Export Controls: State and Commerce Should Improve Guidance and Outreach to Address University-Specific Compliance Issues
Released: 2020-05-12T00:00:00

Letter

Background U.S. Export Controls

The U.S. government implements export controls to manage risks associated with exporting sensitive items while ensuring that legitimate trade can still occur, and to advance U.S. national security and foreign policy objectives. These export controls are governed by a complex set of laws, regulations, and processes that multiple federal agencies administer to ensure compliance. State and Commerce each play a significant role in the implementation of U.S. export controls. State controls the export of sensitive military items, known as defense articles and defense services, such as tanks, fighter aircraft, missiles, and military training, which it lists on the U.S. Munitions List (USML). Commerce controls the export of U.S.-origin items with both commercial and military applications (known as “dual-use” items), such as computers, sensors and lasers, and telecommunications equipment, as well as less sensitive military items, which it lists on the Commerce Control List (CCL).

Items subject to State and Commerce jurisdiction are governed by separate laws and regulations. The Arms Export Control Act of 1976, as amended, provides the statutory authority to control the export of defense articles and services, which the President delegated to the Secretary of State. State’s ITAR implements this authority and identifies the specific types of items subject to control in the USML. Within State, the Directorate of Defense Trade Controls (DDTC) is responsible for implementing controls on the export of these items. The Export Control Reform Act of 2018 provides the statutory authority for Commerce to control the export of less sensitive military items not on the USML, dual- use items, and basic commercial items. In general, items subject to the EAR include commodities, software, and technology. Commerce’s EAR, which contains the CCL, implements this authority. Commerce’s Bureau of Industry and Security (BIS) is responsible for administering these export controls.

DDTC and BIS control the export of items within their respective jurisdictions by requiring, in certain instances, a license or other authorization to export an item. Whether a license is required will generally depend on the intended destination, end-use and end-user, and the item’s classification. Generally, unless a license exemption or exception applies, exporters submit a license application to DDTC if their items are controlled on the USML, or to BIS if their items are controlled on the CCL. In addition to the shipment of tangible commodities or the tangible or intangible transfer of software or technology outside of the United States, export control regulations also consider the transfer or release of certain U.S. technology or source code to a foreign person in the United States to be an export. These transfers or releases are commonly referred to as “deemed exports” and can take the form of written, oral, or visual disclosure of technology or source code. Under the ITAR, technical data is controlled for all exports, including deemed exports. Under the EAR, technology and source code are controlled for the purpose of deemed exports.

Export Controls in the University Environment

Export-controlled items or source code used in U.S. universities’ research activities may be subject to export controls. Such activities could include shipping an export-controlled item—such as certain biological samples or research equipment—overseas. Additionally, the release of export- controlled items or source code in connection with research activities to a foreign student or scholar could qualify as a deemed export requiring a license.

U.S. universities may be exempt from or not subject to export controls if the information they are planning to release falls into one of three categories: published information or information in the public domain, certain academic information, or fundamental research.

Published information or information in the public domain: Under the ITAR, information that is published and generally available in the public domain through specific methods is not considered to be technical data, and is therefore not subject to ITAR export licensing requirements. Under the EAR, unclassified technology or software that has been made available to the public without restrictions upon its further dissemination is considered to be published and is therefore not subject to the EAR.

Certain academic information: Under the ITAR, information regarding general scientific, mathematical, or engineering principles commonly taught in schools is not included in the definition of technical data and is not subject to ITAR export controls. Similarly, information that is taught in catalog-listed courses or associated teaching laboratories of academic institutions is not subject to the EAR.

Fundamental research: Fundamental research is not subject to the ITAR or the EAR. The ITAR defines fundamental research as basic and applied research in science and engineering where the resulting information is ordinarily published and shared broadly within the scientific community, as distinguished from research the results of which are restricted for proprietary reasons or specific U.S. government access and dissemination controls. The EAR defines fundamental research as research in science, engineering, or mathematics, the results of which ordinarily are published and shared broadly within the research community, and for which the researchers have not accepted restrictions for proprietary or national security reasons. Under the EAR, software and technology that arise during or result from fundamental research that is intended to be published is also not subject to the EAR. For example, a foreign person may be able to read research reports or view presentations that result from fundamental research and are intended to be published without the university obtaining a license. However, if that research involves software or technology that is subject to the ITAR or the EAR and is not intended to be published or produces an item that is subject to the ITAR or the EAR, the foreign person generally could not participate in the research without the university securing an export license.

Foreign Threats to Universities and Vulnerabilities in U.S. Export Controls

According to the FBI and DOD, as foreign adversaries use increasingly sophisticated and creative methodologies to exploit America’s free and open education environment, the United States faces an ever-greater challenge to strike a sustainable balance between unrestricted sharing and sufficient security within the U.S. university research environment. According to a 2019 FBI white paper, the inclusion of foreign students and scholars at U.S. universities entails both a substantial benefit and a notable risk. Specifically, the FBI reported that while many of these foreign students and scholars contribute to advanced research, the development of cutting-edge technology in an open research environment puts academia at risk for exploitation by foreign actors who do not follow U.S. laws and regulations. Additionally, a DOD report from September 2019 stated that research targeted by foreign talent programs includes topics relevant to U.S. national defense. According to the FBI, while the majority of foreign students and scholars do not pose a threat to their host institution, fellow classmates, or research fields, some foreign actors seek to illicitly or illegitimately acquire U.S. academic research and information to advance their home countries’ scientific, economic, and military development goals. By doing so, they can save their home countries significant time, money, and resources while achieving generational advances in technology.

The U.S. government, including GAO, has long identified vulnerabilities in U.S. agencies’ efforts to protect U.S. research from foreign entities who might seek to exploit the openness of the U.S. academic environment. In prior GAO reports, we identified weaknesses in the deemed export control system that could allow the unauthorized transfer or release of export-controlled items to foreign persons in the United States. Moreover, since 2007, we have identified the protection of technologies critical to U.S. national security interests—including through U.S. export controls—as a high-risk area. More recently, the Senate Homeland Security and Governmental Affairs Committee reported that federal agencies need to do more to mitigate the threat to American universities by foreign persons seeking to undermine the integrity of the American research enterprise and endanger our national security.

Foreign Students and Scholars at U.S. Universities

More than 1.2 million foreign students and 21,000 foreign scholars studied or worked at U.S. universities in 2018. Nearly a third of foreign students studying in the United States are from China, and a large proportion of Chinese students major in science, technology, engineering and mathematics (STEM) fields (see table 1).

In addition, 10 countries accounted for about 70 percent of the more than 21,000 foreign scholars who worked at U.S. universities in 2018 (see table 2).

Federal Funding for University Research

The federal government obligated approximately $33 billion for U.S. universities for research and development in fiscal year 2017. The National Institutes of Health obligated approximately 54 percent of federal research and development funding provided to U.S. universities that year. The Department of Energy, DOD, and the National Aeronautics and Space Administration also obligated significant funding for universities for research (see fig. 1).

State and Commerce Have Provided Guidance and Conducted Outreach, but Universities Expressed Concerns about Their Adequacy for Addressing University-Specific Issues

State’s DDTC and Commerce’s BIS have developed export compliance- related guidance and conducted outreach to support all exporters’ understanding of and compliance with the regulations. However, university and association officials raised concerns that DDTC and BIS guidance and outreach does not adequately address university-specific export compliance issues. In addition, DDTC’s export compliance guidelines do not explicitly promote risk assessments, identified by GAO as a key element for determining whether an entity’s processes address current threats.

State and Commerce Have Provided Export Control-Related Guidance and Conducted Outreach to Support Exporters’ Compliance Efforts

State’s DDTC and Commerce’s BIS have developed various forms of written guidance and conducted outreach to support all exporters’ understanding of export control regulations. The ITAR and the EAR regulations apply to all exporters, whether universities, private entities, non-profits, or government entities, and according to DDTC and BIS officials, the guidance and outreach materials they have developed are similarly applicable to all potential exporting entities, including universities.

Written Guidance

Both DDTC and BIS provide written guidance intended to (1) increase awareness of applicable export control regulations, (2) provide specific instructions or tools for complying with those regulations, and (3) dispense transaction or entity-specific information or guidance for all exporters. For example, DDTC’s and BIS’s websites include general information about their respective export control regulations, including guidance on when an export license is needed and how such a license can be procured. DDTC highlights useful resources available on its website in a letter it sends to entities, including universities, when those entities register with DDTC as potential exporters of ITAR-controlled items. BIS’s website includes information about deemed exports, which one BIS official said is particularly relevant to universities. Both websites also include sets of frequently asked questions.

