Foreign Military Sales: DOD Needs to Take Additional Actions to Prevent Unauthorized Shipments of Spare Parts
Published: 2004-11-09T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: Under Department of Defense (DOD) policy, the export of classified and controlled spare parts must be managed to prevent their release to foreign countries that may use them against U.S. interests. GAO has issued a series of reports on the foreign military sales program in which weaknesses in the military services' internal controls were identified. This report highlights (1) a systemic problem that GAO identified in the internal controls of the military services' requisition-processing systems and (2) a potential best practice that GAO identified in one service that provides an additional safeguard over foreign military sales of classified and controlled parts.
section_title: What GAO Found
paragraphs: At the time GAO conducted its reviews, the Army, the Navy, and the Air Force were not testing their automated requisition-processing systems to ensure that the systems were accurately reviewing and approving blanket order requisitions for compliance with restrictions on the sale of classified and controlled spare parts and operating in accordance with foreign military sales policies. Blanket order requisitions are based on agreements between the U.S. government and a foreign country for a specific category of items for which foreign military sales customers will have a recurring need. GAO's tests of the services' requisition-processing systems showed that classified and controlled spare parts that the services did not want to be released to foreign countries under blanket orders were being released. GAO's internal control standards require periodic testing of new and revised software to ensure that it is working correctly, while the Office of Management and Budget's internal control standards require periodic reviews to determine how mission requirements might have changed and whether the information systems continue to fulfill ongoing and anticipated mission requirements. DOD either concurred or partially concurred with GAO's recommendations for testing the requisition-processing systems. The department, however, does not have a plan specifying the remedial actions to be taken to implement these recommendations. Internal control standards requiring testing also will be applicable to the Case Execution Management Information System, an automated requisition-processing system that DOD and the military services are developing to replace the existing individual military service systems. The Army's automated requisition-processing system incorporates a potential best practice that helps to prevent the release of classified or controlled parts that are not authorized under blanket orders to foreign countries. The automated systems used by the Navy and the Air Force allow country managers to override system decisions not to release to foreign countries classified or controlled parts that are requisitioned under blanket orders. GAO found instances where Navy and Air Force country managers overrode the systems' decisions without documenting their reasons for doing so. In contrast, the Army's system automatically cancels requisitions that are made under blanket orders for classified or controlled parts. Because the requisitions are automatically canceled, country managers do not have an opportunity to override the system's decisions. Compared with the Navy's and the Air Force's systems, the Army's system provides more stringent protection against releasing classified or controlled parts that are not authorized under blanket orders to foreign countries.

section_title: Letter
paragraphs: In response to a request from Senator Tom Harkin, we issued a series of  reports in which we analyzed Army, Navy, and Air Force internal controls  over foreign military sales of classified and controlled cryptographic parts  requisitioned under blanket order cases. Under Department of Defense  (DOD) and service policy, the export of classified and controlled parts  must be managed to prevent their release to foreign countries that may use  them against U.S. interests. We assessed and tested whether key internal  controls, including the automated systems used by the services to process  requisitions received under blanket orders, adequately restricted blanket  order sales of classified and controlled spare parts to foreign countries,  and we determined whether periodic tests were conducted to ensure that  the services’ systems were working as intended. During these reviews, we  identified weaknesses in the military services’ internal controls, which  resulted in the release of parts that were not authorized for release under a  blanket order to foreign countries, and made a number of  recommendations to improve the services’ internal controls. The purpose  of this report is to highlight (1) a systemic problem that we identified in  the internal controls of the military services’ requisition-processing  systems and (2) a potential best practice that we identified in one service  that provides an additional safeguard over foreign military sales of  classified and controlled parts.
For this report, we analyzed the findings and recommendations of our  prior reviews. We also reviewed DOD’s written comments on our prior  reports. In general, we concentrated our prior work on classified and  controlled spare parts that foreign countries requisitioned under blanket  orders. As part of our previous work, we verified whether the systems  approved and released requisitioned parts in accordance with DOD’s and  the services’ foreign military sales policies. Our prior reports provide a  detailed explanation of the scope and methodology we used to conduct  each review. For this report, we did not conduct new audit work. We  conducted this review in accordance with generally accepted government  auditing standards from July through September 2004.
subsections: section_title: Background
paragraphs: The sale or transfer of U.S. defense items to friendly nations and allies  is an integral component of both U.S. national security and foreign  policy. The U.S. government authorizes the sale or transfer of military  equipment, including spare parts, to foreign countries either through  government-to-government agreements or through direct sales from  U.S. manufacturers. The Arms Export Control Act and the Foreign  Assistance Act of 1961 authorize the DOD foreign military sales program.  From 1993 through 2002, DOD delivered over $150 billion worth of  services and defense articles to foreign countries through foreign military  sales programs administered by the military services. The articles sold  include classified and controlled cryptographic spare parts.
