemental responses.
section_title: Scope and Methodology
paragraphs: To assess BIS’s evaluations of the dual-use export control system’s  efficiency and effectiveness after the events of September 2001, we  compared BIS’s annual reports, performance plans, and budget  submissions with performance management and internal control  standards. These standards call for federal agencies to develop results- oriented goals, measure progress toward achieving those goals, and have  procedures that provide reasonable assurances about the agency’s  effectiveness and efficiency. We also spoke with senior BIS officials to  identify evaluations they conducted of the system, particularly those  conducted after the 2001 terror attacks, and discussed how those  evaluations were conducted. To identify changes made to the system, we  interviewed BIS officials and reviewed BIS regulatory notices issued since  September 2001. Additionally, we interviewed officials from the CIA and  the Departments of Defense, Energy, and State to determine changes to  the system based on their participation in the dual-use licensing and  regulatory processes. We also examined existing data on the system.  Specifically, we analyzed data from BIS’s Export Control Automated  Support System on applications and commodity classification requests  closed between fiscal years 1998 and 2005. To assess data reliability, we  performed electronic testing of relevant data elements, interviewed  knowledgeable agency officials, and reviewed system documentation. We  determined the data were sufficiently reliable for the purposes of our  review.
In examining the BIS watchlist, we reviewed BIS’s internal guidance for  adding parties to the watchlist and discussed with BIS officials the various  sources and reasons they use to add parties to the watchlist. Using the  reasons they identified, we compared BIS’s watchlist, dated January 2006,  to documents publicly available through U.S. government Web sites to  assess the list’s completeness. These documents included BIS’s Denied  Persons List, Unverified List, and Major Cases List; the State  Department’s Debarred Parties List and Patterns of Global Terrorism  report; and the Homeland Security Department’s fact sheet on arms and  strategic technologies investigations. We confirmed with BIS officials  that the parties we identified were not on the watchlist and discussed  reasons they were excluded. We also discussed BIS’s process for  screening applications with BIS officials and reviewed BIS’s internal  guidance.
To determine the status of GAO’s prior recommendations to correct  weaknesses in the system, we identified reports issued between fiscal  years 2001 and 2005 regarding the dual-use export control system and their  recommendations. We reviewed BIS’s regulatory notices to determine  whether BIS made regulatory changes in response to GAO’s  recommendations. We also followed up on the status of recommendations  through interviews with Commerce, Defense, and State officials and  reviews of supporting documentation they provided.
We requested data for fiscal years 2004 and 2005 on actual exports of dual- use items from the Bureau of the Census. As discussed with your staff, we  requested the data in October 2005 and did not receive the data in time for  inclusion in this report after multiple attempts to obtain the data. The  delays from Census prevented us from reporting on actual dual-use  exports as planned.
As agreed with your office, unless you publicly announce the contents of  this report earlier, we plan no further distribution of it until 30 days from  the date of this letter. We will then send copies of this report to interested  congressional committees as well as the Secretaries of Commerce,  Defense, Energy, and State; the Director, Central Intelligence Agency; the  Director, Office of Management and Budget; and the Assistant to the  President for National Security Affairs. In addition, this report will be  made available at no charge on the GAO Web site at http://www.gao.gov.
Please contact me at (202) 512-4841 or calvaresibarra@gao.gov if you or  your staff have any questions concerning this report. Contact points for  our Offices of Congressional Relations and Public Affairs may be found on  the last page of this report. GAO staff who made major contributions to  this report are listed in appendix IV.
section_title: Appendix I: Trends in Dual-Use Export Licensing
paragraphs: The number of dual-use export license applications processed by the  Department of Commerce’s Bureau of Industry and Security (BIS) has  increased over the last several years. These applications were generally for  the export of items in the following categories: materials, chemicals,  microorganisms, and toxins; nuclear materials, facilities and equipment  and miscellaneous items; telecommunications and information security;  and other items subject to BIS’s controls but not specified on the  Commerce Control List. As shown in figure 2, from fiscal years 1998  through 2005, the number of applications processed increased by over  50 percent.
Additionally, BIS has been referring a larger percentage of applications to  other agencies for their review. From fiscal year 1998 to 2005, the total  percentage of applications referred to other agencies increased from about  85 percent to about 92 percent. As shown in figure 3, the greatest increases  were in the percent of applications referred to the Department of Energy  and the Central Intelligence Agency (CIA).
After the license application review process is completed, BIS can approve  an application, return it without action, or reject it. The majority of  applications processed since fiscal year 1998 have been approved, as  shown in figure 4.
Although the number of applications processed by BIS increased over the  last several years, the overall median processing times have remained  relatively stable and consistent with time frames established by executive  order, as shown in figure 5.
As shown in table 1, there have been changes over the years in the top  countries of destination for approved and rejected license applications.  However, applications for dual-use exports to China have consistently  represented a significant portion of BIS’s licensing workload.
As shown in figure 6, referring applications to other agencies increases the  time it takes to process license applications. Between fiscal years 1998 and  2005, referred license applications took about 24 more days to process  than those applications that were processed solely by BIS.
BIS’s workload related to commodity classifications has also increased in  recent years. As shown in figure 7, the number of commodity  classifications almost doubled from fiscal year 1998 to 2005.