DDTC and BIS have also developed guidance that provides specific instructions or tools for complying with the agencies’ regulations, including export compliance guidelines (see below for more information about these guidelines) and decision tools for classifying items subject to the ITAR and the EAR. For example, DDTC offers exporters an online tool to help them identify steps to follow in reviewing the USML and in classifying items subject to the ITAR. Similarly, BIS provides exporters with (1) online tools to help them classify items subject to the EAR and (2) guidelines for completing the license application for both deemed exports and tangible exports, such as chemical and biological items.

Finally, both DDTC and BIS offer several mechanisms for obtaining transaction- or entity-specific information or guidance. For example, DDTC and BIS provide advisory opinions when an exporter requests a formal answer to an export control-related question, and both agencies operate a hotline to provide informal guidance to potential exporters. In addition, BIS reviews and provides feedback on export compliance manuals adopted by exporting entities, including universities, when requested. Exporters may also request a commodity jurisdiction classification from DDTC and BIS to determine whether a commodity is subject to the ITAR or the EAR.

Training and Outreach

Both agencies also provide training, present at conferences, and conduct site visits to further educate exporters. For example, DDTC provides in- house seminars on export licensing basics approximately twice a year. BIS has developed and conducts various types of training related to export control compliance, including training videos that are publicly available on its website. BIS also hosts regional seminars and an annual conference in Washington, D.C., on export controls and export compliance.

Both DDTC and BIS participate in various conferences. For example, DDTC and BIS participate in an annual conference affiliated with the Association of University Export Control Officers, where agency officials discuss topics such as regulatory updates, license statistics, and export compliance best practices. In fiscal year 2019, DDTC participated in 52 outreach events, two of which were university-specific. During that year, BIS conducted or participated in over 80 outreach events, six of which were university-specific.

DDTC and BIS also conduct site visits to learn more about a given entity’s export compliance program and provide feedback, among other things. According to officials, DDTC conducted three university site visits from 2015 through 2019. Similarly, according to officials, BIS conducted two university site visits from 2013 through 2019. Further, officials at both agencies stated that they share information at outreach events about export compliance program strengths and weaknesses they identified during site visits.

Universities Expressed Concerns that Agency Guidance and Outreach Does Not Adequately Address University- Specific Export Compliance Issues

Officials from universities in our sample and university association officials told us that most DDTC and BIS export control-related guidance and outreach does not address those issues most relevant to the university export compliance environment and that additional guidance and outreach efforts would be useful. For example, according to association officials and officials at six of the nine universities we visited, it is sometimes difficult to understand how to implement in the university environment what they perceive to be industry-focused guidance developed by DDTC and BIS. Some of these officials further noted that the export compliance environment for industry typically differs from that for academia. Specifically, university and association officials noted that companies are typically focused on developing proprietary technologies, whereas universities are primarily focused on expanding knowledge through fundamental and collaborative research. In addition, officials from two universities stated that researchers typically do not see themselves as exporters, which makes it difficult to explain to them how export control regulations pertain to university research. For example, one official told us that it is difficult to explain the concept of a deemed export within an open, academic setting to university researchers. Officials at two universities also noted that the term “defense service,” a type of export subject to the ITAR, is a difficult concept to explain to university researchers who do not consider their work to be a “service.”

Officials at four universities told us that they rely on university associations to develop a common understanding or interpretation of the regulations for the university context. For example, officials from one university said that university associations are a resource for sharing information and best practices regarding export compliance in the university environment. An official from another university stated that although she reviews the DDTC and BIS websites periodically for regulatory updates, she relies on university associations to explain how any updates affect universities.

Some university officials stated that some agency outreach efforts are useful, but others said that more outreach is needed. Specifically, five university officials mentioned specific agency training and outreach efforts as being useful. For example, the officials said they appreciate that BIS conducts regional seminars for all exporters, which they said are easier to get to than events in Washington, D.C. One of these officials further noted that these seminars discuss how to set up an effective compliance program. However, four university officials stated that additional outreach efforts by both DDTC and BIS were needed. For example, two of these officials suggested that agencies consider additional training for universities, such as webinars or videos providing examples of simple export scenarios for university audiences, to clarify the intent of the export control regulations and explain how regulatory requirements pertain to university research.

In discussing additional guidance needs, university and association officials told us that a set of all-encompassing, university-specific guidance is not necessary, but that additional guidance addressing specific topics that are relevant to universities would be useful. For example, one university association told us that additional DDTC and BIS guidance could take the form of frequently asked questions regarding issues of interest to universities, such as deemed exports and fundamental research. Similarly, one university export control officer stated that additional sets of frequently asked questions focused on issues most relevant to university export compliance, examples of university export compliance best practices, and examples of export control violations committed by universities would be particularly helpful. This export control officer explained that such guidance would help her and her colleagues (1) explain why the export control regulations are relevant for university researchers and (2) better explain the need for additional compliance resources to university management.

University and association officials further stated that it would be helpful if DDTC and BIS would work with university associations to develop guidance that would support universities’ efforts to interpret the regulations consistently. These officials said that a stronger partnership between the regulatory agencies and universities would support agencies’ understanding of the university environment and result in better guidance for universities. They noted, for example, that soliciting university input on existing guidance and suggestions for additional guidance could provide DDTC and BIS with helpful information about the challenges that universities face in complying with export control regulations in their distinct environment.

DDTC officials acknowledged that additional guidance addressing university-specific issues could be helpful and agreed that it may be difficult for university export control officers to explain export control regulations to researchers. They told us that it could be useful for the department to draft white papers, sets of frequently asked questions, or tip sheets specifically addressing issues most relevant to universities. For example, officials suggested that DDTC could develop tips on what may constitute a defense service in the university context. DDTC officials explained that they had not drafted such guidance because of resource constraints and other priorities.

When we asked BIS officials about the potential need for university- specific guidance, one official identified some currently available guidance that could be most useful to universities. For example, BIS maintains a set of frequently asked questions and a YouTube webinar concerning deemed exports, and has guidance related to fundamental research available on its website. According to BIS, it regularly updates guidance related to deemed exports and fundamental research, including in connection with regulatory changes that affected both areas in 2016.

GAO’s Standards for Internal Control in the Federal Government state that management should communicate with, and obtain information from, external parties using established reporting lines. Although BIS has provided written guidance that is relevant to universities and both DDTC and BIS conduct university-specific outreach, officials at universities we visited and associations we interviewed raised concerns about the adequacy of this guidance and outreach for the university research environment. Without additional guidance and outreach from DDTC and BIS that addresses issues most relevant to universities, some universities may utilize guidance, training, or other resources developed by other entities that may not facilitate compliance with export control regulations in the way that DDTC and BIS intended. Hence, universities may be at risk of failing to comply with export control regulations and properly safeguard export-controlled items from foreign students and scholars who are not authorized under deemed export licenses to receive such items. In addition, such university-focused guidance is consistent with the Export Control Reform Act of 2018, which requires the President to enforce export controls by providing guidance in a form that facilitates compliance by academic institutions and other entities.

State’s Written Guidance Does Not Explicitly Promote Risk Assessments

Although State’s DDTC and Commerce’s BIS officials identified their respective export compliance guidelines, available on the agencies’ websites, as key sources of written guidance for supporting exporters’ compliance with each agency’s export control regulations, DDTC’s compliance guidelines do not explicitly promote risk assessments. Both sets of export compliance guidelines include similar elements that the agencies consider critical for an effective export compliance program. For example, both sets of guidelines include elements related to management commitment, recordkeeping, and training. However, DDTC’s guidelines do not advise entities on how to assess risk, which GAO has identified as a key element for determining whether an entity’s processes address current threats.

BIS Guidelines. BIS’s export compliance guidelines identify eight elements of an effective export compliance program. BIS officials stated that the agency’s guidelines provide a useful compliance framework for all exporters, including universities. These guidelines include information about recordkeeping, conducting internal audits, performing risk assessments, and training, among other elements. BIS’s guidelines also provide templates, checklists, specific examples, and other tools exporters may use to develop an export compliance program or enhance an existing program. For example, the guidelines include a summary of potential risks involved in each phase of the exporting process with a list of tools to mitigate such risks. The guidelines also include an audit module tool to help exporters review and revise their current compliance program with a set of checklists for each of the eight elements.