The Department of State sets overall policy concerning which countries  are eligible to participate in the DOD foreign military sales program. DOD  identifies military technology that requires control when its transfer to  potential adversaries could significantly enhance a foreign country’s  military or war-making capability. Various agencies such as the  Department of State and DOD are responsible for controlling, in part, the  transfer or release of military technology to foreign countries.
The Defense Security Cooperation Agency, under the direction of the  Under Secretary of Defense for Policy, has overall responsibility for  administering the foreign military sales program, and the military services  generally execute the sales agreements with the individual countries.  A foreign country representative initiates a request by sending a letter to  DOD asking for such information as the price and availability of goods and  services, training, technical assistance, and follow-on support. Once the  foreign customer decides to proceed with the purchase, DOD prepares a  Letter of Offer and Acceptance stating the terms of the sale for the items  and services to be provided. After this letter has been accepted, the foreign  customer is generally required to pay, in advance, the amounts necessary  to cover the costs associated with the services or items to be purchased  from DOD and then is allowed to request spare parts through DOD’s  supply system.
Generally, the military services use separate automated systems to process  requisitions from foreign countries for spare parts. While the Air Force has  retained responsibility for its system, responsibility for the Army’s and the  Navy’s systems was transferred to the Defense Security Assistance  Development Center in October 1997. The Center, which is part of the  Defense Security Cooperation Agency, has overall responsibility for  providing system information technology maintenance support, such as  testing the system. For blanket orders, the systems use various codes and  item identifiers to restrict the spare parts available to the countries. In  cases where the systems validate a requisition, the requisition is sent to a  supply center to be filled and shipped. In cases where the systems reject a  requisition, the requisition is sent to a country manager for review. The  country manager will either validate the requisition and forward it to the  supply center to be filled and shipped or reject the requisition, in which  case the requisition is canceled.
section_title: Testing of the Requisition- Processing Systems Is Needed to Improve Internal Controls for Foreign Military Sales
paragraphs: Our reviews showed that the Army, the Navy, and the Air Force were not  testing their automated systems to ensure that the systems were  accurately reviewing and approving blanket order requisitions for  compliance with restrictions and operating in accordance with foreign  military sales policies. Our tests of the services’ automated systems used  to manage foreign countries’ requisitions for spare parts made through  blanket orders showed that classified and controlled spare parts that the  services did not want released were being released to countries. For  example, we identified 5 out of 38 blanket order requisitions for which the  Navy’s system approved and released 32 circuit card assemblies’  controlled cryptographic spare parts to foreign countries. According to  Defense Security Assistance Development Center officials, who are  responsible for this portion of the Navy’s system, the system was not  programmed to review the controlled cryptographic items codes, and as a  result, the system automatically approved and released the parts requested  by the foreign countries. Navy and DOD officials were unaware that the  system was not reviewing controlled cryptographic parts prior to their  release to foreign countries.
For another example, the Air Force’s system used controls that were  based on supply class restrictions and that were ineffective and resulted in  erroneously approving requisitions for shipment. Included in an item’s  national stock number is a four-digit federal supply class, which may be  shared by thousands of items. The national stock number also contains a  nine-digit item identification number that is unique for each item in the  supply system. We found that countries requisitioning parts under the Air  Force’s system could obtain a classified or controlled spare part by using  an incorrect, but unrestricted, supply class with an item’s correct national  item identification number. The Air Force was unaware of this situation  until our test of the system identified the problem. In response to our  work, the Air Force corrected the problem.
GAO’s internal control standards require periodic testing of new and  revised software to ensure that it is working correctly, while the Office of  Management and Budget’s internal control standards require periodic  reviews to determine how mission requirements might have changed and  whether the information systems continue to fulfill ongoing and  anticipated mission requirements. The importance of testing and  reviewing systems to ensure that they are operating properly is highlighted  in the Federal Information Security Management Act of 2002. The act  requires periodic testing and evaluation of the effectiveness of information  security controls and techniques. Moreover, the act requires agencies, as  part of their information security program, to include a process for  planning, implementing, evaluating, and documenting remedial actions to  address deficiencies. Under guidance from the Office of Management and  Budget, agencies are to develop a Plan of Actions & Milestones to report  on the status of remediation efforts. This plan is to list information  security weaknesses, show estimated resource needs or other challenges  to resolving them, key milestones and completion dates, and the status of  corrective actions.
In commenting on our prior reports, DOD either concurred or partially  concurred with our recommendations for testing the services’ requisition- processing systems. The department, however, does not have a plan  specifying the remedial actions to be taken to implement these  recommendations. If actions are not taken to implement testing and  reviews, the potential benefits of these controls in preventing the  inadvertent release of classified or controlled spare parts may not be  realized.