BIS continues to exceed the 14-day time frame established in the Export  Administration Regulations for processing commodity classifications, as  shown in figure 8.
section_title: Appendix II: Prior GAO Reports on the Dual- Use Export Control System and the Status of Recommendations (Fiscal Years 2001-2004)
paragraphs: Appendix II: Prior GAO Reports on the Dual- Use Export Control System and the Status of  Recommendations (Fiscal Years 2001-2004)
subsections: section_title: Export Controls: System for Controlling Exports of High Performance Computing Is Ineffective (Dec. 18, 2000, GAO-01-10)
paragraphs: Background: Exports of high performance computers  exceeding a defined performance threshold require an  export license from the Commerce Department. As  technological advances in high performance computing  occur, it may become necessary to explore other options to  maintain the U.S. lead in defense-related technology. As a  step in this direction, the National Defense Authorization  Act for Fiscal Year 1998 required the Secretary of Defense  to assess the cumulative effect of U.S.-granted licenses for  exports of computing technologies to countries and entities  of concern. It also required information on measures that  may be necessary to counter the use of such technologies  by entities of concern. in consultation with other  relevant agencies, convene a  panel of experts to  comprehensively assess and  report to Congress on ways of  addressing the shortcomings of  computer export controls.
The Commerce Department  has implemented our  recommendation.
Main issues: The current system for controlling exports of  high performance computers is ineffective because it  focuses on the performance level of individual computers  and does not address the linking or “clustering” of many  lower performance computers that can collectively perform  at higher levels than current export controls allow.  However, the act does not require an assessment of the  cumulative effect of exports of unlicensed computers, such  as those that can be clustered. countermeasures are  necessary, if any, to respond to  enhancements of the military or  proliferation capabilities of  countries of concern derived  from both licensed and  unlicensed high performance  computing.
The Defense Department has  not implemented our  recommendation.
The current control system is also ineffective because it  uses millions of theoretical operations per second as the  measure to classify and control high performance  computers meant for export. This measure is not a valid  means for controlling computing capabilities.
Export Controls: State and Commerce Department License Review Times Are Similar   (June 1, 2001, GAO-01-528)
Background: The U.S. defense industry and some U.S.  and allied government officials have expressed concerns  about the amount of time required to process export  license applications.
No recommendations.
Not applicable.
Main issues: In fiscal year 2000, State’s average review  time for license applications was 46 days while  Commerce’s average was 50 days. Variables identified as  affecting application processing times include the  commodity to be exported and the extent of interagency  coordination. Both departments approved more than 80  percent of license applications during fiscal year 2000.
Export Controls: Regulatory Change Needed to Comply with Missile Technology Licensing Requirements   (May 31, 2001, GAO-01-530)
Background: Concerned about missile proliferation, the  United States and several major trading partners in 1987  created an international voluntary agreement, the Missile  Technology Control Regime (MTCR), to control the spread  of missiles and their related technologies. Congress  passed the National Defense Authorization Act for Fiscal  Year 1991 to fulfill the U.S. government’s MTCR  commitments. This act amended the Export Administration  Act of 1979, which regulates the export of dual-use items,  by requiring a license for all exports of controlled dual-use  missile technologies to all countries. The National Defense  Authorization Act also amended the Arms Export Control  Act, which regulates the export of military items, by  providing the State Department the discretion to require  licenses or provide licensing exemptions for missile  technology exports.
Our recommendations have not  been implemented. However,  the Commerce Department has  a regulatory change pending  that, once implemented, will  require licenses for the export  of dual-use missile technologies  to Canada.
Congress to specifically permit  MTCR items to be exempted  from licensing requirements.
Main issues: The State Department’s regulations require  licenses for the exports of missile technology items to all  countries—including Canada, which is consistent with the  National Defense Authorization Act. However, the  Commerce Department’s export regulations are not  consistent with the act as they do not require licenses for  the export of controlled missile equipment and technology  to Canada. if Commerce seeks a statutory  change, revise the Export  Administration Regulations to  comply with the current statute  until such time as a statutory  change occurs.
Export Controls: Clarification of Jurisdiction for Missile Technology Items Needed   (Oct. 9, 2001, GAO-02-120)
Background: The United States has committed to work  with other countries through the MTCR to control the  export of missile-related items. The regime is a voluntary  agreement among member countries to limit missile  proliferation and consists of common export policy  guidelines and a list of items to be controlled. In 1990,  Congress amended existing export control statutes to  strengthen missile-related export controls consistent with  U.S. commitments to the regime. Under the amended  statutes, the Commerce Department is required to place  regime items that are dual-use on its list of controlled  items. All other regime items are to appear on the State  Department’s list of controlled items. jointly review the listing of items  included on the MTCR list,  determine the appropriate  jurisdiction for those items, and  revise their respective export  control lists to ensure that  proposed exports of regime  items are subject to the  appropriate review process.
The Departments of Commerce  and State have not  implemented our  recommendations despite  initially agreeing to do so.