DDTC Guidelines. DDTC’s export compliance guidelines include nine elements that it has identified as important aspects of an effective export compliance program. According to DDTC, its guidelines are also applicable to all exporters, including universities, and the agency references them in a confirmation letter when entities register as exporters. The guidelines include information about organizational structure, corporate commitment and policy, internal monitoring, and training, among other elements. The guidelines also provide examples of questions a compliance program should address for some elements.

However, DDTC’s export compliance guidelines lack a risk assessment element. Risk assessments provide entities with an opportunity to review their processes to determine whether the processes in place address current threats. According to DDTC, the agency has not added guidance related to risk assessments to the export compliance guidelines because it assumes that exporters conduct a risk assessment for each compliance element as a matter of course. GAO’s Standards for Internal Control in the Federal Government state that management should communicate quality information externally so that external parties can help the entity achieve its objectives and address related risks. Further, according to an Office of Management and Budget bulletin, agencies increasingly have relied on guidance documents to inform the public and to provide direction to their staffs as the scope and complexity of regulatory programs have grown. Exporters, including universities, may not conduct periodic risk assessments if DDTC’s guidance does not encourage them to do so. As such, they may be unaware of potential threats and may not take appropriate measures to protect export- controlled items.

Universities Identified Challenges Working with and Obtaining Guidance from Other Agencies

University and association officials we interviewed identified challenges working with and obtaining guidance from federal agencies that fund research and monitor threats to the United States, including threats to research security. Specifically, university and association officials identified the following three challenges working with and obtaining guidance from these agencies: (1) federal agencies are developing different requirements for reporting financial conflicts of interest to address foreign influence issues, (2) some agencies provide briefings and other forms of guidance related to export controls and foreign threats that do not sufficiently address universities’ needs, and (3) DOD officials inconsistently interpret export control regulations and misunderstand what constitutes fundamental research. Agencies are taking steps to address some of these challenges. For example, an interagency working group established by the White House Office of Science and Technology Policy and individual federal agencies are undertaking efforts to address university concerns regarding inconsistent financial conflict of interest reporting requirements and the lack of relevant, university-specific resources to address threats identified by some agencies. However, the actions that DOD plans to take to address agency officials’ inconsistent interpretation of the regulations and their misunderstanding of the term fundamental research may not fully address the challenge identified by university and association officials.

Universities Identified Inconsistent Reporting Requirements as a Challenge

University and association officials expressed concerns that federal agencies are developing different requirements for reporting financial or other conflicts of interest, such as foreign funding, but some of these differences in reporting requirements may be necessary to address varying agency-specific legal requirements. For example, recent reporting guidance from the National Institutes of Health reminds researchers to report all sources of support, including support for laboratory personnel and the provision of materials that are not freely available, whereas the most recent guidance from DOD does not include such clarification for what constitutes “support.” Although each agency has a separate mission and separate legal authorities, which may require agencies to have different financial or other conflict of interest reporting requirements, officials at several universities and associations discussed the challenges they face in complying with these varied reporting requirements. Representatives from one university association explained that these new requirements are especially challenging for universities because they typically accept funding from multiple agencies. In addition, officials from one university stated that the variation across the agencies’ reporting requirements makes it difficult to develop one process to support researchers’ efforts to comply with them. According to university and association officials, universities will need to spend more time and resources to understand and comply with each set of requirements. Moreover, one association official told us there is more room for universities to make mistakes when each agency develops different requirements to deal with the same issue.

An interagency working group established by the White House Office of Science and Technology Policy is undertaking efforts to address university concerns regarding inconsistent financial conflict of interest reporting requirements. In May 2019, the Office of Science and Technology Policy established the Joint Committee on the Research Environment (JCORE), an interagency effort to address research security and other related issues. According to officials in the Office of Science and Technology Policy, JCORE has drafted one set of coordinated guidance for funding agencies to ensure that funding agencies consistently require researchers to report the same types of information regarding potential conflicts of interest. In addition, JCORE has drafted a set of non-binding guidelines for universities to support their efforts to comply with conflict of interest reporting requirements. Officials stated that the draft guidance for funding agencies and the non-binding guidelines for universities were under review as of January 2020. Officials further stated that JCORE is developing a set of case studies and other materials that federal agencies will be able to use to educate researchers and universities about the types of situations that represent a potential conflict of interest.

Universities Cited a Lack of University-Specific Resources for Addressing Threats Identified by Some Agencies as a Challenge

Agencies such as the FBI, DHS, BIS’s Office of Export Enforcement, and DOD’s Defense Counterintelligence and Security Agency provide briefings and other forms of guidance related to export controls and foreign threats. For example, officials at these agencies provide briefings to individual universities or to groups of universities during university association events, such as the annual Association of University Export Control Officers conference and the annual Academic Security Conference hosted by the Texas A&M University System. In addition, DHS identified the 11 universities with the largest number of foreign students studying in STEM fields in 2018 to target university outreach efforts in late 2018 and early 2019. DHS developed a template presentation for DHS field offices to use during their outreach to these universities to increase awareness of export control laws. According to DHS, it plans to expand this effort to target the top 60 universities with foreign students in STEM fields. The Department of Justice and BIS’s Office of Export Enforcement have both published reports summarizing recent major U.S. export enforcement-related criminal and administrative prosecutions. Some university officials told us that the briefings and other information that some agencies provide are helpful for improving their awareness of threats.

However, officials at five of the nine universities we visited and officials from three university associations said that these briefings and other information are not as useful as they could be. Some of these officials cited the following reasons for why they did not find such information to be useful:

Classified information cannot be shared widely: Some university officials and an association representative stated that some agencies often provide classified briefings and materials that they cannot share widely with the university community. One university official said that it would be helpful if agencies, where possible, could also provide some unclassified information with clear examples that could then be shared with researchers about current threats and what these threats may look like in a university setting. Without such information, university officials are restricted in how they can use the threat-related information they obtain for raising awareness on campus, according to a university association official. Moreover, another university official stated that if export control officers cannot share relevant threat information with the university’s administration because of classification issues, the university may not get the resources it needs to improve its compliance programs and properly comply with export control regulations.

Guidance and threat information does not address the university environment or utilizes outdated examples: Representatives from three university associations and one university stated that some federal agencies do not provide guidance and threat information that address the university research environment, and two associations said that any university-specific examples federal agencies provide during briefings are outdated, which limits the relevancy of guidance and threat information to the university environment. For example, an official from one association explained that in 2015 the FBI provided a threat briefing at an association meeting and requested that university officials contact the FBI if a researcher had, among other things, published in an international scientific journal or attended an international conference, or if any graduate students worked in university laboratories late at night. This official noted that these FBI officials did not understand that researchers must undertake such activities to obtain tenure and that it is common for students to work late at night. In addition, according to an official from one association, when university officials ask the FBI to provide recent examples of foreign students stealing sensitive or export-controlled items from U.S. universities, the FBI often cites cases that occurred more than 10 years ago. He further stated that federal agencies are raising alarms that universities are vulnerable to foreign theft of export-controlled items without any concrete, recent examples.

FBI threat briefings lack actionable guidance: University officials told us that many FBI threat briefings are not helpful because they do not provide actionable guidance for addressing identified threats, which limits universities’ understanding of how to address them. For example, one university official stated that the FBI briefings do not provide any detailed information about what attendees should do with the information they obtain. He further stated that the briefings would be more beneficial if the FBI provided prescriptive guidance on how to use the information.

DOD and the FBI are taking steps to partner with academia to address challenges regarding information sharing. DOD is undertaking several collaborative efforts with academia in response to Section 1286(d) of the 2019 National Defense Authorization Act, which directed the Secretary of Defense to establish an initiative to support protection of national security academic researchers from undue influence and other security threats. For example, DOD partnered with the National Academy of Engineering to establish the “Roundtable on Linking Defense Basic Research to Leading Academia Research and Engineering Communities,” or the “Deans’ Roundtable.” The Deans’ Roundtable brings DOD leadership together with deans from U.S. university engineering programs to facilitate dialogue between DOD and the academic research community on research protection. The roundtable’s objectives are to better understand major issues in the defense research community and to form working groups to help craft potential solutions to challenges identified by the roundtable. The roundtable is expected to help address issues of research espionage by foreign governments on university campuses and inform senior DOD officials about technological developments on university campuses, among other efforts.