Regarding our recommendation to periodically test the Army’s system,  DOD concurred and stated that testing of the Army system and its logic  would occur, given the funding and guidance required to do so.  In response to our recommendation to periodically test the Navy’s system,  DOD concurred.
Concerning our recommendation to periodically test the Air Force’s  system, DOD partially concurred and stated that a program was being  developed to test new modifications to the Air Force’s system and that  testing of old modifications would be an ongoing effort. Testing only the  modifications to the Air Force’s system, as DOD commented, will not  necessarily ensure that the system’s logic is working correctly.  Subsequently, the Air Force concurred with our recommendation and  reported that it had modified its system and would be conducting annual  tests of the system’s logic.
The Defense Security Cooperation Agency and the military services are  developing a new automated system, the Case Execution Management  Information System, to process foreign military sales requisitions. The new  system will replace the services’ existing legacy systems with a standard  DOD system. DOD expects to deploy the new system in fiscal year 2007.  Internal control standards requiring testing will be applicable to the new  system.
section_title: Army’s Practice Provides More Stringent Protection against the Improper Release of Parts to Foreign Countries
paragraphs: Our reviews showed that the Navy’s and the Air Force’s systems allowed  country managers, who are responsible for managing the sale of items to  foreign countries, to override system decisions not to release to foreign  countries classified or controlled parts that are requisitioned under  blanket orders. We identified instances where Navy and Air Force country  managers overrode the systems’ decisions without documenting their  reasons for doing so. For example, of the 123 Air Force requisitions we  reviewed, the Air Force’s system identified 36 requisitions for country  manager review. For 19 of the requisitions, the managers overrode the  system’s decisions and shipped classified and controlled spare parts  without documenting their reasons for overriding the system. The  managers we queried could not provide an explanation for overriding  the system.
In 1999, the Army modified its system to reject requisitions that are made  under blanket orders for classified or controlled parts. As a result, Army  country managers were precluded from manually overriding the Army  system’s decisions. Compared with the Navy’s and the Air Force’s systems,  the Army’s system provides more stringent protection against releasing  classified or controlled parts that are not authorized for release under  blanket orders to foreign countries.
section_title: Conclusions
paragraphs: Preventing the inadvertent release of classified and controlled spare parts  that are not authorized for release under blanket orders to foreign  countries deserves the highest level of management attention. The  preemptive nature of testing and reviewing systems allows this internal  control to identify system weaknesses prior to the inadvertent release of  classified or controlled spare parts. Had the services conducted periodic  tests of their systems, the instances of releasing spare parts that DOD did  not want released that we identified in our reports could have been  significantly reduced, if not eliminated. Developing effective corrective  action plans is key to ensuring that remedial action is taken to address  significant information-system internal control deficiencies. We believe the  department could demonstrate its commitment to addressing this systemic  weakness by providing specific information on its planned remedial  actions.
Documenting country managers’ decisions to override system decisions is  a control that could help prevent the release of classified or controlled  parts that are not authorized for release under blanket orders to a foreign  country. However, modifying systems, as the Army did, to reject  requisitions that are made under blanket orders for classified or controlled  parts and to preclude country managers from manually overriding system  decisions would provide more stringent protection against releasing  classified or controlled parts that are not authorized for release under  blanket orders to a foreign country.
section_title: Recommendations for Executive Action
paragraphs: To reduce the likelihood of releasing classified and controlled spare parts  that DOD does not want to be released to foreign countries, we  recommend that you take the following three actions:    Direct the Under Secretary of Defense for Policy, in conjunction with the  Secretaries of the Army and the Navy, and direct the Secretary of the Air  Force to develop an implementation plan, such as a Plan of Actions &  Milestones, specifying the remedial actions to be taken to ensure that  applicable testing and review of the existing requisition-processing  systems are conducted on a periodic basis.
Direct the Under Secretary of Defense for Policy, in conjunction with the  Secretaries of the Army, the Air Force, and the Navy, to determine  whether current plans for developing the Case Execution Management  Information System call for periodic testing and, if not, provide for such  testing.
Direct the Under Secretary of Defense for Policy, in conjunction with the  Secretary of the Navy, and direct the Secretary of the Air Force to  determine if it would be beneficial to modify the Navy’s and the Air  Force’s requisition-processing systems so that the systems reject  requisitions for classified or controlled parts that foreign countries make  under blanket orders and preclude country managers from manually  overriding system decisions, and to modify their systems as appropriate.
section_title: Agency Comments and Our Evaluation
paragraphs: The Director of the Defense Security Cooperation Agency provided  written comments on a draft of this report for DOD and partially  concurred with one recommendation and concurred with two  recommendations.
