Export Controls: Agencies Should Assess Vulnerabilities and Improve Guidance for Protecting Export-Controlled Information at Universities
Published: 2006-12-05T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: Foreign students and scholars have made substantial contributions to U.S. research efforts and technology development. However, according to a federal government intelligence assessment, foreign access to sensitive U.S. technology has imposed a significant but unquantifiable cost to the United States. Given this risk, GAO was asked to (1) describe the nature of the research at universities and identify steps they take to comply with export controls and (2) assess efforts by the Departments of Commerce and State--the key export control agencies--to determine the risk of export violations in university research. GAO reviewed Commerce and State export control programs and met with officials from 13 universities, selected based on their foreign student populations, applications for export licenses, and federal grants and contracts.
section_title: What GAO Found
paragraphs: The U.S. export control system requires export licensing for defense items and items that have both commercial and military applications, except where exclusions apply, such as those applicable to universities in some circumstances. The U.S. export control agencies place the onus on universities to understand and comply with the regulations. According to university officials we interviewed, their institutions focus almost exclusively on fundamental research--defined as basic and applied research in science and engineering, the results of which ordinarily are published and shared broadly within the scientific community. Such research is generally not subject to export controls. Universities we visited conduct research in such areas as nanotechnologies, computer security, and chemical engineering. To ensure their research remains in the public domain, university officials said they negotiate contract language to remove publication or other dissemination restrictions for research they consider to be fundamental. If export controls apply, university officials stated they sometimes involve only those students eligible to conduct the research under a license exclusion, to avoid the lengthy license application process. In other cases, they refer such work to off-campus associated facilities that can better regulate and control foreign national access to the research. Universities we visited indicated that government-provided training and guidance on export control regulations is limited in informing their efforts to manage and protect export-controlled information in the university environment. State and Commerce officials expressed concerns that universities may not correctly interpret and apply export regulations, given the large number of foreign students participating in research at universities and the relative lack of license applications from universities. Although federal internal control standards contain guidelines for agencies to conduct risk assessments, State and Commerce have not conducted an overall assessment of available trend data on technology development research and foreign participation in such research at U.S. universities to identify potential vulnerabilities. For example, U.S. government agencies collect data on foreign student nationality, school enrollment, and types of research conducted at universities for federal agencies, which could supplement information that State and Commerce receive from visa application processes and other sources. Although State and Commerce provide guidance through training seminars, agency Web sites, and telephone help desks to assist exporters in understanding and complying with regulations, officials stated that their focus is on processing export license applications--primarily from industry. Recently, Commerce established an advisory committee composed of industry and university representatives who are expected to discuss issues such as the nature of university research and its relation to export controls.

section_title: Letter
paragraphs: U.S. national security and economic interests are heavily dependent on  technological innovation and advantage. Many of the nation’s leading-edge  technologies, including defense-related technologies, are being discovered  by American and foreign national students and scholars in U.S. university  research and university-affiliated laboratories. As the Department of  Defense (DOD) invests less and less of its funding on in-house research  and development, university-based discoveries are becoming increasingly  vital to national security and other U.S. interests.
To mitigate the risk of technology and knowledge falling into the wrong  hands, the U.S. government—primarily the Departments of State and  Commerce—controls the transfer of defense and “dual use” information.  However, controlling the transfer of such information presents special  challenges. U.S. export control regulations allow foreign students and  researchers without export licenses to partake in fundamental research,  defined to mean basic and applied research in science and engineering, the  results of which are ordinarily published and shared broadly within the  scientific community. U.S. policymakers recognize that foreign students  and researchers have made substantial contributions to U.S. research  efforts, but the potential transfer of knowledge of controlled defense- related technologies to their home countries could have significant  consequences for U.S. national interests. In a September 2005 testimony  before Congress, the National Counterintelligence Executive stated that  while the vast majority of foreign students in the United States are  legitimately studying and advancing academic pursuits, some seek to  acquire sensitive U.S. technologies to advance their own countries’  economic and military interests. Additionally, while not limited to foreign  students, a 2005 federal report noted that the technology lost as a result of  foreign efforts to target sensitive U.S. technologies has imposed a  significant, but difficult to quantify, cost on the United States.
On the basis of your interest in continuing to attract foreign students and  researchers to U.S. universities while protecting export-controlled  information, you asked us to look at how academic institutions and the  U.S. government protect against the illegal disclosure of such information.  In response, we (1) described the nature of the research conducted at  universities and identified the steps they have taken to comply with  government export control regulations and (2) assessed the efforts of the  Departments of Commerce and State to determine the risk of export  violations in university research.