The FBI partnered with the Academic Security and Counter Exploitation Program, a university-led association focused on research security, to produce a series of unclassified “awareness-raising” materials for university audiences. According to FBI officials and a member of the Academic Security and Counter Exploitation Executive Committee, the FBI recognized that university officials were frustrated that relevant FBI documents regarding the foreign threat to U.S. research were classified. The association’s Executive Committee member further explained that this created significant restrictions on the way university officials could use the materials for awareness and training efforts on campus. He further noted that many of these “awareness-raising” materials were tone- deaf to the needs of academia and did not explain how the threats were related to university researchers’ work. The Academic Security and Counter Exploitation Executive Committee worked with the FBI to revise existing FBI handouts to create a series of academic-focused, unclassified documents suitable for inclusion in awareness and training programs on university campuses. For example, they revised a FBI handout regarding the threat that China poses to corporate America to instead focus on the threat that China poses to academia.

Universities Identified DOD Officials’ Inconsistent Interpretation of Export Control Regulations as a Challenge, and DOD’s Planned Actions Will Not Fully Address the Issue

Officials from multiple universities and associations stated that DOD officials inconsistently interpret export control regulations and misunderstand the term fundamental research and its implications when providing funding for university research, which some officials said leads to confusion, results in contract delays, and may limit universities’ ability to conduct research for DOD. DOD officials acknowledged that some officials have inconsistently interpreted the regulations. Moreover, DOD reported to Congress in September 2019 that it is mindful of the fact that reducing the quantity and competitiveness of early ideas flowing through the university system to the department by non-judicious use of controls could have negative consequences.

Officials at four of the nine universities we visited identified DOD officials’ inconsistent interpretation of the regulations and their misunderstanding of what constitutes fundamental research as a challenge they face in complying with export control regulations. For example, officials at three universities asserted that DOD includes contract clauses, such as export control-related clauses, that are not relevant to or conflict with other stated terms in the contract, in some cases. Officials at two universities further stated that there appears to be an internal disagreement between the program officers and contracting officers about how to interpret some aspects of export control regulations. One university official said the university tries to negotiate with DOD when contracts that the university perceives as only containing fundamental research include export control- related clauses; however, the official said these types of delays slow the pace of research.

Moreover, university association officials noted that member universities are reporting that DOD is increasingly including publication restrictions in research contracts for projects that the universities believe only entail fundamental research. Research does not qualify as fundamental research if the researcher accepts any restrictions on the publication of the information resulting from the research. Officials from one association stated that DOD is reluctant to remove publication restrictions from award contracts even when it acknowledges that the work may only involve fundamental research. As a result, universities that only accept contracts for fundamental research may decline an awarded contract if the conditions for the award vary from initial expectations, which may lead to a loss in research funding for many universities focused on fundamental research.

In 2008 and 2010, DOD issued memoranda to its personnel providing clarifying guidance concerning fundamental research and directed that information about contracted fundamental research be included in general training modules for research program personnel. For example, these memoranda state that DOD must not place restrictions on subcontracted unclassified research that has been scoped, negotiated, and determined to be fundamental research within the definition of National Security Decision Directive 189 according to the prime contractor and research performer and certified by the contracting component, except as provided in applicable federal statutes, regulations, or executive orders. These memoranda also state that the effective implementation of the guidance requires that all DOD personnel involved in the acquisition and monitoring of fundamental research have a clear and common understanding of the relevant statutes, regulations, and policies, including the definitions of key terms. To implement these memoranda, DOD also amended the defense federal acquisition regulations in 2013 to update the relevant contract clause for inclusion in DOD contracts.

The Deputy Director for Basic Research at DOD stated that most program officers and contracting officers are familiar with the export control regulations and understand the term fundamental research and how to interpret it in the context of university research, but acknowledged that some officials have inconsistently interpreted the regulations and misinterpreted the term fundamental research. Specifically, DOD officials stated that program officers and contracting officers who frequently work with universities through basic research grants understand what constitutes fundamental research; however, program officers and contracting officers working with applied research contracts may not be as familiar with it or with engaging with universities.

Furthermore, DOD officials acknowledged that although DOD has developed export control-related training, it does not require program officers and contracting officers to take this training. Officials stated that not all program officers and contracting officers work with universities, so they do not all need to take training on export control regulations.

To address these and other research-related concerns, DOD’s Office of Basic Research convened a workshop for basic research program officers in October 2019 to facilitate the sharing of best practices and identify any concerns. According to DOD, program officers raised a concern that they need to constantly ensure that the research being conducted is properly categorized as basic or fundamental research and has not transitioned into applied or non-fundamental research in the course of the contract. DOD’s Office of Basic Research is planning to develop a checklist based on input from program officers that program officers can use when determining whether the scope of a research project meets the definition of fundamental research. Following this workshop, a DOD official stated that program officers are best suited to make technical and nuanced fundamental research determinations because program officers have first-hand knowledge about the scope of the research project.

These actions, however, may not address the concerns universities raised, because they do not include any effort to further educate contracting officers. Contracting officers may add export control clauses or publication restrictions to a contract award after the program officer writes the original solicitation. Additionally, contracting officers are the individuals with regulatory authority for defense contracts to certify that research is fundamental research. Hence, a checklist for program officers may not fully address program officers’ and contracting officers’ inconsistent interpretation of the regulations, including determining whether university research constitutes fundamental research. Without additional efforts to educate all relevant DOD officials on a clear and common understanding of the relevant statutes, regulations, and policies, as identified by the department’s 2010 memorandum, universities may continue to perceive that DOD officials inconsistently interpret the regulations and misunderstand whether research constitutes fundamental research, potentially hindering DOD-funded research at universities.

Universities We Visited Generally Have Developed Export Compliance Policies and Practices Aligned with Agency Guidelines, Though Some Gaps Exist

The nine universities we visited have generally developed export compliance policies and practices to safeguard export-controlled items that align with State’s DDTC and Commerce’s BIS export compliance guidelines, but some of the universities’ compliance efforts have weaknesses in certain areas (see fig. 2).

We reviewed DDTC’s and BIS’s export compliance guidelines to identify common elements and developed a list of eight elements that the agencies classified as critical for an effective compliance program, such as recordkeeping and training, among others. See table 3 for a description of the eight elements we identified for this assessment.

We then interviewed officials at nine universities about their universities’ export compliance policies and practices. We selected universities with annual average expenditures for research and development during the 2013 through 2017 period that ranged from $15 million to over $750 million. In addition, we selected universities on the basis of a number of factors, including total research and development expenditures, number of graduate students, research funding received from certain federal agencies, and geographic dispersion (see app. I for more information about our selection methodology). Finally, we assessed the university officials’ responses against the eight elements of an effective export compliance program to determine the extent to which these universities’ policies and practices align with DDTC’s and BIS’s export compliance guidelines. See appendix III for a detailed description of our assessment of each university’s policies and practices against these elements and a description of the export compliance policies and practices the selected universities have in place.

In addition, we reviewed the websites of a generalizable sample of 100 U.S. universities to determine the extent to which these universities provide publicly available information about export control regulations, training, and other topics pertinent to the campus community. In general, the universities with larger research and development expenditures provided more export control-related information on their websites. See appendix IV for the results of this analysis.

Most of the Universities We Visited Have Export Compliance Policies and Practices That Generally Align with Agency Guidelines, with More Robust Practices in Four Areas

The seven universities with the highest research expenditures among the nine we visited have export compliance policies and practices that generally align with the eight elements we identified from DDTC’s and BIS’s export compliance guidelines, while the two universities with the lowest expenditures among the nine have more weaknesses in their compliance programs. Most of the universities we visited have robust export compliance practices in the following four areas:

Management commitment and organizational structure: All nine of the universities we visited have developed policies and practices that fully or partially align with this element. For example, management at seven of the nine universities we visited issued public statements supporting the university’s export compliance program. These statements briefly described export control regulations, discussed the importance of the universities’ compliance with export control regulations, and emphasized the universities’ commitment to compliance efforts.

Export authorization and tracking export-controlled items: All but one of the nine universities we visited have developed policies and practices that fully align with this element. For example, officials at all nine of the universities we visited stated that their universities require researchers to submit research proposals to an office charged with reviewing proposals and awards for grants and contracts. When reviewing research proposals or awards, this office will flag those proposals and awards that may be subject to export control regulations for further review, either by the export control officer or another authorized university entity. In addition, officials at seven of the universities said they had developed mechanisms to track any export-controlled items being used or developed by the university. The universities we visited also employ various security mechanisms to safeguard export-controlled items. These include physical security mechanisms, as shown in figure 3, as well as information technology security mechanisms, such as setting up separate networks for researchers using export-controlled data in their research.