Main issues: The Departments of Commerce and State  have not clearly determined which department has  jurisdiction over almost 25 percent of the items that the  U.S. government agreed to control as part of its regime  commitments. The lack of clarity as to which department  has jurisdiction over some regime items may lead an  exporter to seek a Commerce license for a militarily  sensitive item controlled by the State. Conversely, an  exporter could seek a State license for a Commerce- controlled item. Either way, exporters are left to decide  which department should review their exports of missile  items and, by default, which policy interests are to be  considered in the license review process.
Export Controls: Issues to Consider in Authorizing a New Export Administration Act   (Feb. 28, 2002, GAO-02-468T)
Background: The U.S. government’s policy regarding  exports of sensitive dual-use technologies seeks to balance  economic, national security, and foreign policy interests.  The Export Administration Act (EAA) of 1979, as amended,  has been extended through executive orders and law.  Under the act, the President has the authority to control  and require licenses for the export of dual-use items, such  as nuclear, chemical, biological, missile, or other  technologies that may pose a national security or foreign  policy concern. In 2002, there were two different bills  before the 107th Congress—H.R. 2581 and S. 149—that  would enact a new EAA.
No recommendations.
Not applicable.
Main issues: A new EAA should take into consideration  the increased globalization of markets and an increasing  number of foreign competitors, rapid advances in  technologies and products, a growing dependence by the  U.S. military on commercially available dual-use items, and  heightened threats from terrorism and the proliferation of  weapons of mass destruction.
Export Controls: Rapid Advances in China’s Semiconductor Industry Underscore Need for Fundamental U.S. Policy Review  (April 19, 2002, GAO-02-620)
Background: Semiconductor equipment and materials are  critical components in everything from automobiles to  weapons systems. The U.S. government controls the  export of these dual-use items to sensitive destinations,  such as China. Exports of semiconductor equipment and  materials require a license from Commerce Department.  Other departments, such as Defense and State, assist  Commerce in reviewing license applications. The United  States is a member of the multilateral Wassenaar  Arrangement on Export Controls for Conventional Arms  and Dual-Use Goods and Technologies.
After initially disagreeing with  our recommendations, the  Commerce Department has  cited our recommendations as  the basis for increased  resources so it can conduct  the recommended analyses.
Main issues: Since 1986, China has narrowed the gap  between the U.S. and Chinese semiconductor  manufacturing technology from approximately 7 years to  2 years or less. China’s success in acquiring manufacturing  technology from abroad has improved its semiconductor  manufacturing facilities for more capable weapons systems  and advanced consumer electronics. The multilateral  Wassenaar Arrangement has not affected China’s ability to  obtain semiconductor manufacturing equipment because  the United States is the only member of this voluntary  arrangement that considers China’s acquisition of  semiconductor manufacturing equipment a cause for  concern. Additionally, U.S. government policies and  practices to control the export of semiconductor technology  to China are unclear and inconsistent, leading to  uncertainty among U.S. industry officials about the  rationale for some licensing decisions. Furthermore, U.S.  agencies have not done the analyses, such as assessing  foreign availability of this technology or the cumulative  effects of such exports on U.S. national security interests,  necessary to justify U.S. policies and practices. develop new export controls, if  appropriate, or alternative  means for protecting U.S.  security interests; and  these efforts to Congress and  U.S. industry.
Export Controls: More Thorough Analysis Needed to Justify Changes in High Performance Computer Controls   (Aug. 2, 2002, GAO-02-892)
Background: High performance computers that operate at  or above a defined performance threshold, measured in  millions of theoretical operations per second, require a  Commerce license for export to particular destinations. The  President has periodically changed, on the basis of  technological advances, the threshold above which  licenses are required. The National Defense Authorization  Act of 1998 requires that the President report to Congress  the justification for changing the control threshold. The  report must, at a minimum, (1) address the extent to which  high performance computers with capabilities between the  established level and the newly proposed level of  performance are available from foreign countries,  (2) address all potential uses of military significance to  which high performance computers between the  established level and the newly proposed level could be  applied, and (3) assess the impact of such uses on U.S.  national security interests.
No recommendations.
Not applicable.
Main issues: In January 2002, the President announced  that the control threshold—above which computers  exported to such countries as China, India, and Russia— would increase from 85,000 to 190,000 millions of  theoretical operations per second. The report to Congress  justifying the changes in control thresholds for high  performance computers was issued in December 2001 and  focused on the availability of such computers. However, the  justification did not fully address the requirements of the  National Defense Authorization Act of 1998. The December  2001 report did not address several key issues related to  the decision to raise the threshold: (1) the unrestricted  export of computers with performance capabilities between  the old and new thresholds will allow countries of concern  to obtain computers they have had difficulty constructing on  their own, (2) the U.S. government is unable to monitor the  end uses of many of the computers it exports, and (3) the  multilateral process used to make earlier changes in high  performance computer thresholds.
Export Controls: Department of Commerce Controls over Transfers of Technology to Foreign Nationals Need Improvement  (Sept. 6, 2002, GAO-02-972)
Background: To work with controlled dual-use technologies  in the United States, foreign nationals and the firms that  employ them must comply with U.S. export control and visa  regulations. U.S. firms may be required to obtain what is  known as a deemed export license from the Commerce  Department before transferring controlled technologies to  foreign nationals in the United States. Commerce issues  deemed export licenses after consulting with the Defense,  Energy, and State Departments. In addition, foreign  nationals who are employed by U.S. firms should have an  appropriate visa classification, such as an H-1B specialized  employment classification. H-1B visas to foreign nationals  residing outside of the United States are issued by the State  Department, while the Immigration and Naturalization  Service approves requests from foreign nationals in the  United States to change their immigration status to H-1B.