To conduct our work, we met with officials from the Departments of  Commerce and State and analyzed their regulations, guidance, and  training. We also met with officials in the Department of Defense—which  participates in the export control regulatory process—and the Department  of Homeland Security—which has responsibility for tracking foreign  students and scholars during their course of study in the United States. We  visited 13 universities that were systematically selected based on their  international student populations, export license applications, and federal  grants and contracts. At the universities, we spoke with officials in such  positions as vice chancellor for research, director of compliance, and  general counsel, among others. While our selection criteria included a  range of university experiences with export controls and foreign students  and scholars, the universities’ views stated in this report do not represent  the entirety of the U.S. academic community. We also spoke with officials  from various research institutes and academic associations. Additional  details on the scope and methodology of our review can be found in  appendix I. We conducted our review from March through November 2006  in accordance with generally accepted government auditing standards.
subsections: section_title: Background
paragraphs: In November 2003, GAO reported that university research is a vital part of  the nation’s research and development efforts, primarily funded by the  federal government because of the broad consensus that university  research is a long-term national investment in the future. The federal  investment in university research has yielded thousands of inventions each  year that have fostered the development of new technologies, stimulated  the creation of new jobs, and improved the quality of life. These benefits  come through open communication among scientists and the sharing of  research results. A National Academy of Sciences official underscored the  importance of this issue in September 2005 congressional testimony,  stating that over 55 percent of the engineering Ph.D. students in the United  States are foreign-born and that their research helps strengthen the United  States in the fastest-moving new technologies, some of which have  potential defense-related application.
Foreign students and scholars bring needed skills to our increasingly  knowledge-based economy, build bridges to other countries and  professional communities, and make other valuable contributions to our  society. These contributions are particularly important for maintaining our  competitiveness, fostering productivity and innovation, and strengthening  our workforce. While the United States has long been a global leader in  higher education and one of the most desired destinations for foreign  students, international competition for the best and the brightest students  and scholars is growing. Countries such as China have improved their  educational capacities, possibly decreasing the incentives for students and  scholars to study in the United States. The recent slowing of foreign  student enrollment in United States universities and colleges has raised  concerns about the extent to which we will be able to continue attracting  talented foreign students and researchers to our universities and to our  workforce after they graduate while also maintaining our nation’s security.
Recognizing the importance of balancing national security interests with  the need to allow the free exchange of information at U.S. academic  institutions of higher learning, the federal government is a major funding  source for research conducted at U.S. universities and colleges. In fiscal  year 2003, the federal government funded almost two-thirds— approximately $29.6 billion—of all basic and applied research funding  provided to universities and colleges by external sources (see fig. 1). Other  sources of funding come from industry, nonprofit organizations, as well as  state and local governments.
According to National Science Foundation data for fiscal year 2003, the  National Institutes of Health of the Department of Health and Human  Services funded approximately 62 percent (about $14.1 billion) of all  federally funded science and technology research conducted by  universities and colleges. Other federal research funding sources identified  by university officials we spoke with include the National Aeronautics and  Space Administration (NASA); the National Science Foundation; various  Department of Defense agencies, including the Navy and the Defense  Advanced Research Projects Agency; and the Departments of Energy,  State, and Transportation. This level of government funding was  consistent with that of several of the universities we visited, where  officials stated that their research is primarily funded by government  grants and contracts, including contracts that are directed toward industry  and subsequently subcontracted, or “flowed through,” to universities.
Over the past several decades in which the current export control system  has been in effect, the global economy has changed significantly. DOD  continues to seek innovative technologies to meet the needs of warfighters  and to counter technologies developed by potential U.S. adversaries. To  achieve these ends, DOD has become more willing to rely on the  nondefense industry to supply its needs. DOD increasingly relies on  commercial research, for areas such as information systems and  telecommunications, where the cutting edge of technological  advancement lies. Such advances in communications technology have  been made possible to a large extent by basic research, much of which  was initially developed in universities and often involved foreign students  and scholars.
The U.S. export control system relies on the ability of exporters to  recognize when certain goods and services meet the criteria for requiring  an export license. The system is primarily divided between two regulatory  regimes, one managed by the Department of State and another managed  by the Department of Commerce. The regimes require export licensing for  defense-related items and information, including data, except where  exclusions apply. Both regulatory regimes include exclusions applicable in  some circumstances to universities and other academic institutions of  higher learning. The U.S. export control system places the onus on  universities and other exporters to understand and comply with the export  control regulations.