Recordkeeping: Officials at all nine universities we visited have developed policies and practices that fully align with this element to ensure that they maintain appropriate export control-related records. For example, at least five of the nine universities we visited maintain their export compliance-related records in an electronic database or other electronic system. One of the universities utilizes a system that tracks each research project from start to finish. This system enables officials to search for all export control-flagged research proposals, awards, and technology control plans, among other documents. One of the officials also told us that the system will alert the export control officer to any technology control plans with an upcoming expiration date. Two of the remaining four universities maintained some files electronically and some in hard copy. The other two universities did not discuss how they maintained their files, but identified who is responsible for export control-related recordkeeping and the types of documents they maintain.

Reporting violations: All nine universities we visited have developed policies and practices that fully align with this element. Specifically, these universities have developed clear procedures outlining the actions employees should take in the event that potential noncompliance is identified. For example, officials at seven universities told us that they have a compliance hotline that people can use to report suspected violations.

Some Universities We Visited Have Gaps in Their Export Compliance Policies and Practices, with Most Gaps Falling into Four Areas

Some of the universities we visited have weaknesses in their export compliance programs, particularly in the following four areas:

Risk assessment: Four of the nine universities we visited do not currently conduct risk assessments to assess and identify potential risks in their export compliance programs, which may limit their ability to identify potential risks or build safeguards in their export compliance program to address potential risks. Three of these four universities are in the lowest tier for annual research and development expenditures.

Training: Two of the nine universities we visited do not provide any formal training for researchers and other officials involved in implementing export control regulations. However, an official from one of the universities said that the university provides access to online export control-related trainings developed by a for-profit entity. The export control officer at the other university said that although the university does not conduct formal training, he conducts frequent outreach and provides materials to increase university officials’ awareness of export control regulations.

Internal audits: Four of the nine universities we visited either partially conducted, or did not conduct, internal audits of their export compliance programs. The three universities that partially conducted internal audits have an export control officer who periodically reviews some internal processes but did not have a university audit group outside of the export control office that had reviewed the export compliance program. However, officials from two of these universities stated that their audit office plans to conduct an audit of the export compliance program soon.

Export compliance manual: Four of the nine universities we visited have not developed an export compliance manual. According to DDTC and BIS guidelines, exporters are encouraged to develop a manual to document export control-related roles and responsibilities of various offices and officials. The manuals should also describe export control procedures, development of technology control plans for export-controlled work, training requirements, and processes for reporting potential violations, among other topics.

Conclusions

Research conducted by U.S. universities and supported by visiting foreign students and scholars makes critical contributions to U.S. national security and economic interests. However, the relative openness of the university environment also presents a vulnerability that can be exploited by foreign adversaries. State’s DDTC and Commerce’s BIS administer systems of export controls to minimize these vulnerabilities while allowing legitimate business to occur, and the agencies provide guidance and conduct outreach to facilitate universities’ compliance with these controls. While DDTC and BIS provide some guidance and conduct outreach to universities, university officials told us that this guidance does not adequately address university-specific issues. The universities we visited primarily rely instead on guidance and training provided by other entities, which may not always facilitate compliance with the export control regulations as DDTC and BIS intended. We found that the nine universities we visited have generally developed export compliance policies and practices that align with agency guidance, but some of the universities’ compliance efforts have gaps. Improved guidance and outreach based on feedback from university stakeholders could further strengthen universities’ efforts to identify and protect export-controlled items from unauthorized transfers or releases to foreign students and scholars. This is especially important in light of continued reports of foreign entities’ exploitation of university research.

Moreover, DDTC’s export compliance guidelines do not include information concerning risk assessments, a key element for determining whether an entity’s processes address current threats. Four of the nine universities we visited did not conduct risk assessments. Including information about risk assessments in DDTC’s written guidelines regarding the elements of an effective export compliance program would enable DDTC to remind universities and other exporters that conducting risk assessments is a beneficial practice. If exporters, including universities, do not conduct periodic risk assessments, they may be unaware of new threats and, consequently, may not take appropriate measures to protect export-controlled items.

Furthermore, universities reported challenges working with DOD because of DOD officials’ inconsistent interpretation of export control regulations, including how to assess whether a university is engaging in fundamental research. DOD officials acknowledged this challenge, but DOD has not taken sufficient action to educate its personnel on the regulations. Without additional action, DOD may continue contributing to confusion and contract delays that hinder legitimate research.

Recommendations for Executive Action

We are making four recommendations, including two to State, one to Commerce, and one to DOD. Specifically: The Secretary of State should ensure that the Deputy Assistant Secretary for Defense Trade Controls, in consultation with university representatives, provides additional or revises existing guidance and outreach to address university-specific export control issues to further support universities’ understanding and compliance with the International Traffic in Arms Regulations. (Recommendation 1)

The Secretary of Commerce should ensure that the Under Secretary for Industry and Security, in consultation with university representatives, provides additional or revises existing guidance and outreach to address university-specific export control issues to further support universities’ understanding and compliance with the Export Administration Regulations. (Recommendation 2)

The Secretary of State should ensure that the Deputy Assistant Secretary for Defense Trade Controls revises existing export compliance guidelines to include information concerning periodic risk assessments to remind exporters that it is beneficial to periodically identify, analyze, and respond to new risks as part of an effective International Traffic in Arms Regulations compliance program. (Recommendation 3)

The Secretary of Defense should ensure that the Under Secretary of Defense for Research and Engineering takes steps to ensure that its program officers and contracting officers are interpreting export controls consistent with regulations and guidance and consistently determining whether university research constitutes fundamental research. (Recommendation 4)

Agency Comments and Our Evaluation

We provided a draft of this report to Commerce, DHS, DOD, FBI, State, and the White House Office of Science and Technology Policy for comment. In their comments, reproduced in appendixes V and VI, State and DOD concurred with the recommendations directed to them. State also provided information about the actions it plans to take to address recommendations 1 and 3. With respect to recommendation 1, State noted that it is already expanding its outreach to university representatives and planning to issue additional guidance to further support universities’ understanding of the ITAR. With respect to recommendation 3, State noted that it plans to revise existing export compliance guidelines to include information concerning periodic risk assessments. DOD also provided information about actions it plans to take to address recommendation 4. Specifically, DOD stated that it will develop new guidance for DOD personnel to clarify the process for identifying fundamental research, funding contracts containing fundamental research, and monitoring those contracts to ensure that they are performed in compliance with export control regulations and fundamental research policies. DOD also stated that it plans to work with State and Commerce to ensure that the new guidance is consistent with the ITAR and the EAR, respectively. Commerce concurred with recommendation 2, but it did not provide a comment letter in time for publication in the report.

DHS, FBI, and the White House Office of Science and Technology Policy informed us that they had no comments. Commerce, DOD, and State provided technical comments, which we incorporated as appropriate.

We are sending copies of this report to the appropriate congressional committees; the Secretaries of Commerce, Defense, and State; the Acting Secretary of Homeland Security; the Attorney General of the United States; the White House Office of Science and Technology Policy; and other interested parties. In addition, the report is available at no charge on the GAO website at http://www.gao.gov.

If you or your staff have any questions about this report, please contact me at (202) 512-8612 or gianopoulosk@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix VII.

Appendix I: Objectives, Scope, and Methodology

Our report examines (1) the extent to which the Departments of State (State) and Commerce (Commerce) have provided guidance and outreach that supports U.S. universities’ understanding of and compliance with both agencies’ export control regulations, (2) export control-related challenges that U.S. universities face while working with or obtaining guidance from other federal agencies, and (3) the extent to which export compliance policies and practices developed by U.S. universities align with State’s and Commerce’s export compliance guidelines.

In addition to the methods discussed below, we reviewed government reports concerning (1) previously identified gaps in the U.S. export control system and (2) the threat that some foreign persons pose to U.S. universities to provide context for all three objectives, and reviewed relevant federal laws and regulations to address all three objectives. We also attended a conference in March 2019 hosted by Association of University Export Control Officers member universities to better understand how universities administer export control regulations and those aspects of the regulations most relevant to universities. We used the information we collected during the conference to inform our planning for our site visits.

Federal Data

To provide context for all three objectives, we examined federal data concerning (1) the number of foreign students and scholars studying or working at U.S. universities, (2) federal agencies’ research and development funding provided to universities, and (3) U.S. universities’ export license applications.