Our recommendations have  been implemented. use available Immigration and  Naturalization Service data to  identify foreign nationals  potentially subject to deemed  export licensing requirements.    establish, with the Defense,  Energy, and State Departments,  a risk-based program to monitor  compliance with deemed export  license conditions. If the  departments conclude that  certain security conditions are  impractical to enforce, they  should jointly develop conditions  or alternatives to ensure that  deemed exports do not place  U.S. national security interests at  risk.
Main Issues: In fiscal year 2001, Commerce approved  822 deemed export license applications and rejected 3.  Most of the approved deemed export licenses allowed  foreign nationals from countries of concern to work with  advanced computer, electronic, or telecommunication and  information security technologies in the United States. To  better direct its efforts to detect possible unlicensed deemed  exports, in fiscal year 2001 Commerce screened thousands  of applications for H-1B and other types of visas submitted  by foreign nationals overseas. From these applications, it  developed 160 potential cases for follow-up by enforcement  staff in the field. However, Commerce did not screen  thousands of H-1B change-of-status applications submitted  domestically to the Immigration and Naturalization Service  for foreign nationals already in the United States. In addition,  Commerce could not readily track the disposition of the  160 cases referred to field offices for follow-up because it  lacks a system for doing so.
Commerce attaches security conditions to almost all  licenses to mitigate the risk of providing foreign nationals  with controlled dual-use technologies. However, according  to senior Commerce officials, their staff do not regularly visit  firms to determine whether these conditions are being  implemented because of competing priorities, resource  constraints, and inherent difficulties in enforcing several  conditions.
Export Controls: Processes for Determining Proper Control of Defense-Related Items Need Improvement   (Sept. 20, 2002, GAO-02-996)
Background: Companies seeking to export defense-related  items are responsible for determining whether those items  are regulated by the Commerce Department or the State  Department and what the applicable export requirements  are. If in doubt about whether an item is Commerce or State- controlled or when requesting a change in jurisdiction, an  exporter may request a commodity jurisdiction determination  from State. State, which consults with Commerce and  Defense, is the only department authorized to change export  control jurisdiction. If an exporter knows an item is  Commerce-controlled but is uncertain of the export  requirements, the exporter can request a commodity  classification from Commerce. Commerce may refer  classification requests to State and Defense to confirm that  an item is Commerce-controlled. guidance and develop criteria  with concurrence from the State  and Defense Departments for  referring commodity classification  requests to those departments.    work with State to develop  procedures for referring requests  that are returned to companies  because the items are controlled  by State or because they require  a commodity jurisdiction review.
With a limited exception, our  recommendations have not  been implemented. In  responding to our report, the  State Department indicated it  partially agreed with our  recommendations, while the  Departments of Commerce  and Defense agreed to  implement our  recommendations.
Main issues: The Commerce Department has improperly  classified some State-controlled items as Commerce- controlled because it rarely obtains input from Defense and  State before making commodity classification  determinations. As a result, the U.S. government faces an  increased risk that defense items will be exported without  the proper level of government review and control to protect  national interests. Also, Commerce has not adhered to  regulatory time frames for processing classification requests.
Commerce, Defense and   State Departments  have added staff to assist  with their respective  processes.
In its implementation of the commodity jurisdiction process,  the State Department has not adhered to established time  frames, which may discourage companies from requesting  jurisdiction determinations. State has also been unable to  issue determinations for some items because of interagency  disputes occurring outside the process. make jurisdiction  recommendations and  determinations within established  time frames and reallocate them  as appropriate.
Nonproliferation: Strategy Needed to Strengthen Multilateral Export Control Regimes   (Oct. 25, 2002, GAO-03-43)
Background: Multilateral export control regimes are a key  policy instrument in the overall U.S. strategy to combat the  proliferation of weapons of mass destruction. They are  consensus-based, voluntary arrangements of supplier  countries that produce technologies useful in developing  weapons of mass destruction or conventional weapons. The  regimes aim to restrict trade in these technologies to prevent  proliferation. The four principal regimes are the Australia  Group, which controls chemical and biological weapons  proliferation; the MTCR; the Nuclear Suppliers Group; and  the Wassenaar Arrangement, which controls conventional  weapons and dual-use items and technologies. All four  regimes expect members to report denials of export licenses  for controlled dual-use items, which provides members with  more complete information for reviewing questionable export  license applications. The United States is a member of all  four regimes.
The State Department has not  implemented our  recommendations. representative to the multilateral  regimes, establish a strategy to  strengthen these regimes. This  strategy should include ways for  regime members to  implement regime changes to  their export controls more  consistently, and  identify organizational  changes that could help  reform regime activities.