The Department of State Directorate of Defense Trade Controls (DDTC)  manages defense items through the International Traffic in Arms  Regulations (ITAR). State issues export licenses based on the U.S.  Munitions List, which identifies defense articles, services, and related  technical data that are controlled for export. Moreover, the regulations  state that unless otherwise expressly exempted or excluded, an export  license is required for the oral, visual, or documentary transmission of  technical data by U.S. persons to foreign persons, by such means as in- person or telephone discussions and written correspondence including  electronic messages, even when they are in the United States. The U.S.  Munitions List contains 21 categories, covering items such as weapons,  chemical and biological agents, missiles, and both commercial and military  satellites.
The Department of Commerce’s Bureau of Industry and Security (BIS)  manages dual-use items, having both military and commercial  applications, through the Export Administration Regulations (EAR).  Under these regulations, exporters are to obtain prior government  authorization in the form of a license from BIS, or determine that a license  is not needed, before exporting dual-use items. Commerce requires an  export license for the release of technology or software source code to a  foreign national because such a release is deemed to be an export to the  home country or countries of the foreign national, even if the person is in  the United States. Commerce regulates the dual-use items specified in the  EAR’s Commerce Control List, which are controlled for a variety of  reasons, including restricting exports that could significantly enhance a  country’s military potential, preventing exports to countries that sponsor  terrorism, and limiting the proliferation of chemical, biological, and  nuclear weapons and their delivery systems. The Commerce Control List  has 10 categories covering items such as electronics, computers,  telecommunications, and avionics.
section_title: Universities Focus on Fundamental Research to Comply with Export Regulations
paragraphs: Most of the universities we visited aim to ensure that their research  remains unrestricted and in the public domain by conducting fundamental  research, which is generally excluded from export controls. To ensure that  most of the research conducted on their campuses does not require an  export license, these universities negotiate to exclude any restrictions on  publishing and disseminating the results of the research they consider to  be fundamental. For research that may be subject to export control  regulations, the universities we visited have taken steps to ensure that  their personnel are informed about and comply with these regulations.
subsections: section_title: Universities Focus on Conducting Fundamental Research
paragraphs: According to most university officials, their institutions conduct basic and  applied science and engineering research in a wide variety of areas,  producing findings that are conducted, shared, and published openly  within a broad community that includes international students and  scholars. Table 1 lists examples of research areas conducted at  universities that we visited.
Most officials we spoke with stated that their universities specifically seek  out research contracts and grants that do not restrict their ability to  conduct fundamental research by extensively screening and reviewing the  terms of potential contracts and grants. If a contract includes restrictions  on fundamental research, some universities attempt to negotiate the  restrictive language out of the contract. Some university officials noted  that such negotiations have become more frequent because government  and industry contracting officials are increasingly inserting restrictive  language in contracts for research that universities consider to be  fundamental. For example, according to university officials, DOD agencies  sometimes insert standard acquisition regulations language that prohibits  the contractor from releasing information, even unclassified information,  outside of the contractor’s organization. According to university officials,  a rule proposed by DOD would have restricted universities from sharing  information with other academic institutions and publishing research or  otherwise making such information available in the public domain. DOD  revised the rule to minimize the impact on fundamental research  conducted at universities and acknowledged that the free exchange of  ideas is a foundational concept of U.S. research and educational  institutions. Several universities we interviewed stated that if they are  unsuccessful in negotiating the restrictive language out of those research  contracts they consider to be fundamental, they sometimes reject the  opportunity to participate in the research.
For research subject to export control restrictions, universities may  modify the way the research is conducted to avoid the export license  application process—a process some officials characterized as time- consuming and complicated. For example, officials at one university said  that instead of applying for an export license for one project, they opted to  use only researchers who are excluded from export license requirements,  such as U.S. citizens or foreign nationals with permanent residency status.  In other cases, university officials stated they move export-controlled  work to off-campus facilities and laboratories administered by the  universities or the entity sponsoring the contract, where such research can  be better segregated and controlled. At the six university-administered  laboratories that we visited, each used access control systems such as  badges and computer passwords. Such restrictions limiting access to  information at laboratories are not as common on the main campuses we  visited, where research information is more openly available.
section_title: Efforts Undertaken by Universities to Understand and Comply with Export Control Regulations
paragraphs: According to a State official, U.S. export control regulations are designed  for “self-compliance.” For the academic community specifically, State  officials said that it is the universities’ responsibility to conduct due  diligence to determine whether their research activities are subject to  export laws, and to identify whether an export license is required for  foreign nationals within their purview. University officials we spoke with  have taken actions to become educated on complex export control  regulations—an undertaking that several officials indicated requires an  extensive time commitment because the government does not provide  sufficient guidance. Some universities have also dedicated other resources  to ensure they comply with U.S. export control laws, such as hiring legal  counsel.