We examined data identifying the country of citizenship for foreign students and scholars studying or working at U.S. universities from 2013 through 2018. We received the foreign student data from the Department of Homeland Security (DHS), which pulled data from its Student and Exchange Visitor Information System. We used these data to identify the top 10 countries sending foreign students to U.S. universities in 2018. DHS also provided data identifying foreign scholars working at U.S. universities based on I-129 filings. The I-129 form is typically filed by a U.S. employer on behalf of a nonimmigrant worker to come to the United States to temporarily perform services or labor or to receive training. We used these data to identify the top 10 countries sending foreign scholars to U.S. universities in 2018.

We utilized data collected by the National Science Foundation to determine the amount of research and development funding U.S. universities received from federal agencies in fiscal year 2017. The National Science Foundation collects funding information from federal agencies through its Survey of Federal Funds for Research and Development. We downloaded the data from the agency’s website and analyzed the data to determine how much funding selected federal agencies and the federal government as a whole provided to universities and university-administered Federally Funded Research and Development Centers.

Finally, we analyzed State and Commerce data for export license applications received in calendar years 2014 through 2018 to identify trends in U.S. university export license applications and determine the percentage of export license applications from U.S. universities as a share of all export license applications. For both data sets, we reviewed each applicant to verify whether it was a U.S. university, because both agencies provided some data that included license applications submitted by entities that are not U.S. universities, such as associations or foreign universities. We then analyzed the data to determine trends in application results, identify the top 10 destination countries for approved U.S. university export license applications, and identify the top five categories of export-controlled items for export license applications submitted by U.S. universities.

We determined that all of these data sources were sufficiently reliable for providing context for our report.

Interviews and Reviews of Relevant Documents

To address our first objective, we interviewed relevant State and Commerce officials from the Directorate of Defense Trade Controls and Bureau of Industry and Security and reviewed the guidance and outreach materials these agencies developed related to export controls. We also analyzed information regarding their outreach efforts for fiscal year 2019 to identify the number of university-specific outreach events. In addition, we attended (1) the March 2019 Association of University Export Control Officers conference, at which both State and Commerce officials presented to university officials, and (2) Commerce’s annual conference on export controls in Washington, D.C., at which State officials also presented.

To address our second objective, we interviewed officials from several agencies that provide research funding to universities, including the Departments of Defense (DOD) and Energy, the National Institutes of Health, and the National Aeronautics and Space Administration, to learn how they work with universities that receive research funding. Additionally, we met with a number of security agencies, including DOD’s Defense Counterintelligence and Security Agency, DHS, and the Federal Bureau of Investigation, and reviewed reports, handouts, and outreach materials regarding either export control regulations or the threat environment to learn how these agencies educate U.S. universities. Finally, we met with the White House Office of Science and Technology Policy to discuss an interagency effort to address research security and other related issues.

To identify university perspectives for all three of our objectives, we interviewed (1) representatives from four university associations and (2) officials at nine U.S. universities. Specifically, for our first and second objectives, we interviewed representatives from the Association of University Export Control Officers, Association of American Universities, and Council on Governmental Relations. The Association of University Export Control Officers is a member organization composed of over 270 export control and other compliance officers at U.S. academic institutions to provide a forum for the exchange of information regarding higher education and export, import, and trade sanctions policies. The Association of American Universities represents 65 research universities and seeks to shape policy for higher education, science, and innovation. According to a representative, the association’s membership is composed of university presidents and chancellors. The Council on Governmental Relations provides information to over 185 member universities regarding research administration and compliance, financial oversight, and intellectual property. The association’s membership is mainly composed of Vice Presidents for Research and Directors of Sponsored Research, according to a representative. For our second objective, we also interviewed a representative from the Academic Security and Counter Exploitation Program, whose executive committee includes representatives from 11 universities and university systems. This university-led association is focused on providing a forum within academia for discussions concerning the protection of intellectual property, controlled information, key personnel, and critical technologies at U.S. universities conducting research relevant to national security. For all three of our objectives, we interviewed officials at nine U.S. universities. See below for our selection methodology.

Site Visits

To inform all three of our objectives, we conducted site visits to nine U.S. universities to speak with various university officials. We selected a non- generalizable sample of nine U.S. universities on the basis of a number of factors, including total research and development expenditures, number of graduate students, research funding received from certain federal agencies, and geographic dispersion.

To identify a sample of U.S. research universities, we first examined U.S. university research and development expenditures data collected by the National Science Foundation for the 2013 through 2017 period. The National Science Foundation collects this data from universities through its annual Higher Education Research and Development Survey and we downloaded the data from the agency’s website. We then calculated the average annual research and development expenditures for each university on this list for this period. We limited our scope of universities to those with an annual average total research and development expenditures of over $15 million. This resulted in a total sample size of 292 U.S. universities. To assess the reliability of the data, we reviewed related documentation on the National Science Foundation’s web page regarding the Higher Education Research and Development Survey and dataset. We determined these data to be sufficiently reliable for the purposes of our report.

We then reviewed a number of other factors for each of these universities. First, we categorized each of the 292 universities in our sample as public or private. We then identified the number of full-time graduate students for each university on the basis of results from the National Science Foundation’s annual Survey of Graduate Students and Postdoctorates in Science and Engineering (2016), because federal officials told us that graduate students were more likely to conduct research involving items subject to export control regulations than undergraduate students. We also reviewed universities’ security clearance level and membership in a number of associations to identify those universities that may be more aware of research security-related issues. Finally, we downloaded data from the Federal Procurement Data System to identify the total amount of federal contracts for research and development each university in our sample had received from four main funding agencies—DOD, the Department of Energy, the National Institutes of Health, and the National Aeronautics and Space Administration. These four agencies represent four of the five major funding agencies for university research and development in fiscal year 2017. In addition, they represent the four agencies that we determined, in consultation with GAO stakeholders and State and Commerce officials, are most likely to provide funding for research involving items that may be subject to export control regulations.

We grouped the universities in our sample into six geographic regions and initially selected 35 universities across these six regions that represented a cross-section of universities, on the basis of the factors discussed above. Ultimately, we selected nine universities for site visits from four of these regions on the basis of university officials’ availability and scheduling considerations. While we sought to include a range of university experiences regarding export control compliance in our non- generalizable sample, the university officials’ views stated in this report do not represent the entirety of the U.S. academic community.

During our site visits, we conducted semi-structured interviews with about 80 university officials involved in export compliance on the main campus of nine universities, including officials in the following relevant positions: vice presidents for research, export compliance officers, facility security officers, and officials charged with reviewing grants and contracts, among others. During these interviews, we asked officials about the export control-related policies and practices their university had developed; their roles in implementing those practices; their perspectives concerning guidance and threat-related information from federal agencies; and any challenges they face in complying with export control regulations, among other topics. We also conducted seven focus groups with 44 faculty in Science, Technology, Engineering and Mathematics (STEM) fields. However, we were not able to meet with all of the same types of officials at each university we visited.

Assessment of University Export Compliance Policies and Practices against State and Commerce Guidelines

To address our third objective, we assessed university officials’ responses concerning export compliance policies and practices against a set of eight elements of an effective export compliance program. We reviewed State’s and Commerce’s guidelines to identify a list of eight common elements that the agencies classified as critical for an effective compliance program. We then assessed the responses of university officials from the nine universities we visited against these eight elements. Within some of the elements, we identified sub-elements for assessing university policies and practices. For example, within the element for management commitment and organizational structure, we identified five sub-elements against which we reviewed university officials’ responses. For each element, we developed a scale for determining whether each university’s export compliance policies and practices fully aligned, partially aligned, or did not align with that element. For example, for the management commitment and organizational structure element, we defined the extent to which each university’s policies and practices aligned with this element as (1) “fully aligned” if policies and practices were in place for at least four out of five sub-elements, (2) “partially aligned” if they were in place for two or three out of five sub-elements, and (3) “not aligned” if they were in place for one or zero of five sub- elements.

We conducted this performance audit from February 2019 to May 2020 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives.

Appendix II: Analysis of Export License Application Data for U.S. Universities

Although U.S. universities generally promote an open learning environment that is focused on the free exchange of information through fundamental research, some U.S. universities conduct research involving export-controlled items and have applied for export licenses for deemed exports (releases within the United States to foreign persons) and exports of tangible items out of the United States. The Departments of State (State) and Commerce (Commerce) both control the export of items within their respective jurisdictions by requiring a license or other authorization prior to the export of an item. Within State, the Directorate for Defense Trade Controls (DDTC) is responsible for implementing export controls. Similarly, within Commerce, the Bureau of Industry and Security (BIS) is responsible for implementing export controls.