Main issues: Weaknesses impede the ability of the  multilateral export control regimes to achieve their  nonproliferation goals. Regimes often lack even basic  information that would allow them to assess whether their  actions are having their intended results. The regimes  cannot effectively limit or monitor efforts by countries of  concern to acquire sensitive technology without more  complete and timely reporting of licensing information and  without information on when and how members adopt and  implement agreed-upon export controls. For example, GAO  confirmed that the U.S. government had not reported its  denial of 27 export licenses between 1996 and 2002 for  items controlled by the Australia Group. Several obstacles  limit the options available to the U.S. government in  strengthening the effectiveness of multilateral export control  regimes. The requirement to achieve consensus in each  regime allows even one member to block action in adopting  needed reforms. Because the regimes are voluntary in  nature, they cannot enforce members’ compliance with  regime commitments. For example, Russia exported nuclear  fuel to India in a clear violation of its commitments under the  Nuclear Suppliers Group, threatening the viability of this  regime. The regimes have adapted to changing threats in  the past. Their continued ability to do so will determine  whether they remain viable in curbing proliferation in the  future. ensure that the United States  reports all license application  denials to regimes.    establish criteria to assess the  effectiveness of the regimes.
Nonproliferation: Improvements Needed to Better Control Technology Exports for Cruise Missiles and Unmanned Aerial  Vehicles   (Jan. 23, 2004, GAO-04-175)
Background: Cruise missiles and unmanned aerial vehicles  (UAV) pose a growing threat to U.S. national security  interests as accurate, inexpensive delivery systems for  conventional, chemical, and biological weapons. Exports of  cruise missiles and military UAVs by U.S. companies are  licensed by the State Department while government-to- government sales are administered by the Defense  Department. Exports of dual-use technologies related to  cruise missiles and UAVs are licensed by the Commerce  Department. assess and report to the  Committee on Government  Reform on the adequacy of the  Export Administration  Regulations’ catch-all provision  to address missile proliferation  by nonstate actors. This  assessment should indicate  ways the provision should be  modified.
The Commerce Department  has addressed our  recommendation by revising its  licensing requirement for  missile technology exports.
Main issues: U.S. export control officials find it increasingly  difficult to limit or track dual-use items with cruise missile or  UAV-related capabilities that can be exported without a  license. A gap in dual-use export control authority enables  U.S. companies to export certain dual-use items to  recipients that are not associated with missile projects or  countries listed in the regulations, even if the exporter knows  the items might be used to develop cruise missiles or UAVs.  The gap results from current “catch-all” regulations that  restrict the sale of unlisted dual-use items to certain national  missile proliferation projects or countries of concern, but not  to nonstate actors such as certain terrorist organizations or  individuals. Catch-all controls authorize the government to  require an export license for items that are not on control  lists but are known or suspected of being intended for use in  a missile or weapons of mass destruction program.
Commerce, Defense and   State Departments    as a first step, each department  complete a comprehensive  assessment of cruise missile,  UAV, and related dual-use  technology transfers to  determine whether U.S.  exporters and foreign end users  are complying with the  conditions on the transfers.
While the Commerce  Department has taken some  actions to address our  recommendations, the others  departments have not done so.
The Departments of Commerce, Defense, and State have  seldom used their end use monitoring programs to verify  compliance with conditions placed on the use of cruise  missile, UAV, or related technology exports. For example,  Commerce conducted visits to assess the end use of items  for about 1 percent of the 2,490 missile-related licenses  issued between fiscal years 1998 and 2002. Thus, the U.S.  government cannot be confident that recipients are  effectively safeguarding equipment in ways that protect U.S.  national security and nonproliferation interests. department conduct additional  postshipment verification visits  on a sample of cruise missile  and UAV licenses.
Export Controls: Post-Shipment Verification Provides Limited Assurance that Dual-Use Items Are Being Properly Used   (Jan. 12, 2004, GAO-04-357)
Background: The Commerce Department conducts post- shipment verification (PSV) checks to ensure that dual-use  items arrive at their intended destination and are used for  the purposes stated in the export license. To conduct PSV  checks, Commerce personnel visit foreign companies to  verify the use and location of exported items. PSVs serve as  one of the primary means of checking whether end users  are complying with conditions imposed by the license.  Commerce placed conditions on nearly all approved  licenses for exports to countries of concern for fiscal years  2000 to 2002.
Our recommendations have  been implemented. improve technical training for  personnel conducting PSV  checks to ensure they are able  to verify compliance with license  conditions.  conducting PSV checks assess  compliance with license  conditions.
Main issues: In fiscal years 2000 to 2002, the Commerce  Department approved 7,680 licenses for dual-use exports to  countries of concern, such as China, India, and Russia.  However, we found that during this time Commerce  completed PSV checks on only 428 of the dual-use licenses  it approved for countries of concern. require that the exporter inform  the end user in writing of the  license conditions.
We identified three key weaknesses in the PSV process that  reduce its effectiveness. First, PSVs do not confirm  compliance with license conditions because U.S. officials  often lack the technical training needed to assess  compliance and end users may not be aware of the license  conditions by which they are to abide. Second, some  countries of concern, most notably China, limit the U.S.  government’s access to facilities where dual-use items are  shipped, making it difficult to conduct a PSV. Third, PSV  results have only a limited impact on future licensing  decisions. Companies receiving an unfavorable PSV may  receive greater scrutiny in future license applications, but  licenses for dual-use exports to these companies can still be  approved. In addition, according to Commerce officials, past  PSV results play only a minor role in future enforcement  actions.