To understand export control regulations, universities we visited  frequently rely on agency training and guidance. Several university  officials stated that they had attended training seminars sponsored by  Commerce, as well as conferences sponsored by the Society for  International Affairs, a nonprofit defense trade industry association that  sponsors events such as conferences and workshops to educate and  instruct the export community on all aspects of defense and commercial  exports and technology transfers. Most university officials indicated that  they also accessed Commerce and State Web sites or their respective  telephone help desks.
However, several university officials indicated that the agency training and  guidance have limited utility for academic institutions. For example,  according to some university officials, training provided by Commerce and  State does not discuss how export regulations apply to universities that  have fundamental research exclusions. One university official  characterized the Commerce-sponsored session that he attended as being  “entry level” training directed at the corporate community. Commerce  officials have acknowledged that about 95 percent of the attendees at their  seminars are repeat attendees, primarily from industry. Some university  officials stated that the training was too narrowly focused on topics that  do not pertain to universities. University officials also raised concerns  with State’s and Commerce’s Web-based guidance. Some university  officials characterized the Web-based information provided by Commerce  and State as being unclear or only providing a general introduction to a  topic without providing sufficient details to fully answer questions  concerning export controls. For example, a university official stated that  the Commerce and State Web sites do not identify which forms  universities need to submit in seeking export licenses to involve foreign  researchers in certain research. Also, although some university officials  indicated that Commerce and State officials provide very useful  information via the telephone help desks, they stated that getting  immediate help was difficult at times and that return messages were  untimely.
To further their understanding of export control regulations, several  universities have sought out other sources of information, specifically  sources tailored to universities. Several university officials indicated that  they rely on best practices by other universities that have shared and  developed approaches for addressing different export control issues,  including the Massachusetts Institute of Technology, Stanford University,  and the Universities of Oklahoma and Maryland. For example, officials  from one university said that they have relied on other universities for  guidance on applying for export licenses. Universities and academic  associations exchange best practice information through seminars and  workshops sponsored by nongovernmental organizations, such as the  Association of American Universities, the Council on Governmental  Relations, and the National Council of University Research  Administrators.
Many of the universities that we visited have also developed written  guidance and training to help educate university personnel on their  responsibility to comply with the export control regulations. For example,  officials from one university we visited have developed a Web-based  decision tree to assist university personnel in determining the applicability  of export controls to their research projects. Officials from another  university stated that their research institution requires that all staff take  training—available on the university’s intranet site—related to the  handling of controlled information. Another university adopted a targeted  strategy of export control education for its researchers, reaching out to the  researchers and programs most likely to be affected by export controls,  such as those in engineering.
A number of universities we visited have invested in other resources to  ensure they comply with export control regulations. Some hire outside  legal counsel who specialize in export controls. For example, one  university routinely employs outside counsel to mitigate the risk of  committing violations, because of the severity of the penalties for  noncompliance. According to officials at another university, thousands of  dollars are spent each year for legal services addressing export controls.  Finally, two universities we visited use a software program to help  determine if a proposed research project grant or contract is subject to  export license requirements. According to officials at these two  universities, the software program helps to facilitate a process that is very  difficult, time-consuming, and costly because of the length and complexity  of U.S. export control regulations.
section_title: State and Commerce Have Not Assessed the Potential Risk to Export-Controlled Information at Universities
paragraphs: State and Commerce officials indicated that their top priority is processing  the thousands of license applications received annually—the vast majority  of which are from industry—leaving few resources for guidance and  outreach to exporters. However, they expressed concerns that universities  may be misinterpreting their responsibilities under export regulations and  that the potential may exist for foreign nationals to access sensitive  information on U.S. campuses. Despite these concerns, neither agency has  analyzed available information on university research and foreign student  populations to determine the potential risk of the illegal transfer of  controlled information.
subsections: section_title: Commerce and State Prioritize Processing of License Applications and Target Their Resources to Industry
paragraphs: According to Commerce officials, BIS receives approximately 1,000  deemed export license applications per year. Officials confirmed that most  of these applications are received from industry. For example, Commerce  officials stated that of the 865 deemed export licenses processed by  Commerce in fiscal year 2006, 99.7 percent were from industry. These  same officials noted that over the last few years, only two universities  have submitted deemed export license applications. A 2004 Commerce  Inspector General report stated that license application data suggest that  many industries (including chemical and biotechnology industries),  academic institutions, and federal research facilities that may employ or  host foreign nationals are not applying for deemed export licenses.