State’s DDTC received 597 license applications from U.S. universities in calendar years 2014 through 2018. DDTC provides one of four decisions for each license application—approved, approved with provisos, denied, or returned without action. DDTC approved roughly 79 percent of license applications it received from U.S. universities during this period.

Commerce’s BIS reviewed 680 license applications from U.S. universities during this same time period. BIS provides one of three decisions for each license application—approved, denied, or returned without action. BIS approved 74 percent of these license applications.

DDTC and BIS denied a small number of license applications submitted by U.S. universities in calendar years 2014 through 2018. Specifically, DDTC denied five applications for exports to Mexico, Sri Lanka, and the United Kingdom, as well as one application involving various destination countries. BIS denied eight applications for exports to China, Iran, and Russia during this same period. See figure 4 for more information regarding the status of U.S. university export license applications submitted to DDTC and BIS in calendar years 2014 through 2018.

In calendar years 2014 to 2018, approximately 70 percent of the license applications submitted by U.S. universities that DDTC approved were for exports (including tangible exports and deemed exports) to 10 destination countries or multiple countries. This total included applications that involved various destination countries, which on their own represented 26 percent of total approved applications during this period (see table 4).

Similarly, 57 percent of the license applications submitted by U.S. universities that BIS approved in calendar years 2014 through 2018 were for exports (including tangible exports and deemed exports) to 10 countries (see table 5).

The top five U.S. Munitions List (USML) categories for which U.S. universities applied for export licenses from DDTC accounted for 77 percent of all applications for calendar years 2014 through 2018. These include license applications for exports controlled under USML categories related to spacecraft, night vision, and missiles (see table 6).

The top five categories for which U.S. universities applied for export licenses from BIS accounted for 85 percent of all license applications for calendar years 2014 through 2018. These include license applications for exports specified on the Commerce Control List (CCL) under categories related to chemicals, aerospace, and sensors and lasers, as well as the export of items designated as EAR99 (see table 7).

Appendix III: Assessment of University Export Compliance Policies and Practices against Agency Guidelines

The Departments of State (State) and Commerce (Commerce) have each developed a set of export compliance guidelines (guidelines), which agency officials identified as key sources of written guidance for supporting exporters’ compliance with the agency’s export control regulations. Both sets of guidelines include similar elements that the agencies have identified as being critical for an effective export compliance program. We reviewed both agencies’ guidelines and developed one set of eight elements of an effective export compliance program, which we then used to assess universities’ export control compliance practices. The eight sections below include descriptions of each element.

We selected a non-generalizable sample of nine U.S. universities for site visits on the basis of a number of factors, including total research and development expenditures, number of graduate students, research funding received from certain federal agencies, and geographic dispersion. To learn more about our methodology for selecting universities for site visits, see appendix I. We visited these nine universities to learn about the export control policies and practices that they had developed.

During our site visits, we conducted semi-structured interviews with about 80 university officials involved in export compliance, including officials in the following relevant positions: vice presidents for research, export compliance officers, facility security officers, and officials charged with reviewing grants and contracts, among others. We also conducted focus groups with 44 faculty in Science, Technology, Engineering and Mathematics (STEM) fields at seven of the nine universities we visited. During our university site visits, we asked officials about the export control-related policies and practices their universities had developed; their roles in implementing those practices; and the roles and responsibilities of others involved in implementing the university’s export compliance policies and practices, among other topics. We did not independently verify universities’ implementation of the export compliance policies and practices that university officials described during our site visits.

We found that the nine universities we visited had generally developed export compliance policies and practices to safeguard export-controlled items that aligned with State and Commerce export compliance guidelines, but that some of the universities’ compliance efforts had weaknesses in certain areas (see fig. 5).

In the following sections, we provide a (1) description of each element and (2) summary of the results of our assessment of each university’s policies and practices against each element.

Element 1—Management Commitment and Organizational Structure

For this element, we assessed universities’ activities within five sub- elements: (1) public management support for the export compliance program, (2) management’s understanding of export control regulations, (3) whether the university had designated an export control officer, (4) sufficiency of resources and authority to conduct export compliance activities, and (5) whether the university had created a clear organizational structure identifying individuals responsible for compliance. See figure 6 for the results of our assessment.

Management commitment and organizational structure Entities should have public management support for their compliance program, sufficient resources to conduct compliance activities, and a clear organizational structure identifying individuals responsible for compliance.

All nine of the universities we visited have developed policies and practices that fully or partially align with this element concerning management commitment and organizational structure. Specifically, seven universities had practices that fully aligned and two had practices that partially aligned with this element. Below, we provide additional detail on universities’ activities within the following five sub-elements:

Provides public management support for export compliance program. Seven of the nine universities we visited have issued public statements from university management supporting the export compliance program. These statements briefly describe export control regulations, discuss the importance of the universities’ compliance with export control regulations, and emphasize university management’s commitment to compliance efforts. In addition, university researchers who participated in our focus groups said that their universities had created an environment in which they felt comfortable reaching out to university staff with compliance-related questions. For example, participants in one of the focus groups told us that compliance officials are not trying to find violations, but are instead focused on building stronger compliance programs and stronger relationships with faculty.

Understands export control regulations. Export control officers at all nine of the universities we visited said that university management understands and is knowledgeable about export control regulations and the implications of these regulations on the university’s research and development activities. For example, one export control officer stated that increasing awareness among the administrators, faculty, and staff has taken time, but that the administration now has a good knowledge of export control requirements following the outreach and training that the export control office provided over the last few years.

Designates an export control officer position. Eight of the nine universities we visited have export control officers, and of those eight, five have had an export control officer position for over 10 years. The only university we visited that did not have an export control officer position had such a position prior to our visit. Among the universities we visited, this university had the lowest average research and development expenditures from 2013 through 2017—less than $30 million.

Provides sufficient resources and authority to conduct export compliance activities. Officials at eight of the nine universities we visited stated that their university had sufficient resources and that relevant officials had adequate authority to conduct export compliance activities. Officials at one university said that they did not have adequate authority to conduct compliance activities, but that this condition might be changing because the export control officers now report directly to the Vice President of Research, which is giving them greater access to university management.

Creates a clear organizational structure for export compliance.

Officials at seven of the nine universities we visited identified individuals who are involved in export control compliance, including researchers and officials working in procurement, shipping, and contracting, among other things. Five of these seven universities also have export compliance manuals that specifically describe various officials’ export compliance roles and responsibilities.

Element 2—Risk Assessment

For this element, we assessed the extent to which the university conducted risk assessments of its export compliance program. See figure 7 for the results of our assessment.

University Policies and Practices Related to Element 2—Risk Assessment

Five of the nine universities we visited have developed policies and practices that fully align with this element concerning risk assessments, while the other four have not developed such policies and practices. Below, we provide additional detail on universities’ risk assessment activities.

Of the five universities that told us they conduct risk assessments, three stated that the export control officers periodically or annually conduct internal risk assessments of their export compliance efforts, while the other two described university groups that conduct periodic or annual, university-wide risk assessments that include an assessment of the export compliance program. For example, one university’s export control officer said that her office periodically reviews the university’s export compliance policies and practices to determine whether any gaps exist within the program. She also recently started reviewing her university’s export compliance policies and practices against those of other universities to determine whether other universities had developed any export compliance practices that would be appropriate for her university to emulate. She found, for example, that other universities had implemented a centralized loaner laptop program for researchers traveling abroad to minimize the risk of the theft of sensitive data from personal laptops, and said she hopes to implement such a program at her university. Officials at a university that periodically conducts university- wide risk assessments said they had conducted two such risk assessments since 2015 and were conducting a third assessment during our visit. During one assessment, reviewers recommended that the university increase export control training and staffing, which the export control office is working to address. Another university that conducts annual risk assessments has a research oversight committee that is made up of many subcommittees, including one for export controls. Each subcommittee conducts an annual risk assessment for its compliance area and reports any recommendations for optimizing compliance program effectiveness to the vice president for research.

Element 3—Export Authorization and Tracking Export-Controlled Items

For this element, we assessed universities’ activities within seven sub- elements: whether the university (1) had processes in place to identify research involving export-controlled items, (2) had processes in place to monitor research to determine whether a license might be required at a later time, (3) tracked any export-controlled items being used or developed, (4) had developed any policies or practices for safeguarding export-controlled items, (5) used technology control plans to document and safeguard export-controlled items, (6) screened and monitored foreign visitors, and (7) screened all foreign parties associated with research projects prior to any export activities. See figure 8 for the results of our assessment.