5, §1211, 111 Stat. 1932-34 (1997).  1 nor S. 149 was enacted.
section_title: Appendix III: Comments from the Department of Commerce
subsections: section_title: GAO Comments
paragraphs: 1.  The scope of our review has remained unchanged. We examined BIS’s  dual-use export control system and whether changes were made to the  system by focusing on three specific issues related to how well the  system is operating in the post-September 2001 environment.   2.  Our report is not premised on a need for BIS to develop a national  security strategy, which is outside of BIS’s mission. BIS’s stated goal is  the protection of national security and economic interests. In its  comments, BIS appears to define “national security interests” in terms  of the administration’s National Security Strategy, but BIS has not  developed performance measures to evaluate or determine whether the  dual-use export control system is supporting and furthering that  strategy. Commerce’s comments also do not address what effects the  dual-use export control system has had on U.S. economic interests.   3.  The eight specific measures cited in our report are not “samples” of  steps taken by BIS. Rather, they represent all of the changes identified  by BIS officials as a result of their ad hoc review to determine what  changes, if any, should be made to the system after the September 2001  terror attacks.   4.  Our report accurately depicts what BIS officials told us regarding the ad  hoc review they conducted in the aftermath of the 2001 terror attacks.  Given that BIS officials did not document their review, we can neither  confirm what the review consisted of nor determine the sufficiency of  this review and the resulting changes.   5.  Our report acknowledges that BIS made adjustments to its enforcement  efforts in response to the changing security environment. Also, GAO is  currently conducting a separate review of export control enforcement  efforts.   6.  Our report identifies the specific changes BIS officials stated were the  result of their post-September 2001 ad hoc review and acknowledges  that BIS has reprioritized its enforcement efforts and taken other  actions as a result of various geopolitical changes. However, without  performance measures and systematic evaluations, BIS is not in a  position to readily identify weaknesses in the dual-use export control  system, implement corrective measures, and determine whether those  measures are having the intended effects of protecting U.S. national  security and economic interests.  7.  Commerce’s characterization of BIS’s annual foreign policy report is  misleading. BIS’s annual report summarizes export control changes and  describes what those changes were intended to achieve. BIS’s report  does not contain an assessment of the actual impact foreign policy- based controls have had on U.S. interests.   8.  Our report acknowledges that there have been over 100 amendments to  the EAR since September 2001. However, based on our review of those  amendments, the specific basis for many of these revisions is not clear  and given BIS’s lack of evaluations, the impact of these revisions is  unknown. Also, it should be noted that many of the regulatory  amendments made since September 2001 consisted of administrative  changes and technical corrections as opposed to revisions of export  requirements for dual-use items.   9.  The quotes from senior BIS officials’ speeches do not address whether  the dual-use export control system is protecting U.S. interests nor do  they provide other evidence that BIS has developed performance  measures or conducted systematic evaluations. While these speeches  outline BIS’s mission and the role of export controls, the lack of  performance measures and systematic evaluations precludes a  determination as to whether that mission and role are being  successfully fulfilled. It is also unclear how changing the bureau’s name  is an example of a successful adaptation to the current environment.  Further, the increased scrutiny of license applications was not the  result of BIS’s actions as one of the quotes implies. As discussed in our  report, increases in the referral of license applications resulted from  decisions by other agencies involved in the application review process.   10. Absent any documentation to the contrary, particularly when BIS  officials repeatedly acknowledged that BIS had not undertaken  systematic evaluations, we stand by our finding that BIS has not  systematically evaluated the overall effectiveness and efficiency of the  dual-use export control system. Regarding BIS’s ad hoc post-September  2001 review, we could not assess the validity and sufficiency of the  review and resulting changes due to the lack of documentation.   11. Commerce’s description of BIS’s Game Plan is misleading and  inaccurate. First, BIS’s mission and priorities as summarized in the  Game Plan are not consistent with the mission and goals stated in  Commerce’s official performance management documents, such as the  annual performance plan. The Game Plan may represent BIS’s thoughts  for how to align activities and priorities in the future, but it does not  depict what has been in place since the September 2001 terror attacks.  Second, the Game Plan does not contain measures of effectiveness.  When we discussed the Game Plan with BIS officials, they  acknowledged that they had not developed measures for evaluating  how well the dual-use export control system is protecting national  security and economic interests.   12. We agree that the development of measures for determining the  effectiveness of the dual-use export system would be difficult.  However, BIS’s existing performance measures, which focus on  processing times, fall far short of government management standards  since they do not provide a basis for determining whether the system is  protecting U.S. interests.   13. Our report presents BIS’s position that it was unable to obtain  assistance from other agencies to develop performance measures for  assessing the dual-use export control system’s effects on national  security and economic interests. The two examples of performance  measures provided in Commerce’s comments do not relate to BIS’s  administration of the export controls system, which was the focus of  our review, but rather to BIS’s export enforcement efforts and  assistance to other countries. Also, it is not clear how these two  measures would provide BIS with a basis for determining the security  and economic impact of its controls on dual-use exports. Additionally,  Commerce’s statement that BIS is assigning staff to develop a  methodology for evaluating the system’s effectiveness indicates that  BIS does not yet have a systematic evaluation process in place.   14. Our report discusses that, in the absence of systematic evaluations, BIS  officials obtain information from industry to gauge how the dual-use  export control system is operating. However, the collection of data  from industry does not constitute a measure or evaluation of how the  dual-use export control system is affecting U.S. economic interests.  Also, BIS officials repeatedly informed us that they do not have  measures for determining the impact of dual-use export controls on  economic interests.   