State and Commerce officials stated that beyond processing export  licenses, few resources remain for providing outreach and guidance to the  export community. While both agencies provide guidance and outreach  through conferences cosponsored with other organizations and agency- sponsored training, much of their outreach is directed at industry, and not  the academic community. Commerce cosponsors approximately 45 formal  seminars annually, along with specialty seminars on deemed exports  ranging from basic to advanced. As its principal training activity, State  provides speakers for export licensing conferences that are organized by  the Society for International Affairs and tailored to the needs of industry  and government participants. An official acknowledged that State is  unable to fill all of the speaking requests that it receives, which number in  the hundreds each year. Instead, State responds to requests based on the  availability of personnel and travel funds. From January 2004 through June  2006, State officials approved their personnel to participate in  approximately 135 outreach activities and events.
Officials at both agencies indicated that their visits to or staffing of  training seminars for the academic community are often in response to  specific invitations from universities. A State official who is responsible  for export outreach reported that since 2003, only one event has been held  that was specifically targeted to the academic community. While State  policy officials have indicated that they would like to conduct more  conferences for universities in the future, the official responsible for these  conferences stated that none are currently scheduled because of limited  resources. For Commerce, one official has noted that more universities  have recently begun attending its training seminars. However, while  Commerce stated it has increased its outreach to universities in the last  few years, GAO analysis of its outreach records indicated that several  events that Commerce categorized as targeted at universities were  provided to government research entities instead.
In addition to conferences and agency-provided training, both State and  Commerce maintain telephone help desks and Web sites for exporters to  obtain guidance on export controls. State employs a three-person  response team to answer telephone inquiries and provide informal advice  on export control issues in response to the thousands of calls received  monthly from industry and academic institutions. Officials have indicated  that they have improved help desk response times. Commerce’s and  State’s Web sites provide exporters with guidance on when a license is  needed and how a license can be procured. However, information is aimed  at a more general audience, although a Commerce official stated that the  agency has posted more background information on the fundamental  research exclusion on its Web site. State officials noted that they have  made their Web site more user-friendly and taken steps to expand the Web  site to provide additional guidance to exporters.
Although State and Commerce have separate export control jurisdictions,  the 2004 interagency Offices of Inspector General report stated that  Commerce and State could improve their outreach by providing joint  training that explains the differences between the two agencies’ licensing  requirements and procedures—a recommendation that, according to the  report, was supported by company and academic officials. Furthermore,  previous GAO reports have recommended that Commerce and State  should better coordinate their efforts on analysis and export oversight.  However, State and Commerce have taken few actions to coordinate their  outreach efforts to universities. Though State engaged in six outreach  events with Commerce between November 2003 and April 2004, a State  official explained that staffing such joint events with Commerce remains  difficult because State must use personnel from its licensing staff to  participate in these events. With a backlog in license applications, the  processing of applications is a priority, and the agency is reluctant to  divert those personnel to outreach efforts.
section_title: Commerce and State Have Not Conducted Analysis to Identify whether Any Risk Exists to Export- Controlled Information at Universities
paragraphs: State and Commerce officials expressed concerns that despite the export  control exclusions for university research, the potential may exist for  foreign nationals to access controlled defense and dual-use technologies  and information on U.S. campuses. However, neither State nor Commerce  has analyzed available data on university research contracts or student  fields of study to identify any potential risk to export-controlled  information at universities. According to federal internal control  standards, agencies need to conduct risk assessments that generally  include estimating the risk’s significance and likelihood of occurrence,  deciding how to manage the risk and determining what actions should be  taken.
In the absence of an assessment of export control vulnerabilities at  universities, State officials and a Commerce Inspector General report  stated they were concerned that academic officials may be misinterpreting  export control regulations and guidance. According to State officials,  universities are unaware of the nuances of export control regulations.  Specifically, they said universities have difficulty distinguishing and  tracking export regulations when a specific project develops from basic to  fundamental or applied research. For example, one State official  questioned whether universities devote sufficient resources to export  compliance and apply for export licenses with State and Commerce to the  extent their research activities warrant. This official believes that  academic institutions should designate individuals responsible for  understanding export control regulations and tracking exports, just as  companies do. However, most of the academic institutions we visited had  designated officials who were responsible for export control issues.