DOD partially concurred with our recommendation to develop a Plan of  Actions & Milestones specifying the remedial actions to be taken to  ensure that applicable testing and review of the existing requisition- processing systems is conducted on a periodic basis. DOD stated that the  services have made appropriate changes to their systems in response to  our prior reports and routine maintenance and have tested the  applications accordingly. DOD also stated that, in lieu of a formal Plan of  Actions & Milestones, the military services, in concert with DOD, can  institute a practice of testing the applications on an annual basis, if those  applications are not otherwise changed and tested as a matter of routine  maintenance, to satisfy the requirement for periodic testing. We agree that  alternatives to a formal Plan of Actions & Milestones may address the  needed remedial actions. However, we believe any alternative should  specify the remedial actions to be taken to ensure that applicable testing  and review of the existing requisition-processing systems are conducted  on a periodic basis, and we have modified our recommendation  accordingly.
DOD concurred with our recommendation regarding the Case Execution  Management Information System. DOD stated that the system’s software  program testing will adhere to software-testing standards in place at the  time of implementation, including testing to ensure that the functionality  of existing software code is not changed when the coding is modified or  enhanced.
DOD also concurred with our recommendation to determine if it would be  beneficial to modify the Navy’s and the Air Force’s requisition-processing  systems so that the systems reject requisitions for classified or controlled  parts that foreign countries make under blanket orders and preclude  managers from manually overriding system decisions, and to modify their  systems as appropriate. DOD stated that it will review the Navy’s and the  Air Force’s business processes, as well as the requisition-processing  systems. DOD noted that a better option may be to mandate that country  managers seek the appropriate waivers in accordance with DOD policy to  allow the release of a classified or controlled spare part under a blanket  order; provide sufficient documentation for doing so; and make sure it is  done as the exception, not the rule. We agree that this option would  enhance the Navy’s and the Air Force’s controls and could help prevent  the release of classified or controlled parts that are not authorized for  release under a blanket order to a foreign country.
DOD also provided technical and editorial comments, which we have  incorporated as appropriate.
DOD’s comments are reprinted in appendix I of this letter.
As you know, 31 U.S.C. 720 requires the head of a federal agency to submit  a written statement of the actions taken on our recommendations to the  Senate Committee on Governmental Affairs and to the House Committee  on Government Reform not later than 60 days from the date of the report  and to the House and Senate Committees on Appropriations with the  agency’s first request for appropriations made more than 60 days after the  date of the report. Because agency personnel serve as the primary source  of information on the status of recommendations, we request that DOD  also provide us with a copy of DOD’s statement of action to serve as  preliminary information on the status of open recommendations. Please  provide me with a copy of your responses. My e-mail address is  solisw@gao.gov.
We are sending copies of this report to Senator Tom Harkin; the Senate  and House Committees on Armed Services; the Secretaries of the Army,  the Navy, and the Air Force; the Director, Office of Management and  Budget; and other interested congressional committees. The report is also  available on GAO’s home page at http://www.gao.gov.
If you have any questions, please call me at (202) 512-8365. Key  contributors to this report were Thomas Gosling, Louis Modliszewski, and  R. K. Wild. Key contributors to our prior reports are listed in those reports.
section_title: Appendix I: Comments from the Department of Defense
subsections: section_title: GAO’s Comments
paragraphs: The following are GAO’s comments on the Department of Defense’s letter  dated October 8, 2004.  1.  In our report, we modified the text to clarify that the parts were not  authorized for release under blanket orders. The title of this report is  consistent with the titles of our prior reports on this subject, as listed  on page 1, and we did not modify it as DOD suggests.  2.  In response to DOD’s comments, we modified the text to state that  DOD does not have a plan specifying the remedial actions to be taken  to implement our recommendations.
section_title: GAO’s Mission
paragraphs: The Government Accountability Office, the audit, evaluation and  investigative arm of Congress, exists to support Congress in meeting its  constitutional responsibilities and to help improve the performance and  accountability of the federal government for the American people. GAO  examines the use of public funds; evaluates federal programs and policies;  and provides analyses, recommendations, and other assistance to help  Congress make informed oversight, policy, and funding decisions. GAO’s  commitment to good government is reflected in its core values of  accountability, integrity, and reliability.
section_title: Obtaining Copies of GAO Reports and Testimony
paragraphs: The fastest and easiest way to obtain copies of GAO documents at no cost  is through GAO’s Web site (www.gao.gov). Each weekday, GAO posts  newly released reports, testimony, and correspondence on its Web site. To  have GAO e-mail you a list of newly posted products every afternoon, go to  www.gao.gov and select “Subscribe to Updates.”
subsections: section_title: Order by Mail or Phone
section_title: To Report Fraud, Waste, and Abuse in Federal Programs
section_title: Congressional Relations
section_title: Public Affairs