15. The Office of Management and Budget determined in its 2005 review  that BIS lacked measures related to the fundamental purpose of the  dual-use export controls system. Given this and our evaluation as well  as BIS’s limited measures of efficiency and lack of comprehensive  analyses as to which items under its control have actually been  exported, BIS is not meeting government performance management  standards and, therefore, does not represent the gold standard.  16. We examined the completeness of the watchlist and the thoroughness  of BIS’s watchlist screening process and found omissions in the list and  weaknesses in the process. Our intent was not to determine whether  licenses were approved for parties not on the watchlist. As our report  explains, a match between an application and the watchlist does not  necessarily mean that the application will be denied but that the  application will be more closely scrutinized during the license  application review process.   17. Our report places BIS’s watchlist in the context of the larger license  application review process. A process built on multiple layers and  multiple agencies is only as strong as its weakest link. Other agencies  that participate in the license application review process expect BIS to  thoroughly screen all parties on all applications against the watchlist  before referring applications to them. Given the omissions we identified  in the watchlist and the weakness in the screening process, BIS’s  watchlist is not serving its intended purpose of helping identify those  license applications that warrant additional scrutiny.
We identified many of the 147 parties not on the watchlist by using the  lists cited in Commerce’s comments. While BIS expects exporters to  check these publicly available lists, we found that BIS failed to include  all of the publicly-listed parties on its watchlist. It is reasonable that BIS  would focus its licensing and enforcement efforts on the “truly bad  actors.” However, given that the watchlist is supposed to help BIS  identify parties of export control concern, BIS’s ability to focus on “bad  actors” is undermined by the omissions we identified in the watchlist.   18. The 147 parties we identified should not be regarded as an exhaustive  list of every party of export control concern that should be on BIS’s  watchlist. Our intent was not to identify all parties but rather to  evaluate the process that BIS uses to determine which parties should be  on the list. Therefore, the 147 parties represent examples that illustrate  weaknesses in BIS’s management of the watchlist. However, to provide  additional context, we revised the text to include the number of names  on the BIS watchlist.  19. The measures listed in Commerce’s comments do not address the  underlying weaknesses we identified or our corrective  recommendations.   20. Our report accurately reflects that several, but not all, of GAO’s prior  recommendations regarding the dual-use export control system have  been implemented. BIS’s disagreement with the conclusions of GAO’s  report on China’s semiconductor industry does not change the fact that  BIS continues to cite that report and its recommendations as  justification for requested increases in resources. However, BIS has not  implemented the report’s recommendations.
The continued failure to address GAO’s recommendations regarding the  commodity classification process and export control jurisdiction places  BIS’s mission of protecting national security and economic interests at  risk. Improper decisions regarding jurisdiction and the lack of clear  jurisdiction create the risk that defense-related items will be exported  without the proper level of government review and control to protect  national interests. These weaknesses can also result in companies  seeking to export similar items under the different controls of the  Departments of State and Commerce, which places some companies at  a competitive disadvantage.   21. As discussed in our report’s scope and methodology, we reviewed BIS’s  documents, such as its performance plans, that contain BIS’s official  performance measures. None of these documents contains  performance measures related to the processing of commodity  classifications. During meetings with BIS officials, they did not identify  additional measures for evaluating the system’s effectiveness. Also,  Commerce’s comment is misleading, as our report does not cite BIS  statistics on commodity classifications. Our report contains GAO’s  analyses of BIS’s data on commodity classification processing times  and shows that BIS has exceeded regulatory processing time frames.   22. We are not revising the graphic because it depicts what can occur in the  license application review process under different circumstances.   23. Text revised to further clarify the CIA’s role in the license application  review process.   24. The examples provided by Commerce are limited to BIS’s analyses of  licensing data. However, BIS has not comprehensively analyzed data on  actual exports, particularly on unlicensed exports that represent the  majority of exports subject to BIS’s control.   25. Our report states that Executive Order 12981 provides time frames for  the entire license application review process. However, none of BIS’s  performance measures addresses the timeliness of the entire process.  Also, BIS has not reported overall timeframes consistently in its annual  reports.  26. Our draft report cited changes in BIS’s licensing policy for dual-use  exports to Iraq as an illustrative example; however, we have revised our  report to include the other countries listed in Commerce’s comments.   27. Despite Commerce’s comment regarding its sources, some of the 147  parties we identified as not being on the watchlist appear on publicly  available documents from the State Department’s Directorate of  Defense Trade Controls and the Homeland Security Department’s  Immigration and Customs Enforcement.   28. We are not revising the text based on Commerce’s comment because  our report accurately reflects how the Treasury Department  characterizes the list it maintains on individuals and companies.   29. Despite Commerce’s comment that it adds individuals to its watchlist,  we identified many individuals who were not on the list but should have  been.   30. Our report explains that BIS has a regulatory change pending that once  implemented will address this recommendation from 2001.   31. Commerce’s actions regarding production equipment for missile  technology items do not resolve the lack of clear jurisdiction between  State and Commerce as to which department controls the export of  almost 25 percent of the missile technology items the U.S. government  agreed to control as part of its commitments to the Missile Technology  Control Regime. As a result, GAO’s recommendations regarding this  matter remain unimplemented.   32. See comment 20.   33. The memorandum contained in Commerce’s comments does not  address GAO’s recommendations that BIS develop criteria, with the  concurrence of the State and Defense Departments, for the referral of  commodity classification requests and develop procedures for referring  other commodity classification requests to the State Department. As a  result, GAO’s recommendations regarding this matter remain  unimplemented.   34. We revised the report text to more clearly reflect BIS’s actions.