Despite these concerns, Commerce and State have not fully assessed  university compliance information to identify the potential for export  control vulnerabilities in university research. Commerce and State are  tasked with export control oversight, including administering policy,  processing licenses, and reviewing compliance by exporters. According to  State officials, the department lacks the personnel to conduct extensive  compliance audits. Instead, State relies on voluntary disclosure of possible  export control violations—primarily by companies. When a company  notifies State of a possible export violation, State may visit the company to  discuss the problem and offer advice on weaknesses in the company’s  export control program. According to State officials, State does not target  universities for compliance and has not visited a university because  universities make up a small percentage of all exporters. Officials stated  that Commerce’s formal compliance review program is focused on  deemed export license holders, the majority of which are from industry.  Commerce does not conduct analyses to determine whether academic  institutions that have not applied for licenses are in compliance with  export control regulations. Instead, Commerce uses leads generated by  intelligence agencies, internal Commerce sources, or the public via a  hotline to investigate possible cases of export control violations.
Furthermore, although Commerce gathers information about certain  universities’ research activities on case-by-case basis, neither Commerce  nor State analyzes available federal agency data on university research  subjects to identify trends or determine the potential for such research to  be subject to export control regulations. Given that much of the research  conducted at U.S. universities is federally funded, data from other  government agencies on the subjects of research conducted at academic  institutions could supplement data from Commerce and State. For  example, DOD and NASA fund research at universities, some of which  involves technologies that could become export controlled. General  information on federal contracts available through the Federal  Procurement Data System could also provide information on universities  doing high volumes of research for other federal agencies. However,  neither Commerce nor State makes use of these data sources to analyze  trends in university research. Commerce, instead, relies on Internet  searches or publicly available data on university research when preparing  to meet with academic officials.
Other data could help Commerce and State identify potential risks of  export control violations at academic institutions. Commerce officials  stated that some foreign nationals on U.S. campuses are from countries  that have historically tried to unlawfully obtain information about  American technologies. However, while Commerce uses visa application  data to generate leads for specific cases of deemed export violations, it  does not use other data on foreign students’ and scholars’ majors or fields  of study to identify potential areas of risk. For example, the Department of  Homeland Security administers the Student and Exchange Visitor  Information System—a database that tracks student nationality, school  enrollment, and changes to major or field of study—but within the past 3  years neither State nor Commerce has requested these data from  Homeland Security for the purposes of assessing export control risks.  While a Commerce official indicated that the department would like to  work with Homeland Security in the future, there is currently no  information sharing between the two agencies for the purpose of  identifying trends in student populations. Similarly, State does not use its  Visas Mantis program—a security review procedure that aims to identify  visa applicants who may pose a threat to U.S. national security by illegally  transferring sensitive technology—to identify trends of foreign students  and scholars and their fields of study, although it occasionally receives  alerts about individuals who might pose an export control risk.
To improve controls at universities, in 2005 Commerce solicited  information on the impact of a proposed rule change that would have  modified the definition of the use of export-controlled equipment by  foreign nationals, which was recommended by the Commerce Office of  Inspector General. Commerce received more than 300 comments in  which many cited the potential impact on university research, including  numerous comments that the modified definition would capture too many  routine operations carried out by students and employees and would thus  create a large and generally unnecessary compliance, financial, and  administrative burden for universities, and an increased licensing burden  on Commerce. Subsequently, Commerce withdrew the advanced notice of  proposed rule change in May 2006.
Recently, U.S. export regulatory, oversight, and law enforcement agencies  have taken some steps to engage the academic community on export  issues. For example, in September 2006, Commerce established the  Deemed Export Advisory Committee to address broad export control  issues. Specifically, the committee’s charter is to review and provide  recommendations to Commerce on deemed export policy. Thus, this  committee will be responsible for ensuring that the deemed export  licensing policy protects national security while ensuring that the United  States continues to be at the leading edge of technological innovations. Its  membership includes high-ranking university officials and chief executive  officers of companies. According to Commerce officials, the committee  members will serve for approximately one year. Commerce officials stated  that they plan to address the issue of fundamental research in the  committee’s work and to include participation by a number of export  control agencies in committee meetings. Commerce highlighted one such  issue in a May 2006 Federal Register notice where it described the  difference between the academic community views that export controls  would only apply to the results of research, and the Commerce view that  export controls can also apply to the conduct of research.
In September 2005, the Federal Bureau of Investigation established a  separate forum to improve its lines of communication with the academic  community. The National Security Higher Education Advisory Board— consisting of the presidents and chancellors of several prominent U.S.  universities—aims to foster outreach and to promote understanding  between higher education and the Federal Bureau of Investigation. The  board will provide insight on the higher education culture of openness,  academic freedom, and international collaboration and dialogue on issues  such as terrorism, counterintelligence, and homeland security. In addition,  the Department of Homeland Security's Project Shield America aims to  work with exporters of U.S. technologies that could be illegally exported,  in particular, technologies used in weapons of mass destruction.  According to a DHS official, the project's first outreach effort specifically  targeting the U.S. academic community was scheduled to be held at the  beginning of December 2006.
section_title: Conclusions
paragraphs: Balancing the desire to attract gifted foreign research scientists to U.S.  universities and the need to ensure that export-controlled research at  universities is not compromised is a considerable challenge. Since  government agencies place the responsibility for complying with export  control regulations on universities and other exporting entities, it is  essential that Commerce and State, the two agencies primarily charged  with administering export regulations, understand whether universities  correctly interpret and apply relevant export control policies and  regulations when deciding whether their research is subject to export  controls. Despite some concerns that universities may not understand  their responsibilities when conducting research, Commerce and State have  not leveraged available government information and assessed potential  risks of illegal transfers of export-controlled information at universities.  Furthermore, although Commerce and State have separate export control  jurisdictions, the lack of coordination between these agencies on  outreach, analysis, and oversight could hamper their ability to determine  whether export-controlled information may be at risk of transfer to foreign  nationals in the course of university research. Without such knowledge,  the government agencies cannot determine whether their guidance and  training for universities is appropriate and sufficient and whether their  resources are strategically targeted to optimize their ability to regulate and  monitor universities’ research. Until Commerce and State take such steps,  sensitive information may remain vulnerable to improper transfer,  potentially putting at risk U.S. national security interests.
section_title: Recommendations for Executive Actions
paragraphs: To improve the Department of Commerce’s oversight of export-controlled  information under its jurisdiction at universities, we recommend that the  Secretary of Commerce direct the Administrator of the Bureau of Industry  and Security to    strategically assess potential vulnerabilities in the conduct and  publication of academic research by becoming more knowledgeable  about research being conducted on university campuses and, in  consultation with other agencies, make use of available information on  technology development and foreign student populations at  universities to assess the extent to which research at universities may  be subject to export controls and    on the basis of this assessment of university research and foreign  student populations, improve interagency coordination, conduct  additional outreach, and improve guidance to ensure that universities  understand when to apply export controls.
To improve the Department of State’s oversight of export-controlled  information under its jurisdiction at universities, we recommend that the  Secretary of State direct the Director of the Directorate of Defense Trade  Controls to    strategically assess potential vulnerabilities in the conduct and  publication of academic research by becoming more knowledgeable  about research being conducted on university campuses and, in  consultation with other agencies, make use of available information on  technology development and foreign student populations at  universities to assess the extent to which research at universities may  be subject to export controls and    on the basis of this assessment of university research and foreign  student populations, improve interagency coordination, conduct  additional outreach, and improve guidance to ensure that universities  understand when to apply export controls.
section_title: Agency Comments and our Evaluation
paragraphs: We provided a draft of this report to the Departments of Commerce,  Defense, Homeland Security, and State for their review and comment.   Commerce and State provided written comments, which are reprinted in  appendixes II and III, respectively.  Defense did not have any comments  on our draft report. Homeland Security provided technical comments,  which are incorporated as appropriate throughout the report.
The Department of Commerce generally agreed with the report’s  recommendations, and stated that the Deemed Export Advisory  Committee will aid in this respect. However, Commerce stated that  Student and Exchange Visitor Information System (SEVIS) data are too  general for use in identifying whether foreign students and scholars are  subject to deemed export license requirements and that the collection of  more specific visa application information is needed to assess  vulnerabilities. While we agree that additional information from the visa  application process could be useful, we found that SEVIS data include  information that State and Commerce could use to perform general trend  analysis to determine where best to focus outreach and compliance efforts  at the university level. For example, an analysis of the majors that foreign  students and scholars are pursuing at universities with large federal  research contracts could provide Commerce and State with a proactive  plan for targeting their outreach and training efforts for the academic  community. Furthermore, while Commerce states that about one-third of  its outreach events focus on the academic community, as our report  states, we found that several of the events that Commerce classified as  academic outreach were actually targeted at government research entities.  Finally, Commerce correctly notes that our report focuses on fundamental  research or other research that may be subject to export controls while  excluding other research that falls outside of the export control universe.  We identified the application of the fundamental research exclusion as a  significant issue between the academic community and Commerce, and as  Commerce’s letter notes, some universities could benefit from a better  understanding of deemed export control requirements. Our report  indicates that an assessment of the vulnerabilities will best allow  Commerce to focus its outreach and training efforts toward addressing  this issue with the academic community.