section_title: Appendix IV: GAO Contact and Staff Acknowledgments
subsections: section_title: Staff Acknowledgments
paragraphs: In addition to the contact named above, Anne-Marie Lasowski, Assistant  Director; Johana R. Ayers; Lily Chin; Arthur James, Jr.; Megan Masengale;  Margaret B. McDavid; Bradley Terry; Karen Thornton; and Joseph Zamoyta  made key contributions to this report.
section_title: Related GAO Products
paragraphs: Defense Trade: Arms Export Control Vulnerabilities and Inefficiencies  in the Post-9/11 Security Environment. GAO-05-468R. Washington, D.C.:   April 7, 2005.
Defense Trade: Arms Export Control System in the Post- 9/11Environment. GAO-05-234.  Washington, D.C.: February 16, 2005.
Nonproliferation: Improvements Needed to Better Control Technology  Exports for Cruise Missiles and Unmanned Aerial Vehicles. GAO-04-175.  Washington, D.C.: January 23, 2004.
Export Controls: Post-Shipment Verification Provides Limited  Assurance That Dual-Use Items Are Being Properly Used. GAO-04-357.  Washington, D.C.: January 12, 2004.
Nonproliferation: Strategy Needed to Strengthen Multilateral Export  Control Regimes. GAO-03-43. Washington, D.C.: October 25, 2002.
Export Controls: Processes for Determining Proper Control of Defense- Related Items Need Improvement. GAO-02-996.  Washington, D.C.:  September 20, 2002.
Export Controls: Department of Commerce Controls over Transfers of  Technology to Foreign Nationals Need Improvement. GAO-02-972.   Washington, D.C.: September 6, 2002.
Export Controls: More Thorough Analysis Needed to Justify Changes in  High Performance Computer Controls. GAO-02-892. Washington, D.C.:  August 2, 2002.
Export Controls: Rapid Advances in China’s Semiconductor Industry  Underscore Need for Fundamental U.S. Policy Review. GAO-02-620.  Washington, D.C.: April 19, 2002.
Export Controls: Issues to Consider in Authorizing a New Export  Administration Act. GAO-02-468T. Washington, D.C.: February 28, 2002.
Export Controls: Clarification of Jurisdiction for Missile Technology  Items Needed. GAO-02-120. Washington, D.C.: October 9, 2001.
Export Controls:  State and Commerce Department License Review  Times Are Similar. GAO-01-528. Washington, D.C.: June 1, 2001.
Export Controls: Regulatory Change Needed to Comply with Missile  Technology Licensing Requirements. GAO-01-530. Washington, D.C.:   May 31, 2001.
Export Controls: Inadequate Justification for Relaxation of Computer  Controls Demonstrates Need for Comprehensive Study. GAO-01-534T.  Washington, D.C.: March 15, 2001.
Export Controls: System for Controlling Exports of High Performance  Computing Is Ineffective. GAO-01-10. Washington, D.C.: December 18,  2000.
Export Controls: Statutory Reporting Requirements for Computers Not  Fully Addressed. NSIAD-00-45. Washington, D.C.: November 5, 1999.
Export Controls: Better Interagency Coordination Needed on Satellite  Exports. NSIAD-99-182. Washington, D.C.: September 17, 1999.
Export Controls: Change in Licensing Jurisdiction for Commercial  Communications Satellites. T-NSIAD-98-222.  Washington, D.C.:  September 17, 1998  Export Controls: National Security Issues and Foreign Availability for  High Performance Computer Exports. NSIAD-98-200. Washington, D.C.:  September 16, 1998.
Export Controls: Issues Related to Commercial Communications  Satellites. T-NSIAD-98-208. Washington, D.C.: June 10, 1998.
China: Military Imports From the United States and the European  Union Since the 1989 Embargoes. NSIAD-98-176. Washington, D.C.:   June 16, 1998.
Export Controls: Change in Export Licensing Jurisdiction for Two  Sensitive Dual-Use Items. NSIAD-97-24. Washington, D.C.: January 14,  1997.
Export Controls: Sensitive Machine Tool Exports to China. NSIAD-97-4.  Washington, D.C.: November 19, 1996.
Export Controls: Sale of Telecommunications Equipment to China.  NSIAD-97-5. Washington, D.C.: November 13, 1996.