State agreed with our recommendation to improve interagency  coordination on training and guidance for universities and disagreed with  our report’s finding that it does not assess the potential vulnerabilities  associated with export-controlled information at academic institutions.   State responded that it is currently working with the Department of  Commerce and the Department of the Treasury to conduct an export  control conference during 2007 specifically aimed at universities. As we  recommended in our report, such outreach that is specifically targeted to  the academic community, particularly in coordination with other agencies,  could improve universities’ understanding of regulations concerning  export controlled information.  However, while such outreach may help  universities seeking guidance on deemed export regulations, State would  benefit from strategically assessing vulnerabilities at universities using  readily available data, such as SEVIS, to help the department identify and  address areas of potential risk.  While State disagreed with our  recommendation, in its response it noted that it is considering conducting  such an assessment.  A trend analysis conducted on SEVIS and federal  procurement data would be a valuable investment in providing a proactive  plan for targeting outreach and training for universities.  State also  provided technical comments, which we incorporated throughout the  report, as appropriate.
We are sending copies of this report to appropriate congressional  committees and to the Secretary of Commerce, the Secretary of Defense,  the Secretary of Homeland Security, and the Secretary of State. Copies will  be made available to others upon request. In addition, this report will be  available at no charge on the GAO Web site at http://www.gao.gov.
If you or your staff have any questions about this report, please contact me  on (202) 512-7333. Key contributors to this report are acknowledged in  appendix IV.
section_title: Appendix I: Scope and Methodology
paragraphs: To describe the nature of the research conducted at universities and  identify the steps they have taken to comply with government export  control regulations, we interviewed and obtained documentation from  officials at 13 universities in positions such as vice chancellor for research,  director of compliance, and general counsel. We conducted our review at  the following 13 universities: Boston University, Boston, Massachusetts;  California Institute of Technology, Pasadena, California; Carnegie Mellon  University, Pittsburgh, Pennsylvania; Colorado State University, Fort  Collins, Colorado; George Washington University, Washington, D.C.; Johns  Hopkins University, Baltimore, Maryland; Massachusetts Institute of  Technology, Cambridge and Lexington, Massachusetts; Stanford  University, Stanford, California; University of California at Berkeley;  University of California at Los Angeles; University of Colorado at Boulder;  University of Maryland at College Park; and the University of Southern  California, Los Angeles, California. To get a general overview of the nature  of research at universities, we also spoke by telephone with officials from  the Association of American Universities, Association of University  Technology Managers, National Council of University Research  Administrators, and the Southwest Research Institute. To systematically  select the universities that we visited, we cross-tabulated data on  universities with large numbers of international students or scholars, those  that are associated with federally funded research centers, those that had  applied for International Traffic in Arms Regulations or Export  Administration Regulations export licenses, and those that had high-dollar  contracts with either the Department of Defense or other government  entities. While some of the selected academic institutions fall within the  top tiers across the selection criteria, their views stated in this report do  not represent those of the entirety of the U.S. academic community.
To assess Commerce’s and State’s efforts to determine the risk of export  violations in university research, we interviewed officials from the Bureau  of Industry and Security of the Department of Commerce and its related  export offices: National Security and Technology Transfer Controls,  Exporter Services, Export Administration, Export Enforcement. We also  interviewed officials in the Department of Commerce’s Offices of General  Counsel and Inspector General. At the Department of State, we  interviewed officials and reviewed data from the Bureau of Political- Military Affairs’ Directorate of Defense Trade Controls, the Bureaus of  Consular Affairs and International Security and Nonproliferation, and the  Office of the Inspector General. We obtained and analyzed regulations,  guidance, and training documents from these departments. We also  collected data and other documentation and met with officials from the  Office of Defense Procurement and Acquisition Policy of the Department  of Defense and the Department of Homeland Security’s Immigration Policy  Directorate and U.S. Immigration and Customs Enforcement.
We conducted our work from March 2006 through November 2006 in  accordance with generally accepted government auditing standards.
section_title: Appendix II: Comments from the Department of Commerce
section_title: Appendix III: Comments from the Department of State
section_title: Appendix IV: Staff Contact and Acknowledgments
subsections: section_title: GAO Contact
section_title: Acknowledgments
paragraphs: John Neumann, Sharron Candon, Gregory Harmon, Arturo Holguin, Angela  Thomas, and Sandra Moore made key contributions to this report. Other  key contributors include Marie Ahearn and Karen Sloan.