Export authorization and tracking export- controlled items Entities should develop processes to (1) ensure the organization makes correct export decisions, including identifying when U.S. government authorization is required prior to exporting; (2) track and protect any export- controlled items being used or developed by the organization; and (3) screen all parties associated with an export transaction against the U.S. proscribed/restricted parties lists prior to exporting.

All but one of the nine universities we visited have developed policies and practices that fully align with this element concerning export authorization and tracking export-controlled items. Below, we provide additional detail on universities’ activities within the seven sub-elements, which fall under three process categories: making export decisions, tracking and safeguarding export-controlled items, and screening foreign parties.

Under this category, we assessed universities’ activities in the following two areas: Identifies research involving export-controlled items: Officials at all nine of the universities we visited stated that they had, to varying degrees, developed policies and practices for identifying research projects that might involve items that are subject to export control regulations.

Policies and practices for identifying research involving export-controlled items. All nine of the universities we visited require the lead researcher on a project to submit research proposals to an office charged with reviewing proposals and awards for grants and contracts, which we refer to as the Office of Grants and Contracts. The office also reviews the terms and conditions for awards—contracts, grants, or cooperative agreements—to ensure there is nothing in the paperwork that necessitates additional negotiation or that raises a concern related to export controls. When reviewing research proposals or awards, the Office of Grants and Contracts will flag those proposals and awards that may involve items subject to export control regulations for further review, either by the export control officer or another authorized university entity.

Tools developed to support officials’ identification of research involving export-controlled items. The universities we visited have developed a variety of tools to support officials’ export control reviews of proposals and awards. For example, seven of the nine universities we visited require the lead researcher on a project to complete a questionnaire that includes export control- related questions when submitting research proposals for review. This questionnaire identifies research proposals that may be subject to export control regulations earlier in the process. In addition, at least four of the universities’ export control officers have developed flowcharts or checklists to help the Office of Grants and Contracts understand when to flag research proposals or awards for further review by the export control officer. In addition, seven of the nine universities we visited require that researchers obtain university approval to conduct research involving export-controlled items. For example, one university’s export control officer said that flagged proposals are sent to an export control review committee for review and approval. The committee reviews the risk associated with each of these research projects and determines whether the university is willing to accept the export control-related risks for that project. Another university requires the lead researcher to obtain approval from the university’s board before accepting an award for research involving export-controlled items.

Monitors research to determine whether a license is required after the project starts. Officials at five of the nine universities described practices they had developed to monitor research projects in order to determine whether an export license is required after a research project is underway. For example, one university’s export control officer said her department monitors all research teams that intend to develop hardware or technology during their research because the resulting hardware or technology could be subject to export control regulations. These projects are flagged in the electronic system used to track research projects and the export control officer checks in with the lead researcher periodically to determine the status of the research. An official at another university explained that the university conducts periodic audits of timecards to see if any foreign persons have started charging time to ongoing projects involving export-controlled items. In contrast, one official at another university stated that the university relies on the lead researcher to alert the compliance office of any changes to the research team or research objectives, which may then require a license before continuing research. This official suggested that the lead researchers are better positioned than the export control officer to identify changes to the research that might necessitate obtaining an export license.

Tracking and Safeguarding Export-Controlled Items Seven of the nine universities we visited used a variety of mechanisms to track and safeguard export-controlled items, including manual locks, electronic access systems, and other physical security systems, as well as separate computer networks to protect data subject to export control regulations. Under this category, we assessed universities’ activities in the following three areas:

Tracks export-controlled items used at the university. Officials at seven of the nine universities we visited said they had developed mechanisms to track any export-controlled items being used or developed by the university. These mechanisms range from maintaining paper files to using electronic systems to track such information. For example, some of the universities maintain physical copies of documents they use to identify and track export-controlled items on campus. Other universities have developed electronic databases to track this information. One university maintains all records related to research projects in one electronic system, including technology control plans. Electronic databases and systems allow the export control officer to quickly identify the on-campus location of export-controlled items and who is working with these items.

Safeguards export-controlled items. Eight of the nine universities we visited employ various security mechanisms to protect export- controlled items, including physical and information technology security mechanisms. For example, officials at seven of the nine universities we visited said their university protects export-controlled items by limiting access to spaces where these items are housed with locks or access cards, depending on the space. Three of these universities also require researchers to store export-controlled items in a locked box or storage space, in a locked room, when it is not in use. Some universities also use signs to indicate which spaces are restricted; however, officials at one university said that they do not use signage to indicate restricted spaces because it would draw more attention to the space. Some university officials also described information technology security mechanisms in place to protect data that may be subject to export control regulations. For example, officials at two universities noted the use of isolated or separate networks for researchers working with such data to limit access to this data.

Uses technology control plans to document and safeguard export-controlled items. Officials at all nine of the universities we visited stated that researchers used export-controlled items on campus, and officials at eight of these universities said that their universities had developed and implemented technology control plans to safeguard such items. According to Commerce’s export compliance guidelines, organizations that possess or work with export-controlled items and either employ foreign persons or have frequent meetings with foreign persons should create a technology control plan. These plans should include a physical security plan, an information security plan, and training programs, among other components. According to the university officials we interviewed, the export control officer typically works with the lead researcher to develop the technology control plan. Six of the nine universities we visited require the lead researchers to sign the technology control plan to acknowledge that they understand their responsibilities for protecting the export- controlled items identified in the plan, and at least four of these universities require all the members of the research team to sign it as well. In addition, some of the universities we visited conduct annual audits of the technology control plans to ensure proper implementation. For example, an official at one of these universities explained that the university’s annual audit of the technology control plans verifies that security practices outlined in the plan are being followed by the research team and that only those researchers who signed the technology control plan have access to the export- controlled items. An official at another university said he reviews the human resources account information for projects involving export- controlled items annually to verify that only those individuals who have signed the technology control plan are working on those projects.

Under this category, we assessed universities’ activities in the following two areas:

Screens and monitors foreign visitors. All but one of the nine universities we visited screen and monitor foreign visitors to some extent. Specifically, four of these universities conduct restricted party screenings on all foreign visitors prior to their visit to verify that potential visitors are not on any U.S. government list of restricted or proscribed parties. The other four universities conduct restricted party screenings on some foreign visitors. Three of these four universities said that they do not have a formal process for reviewing foreign visitors and that the effort to invite and review visitors is decentralized. Some of the universities we visited also described how they monitor foreign visitors on campus. For example, officials at two universities said that the foreign visitors’ sponsor is responsible for monitoring their access. The export control officer at a third university told us that he briefs foreign persons visiting restricted spaces on the rules of their visit, including restrictions on camera usage.

Screens foreign parties associated with research projects. All nine of the universities we visited use restricted party screening software, which searches several lists that U.S. agencies continually update to screen for restricted or denied parties. Universities and other exporters may be prohibited or restricted from doing business with any individuals or entities identified on one of these lists. Eight of the nine universities we visited screen all foreign individuals and entities associated with a research project using such software. Entities associated with a research project may include foreign researchers on the research team, foreign sponsors, or foreign collaborators, among others. Officials at the ninth university stated that they conduct ad hoc screening for research collaborations with foreign entities. Additionally, one of the universities has compiled a list of all the foreign entities the university works with and conducts weekly restricted party screenings of the foreign entities on this list. Although we focused our assessment on universities’ export compliance policies and practices in place to limit unauthorized deemed exports to foreign persons, officials at some of the universities we visited discussed their efforts to conduct restricted party screenings for other process areas, such as shipping, procurement, and gifts. We found that individuals or offices responsible for these processes at some universities manually screened entities. In one case, this was because the other offices did not have access to the restricted party screening software that the export control officer used.

Element 4— Recordkeeping

For this element, we assessed the extent to which the university had developed processes for maintaining relevant export control-related records. See figure 9 for the results of our assessment.

University Policies and Practices Related to Element 4—Recordkeeping

All nine of the universities we visited have developed policies and practices that fully align with this element concerning recordkeeping. Below, we provide additional detail on universities’ recordkeeping activities.

At least five of the nine universities we visited maintain their export compliance-related records in an electronic database or other electronic system. For example, one university’s system tracks each research project from start to finish and enables officials to search for all export control-flagged research proposals and awards, technology control plans, and other documents. One of the officials also told us that the system will alert the export control officer to any technology control plans with an upcoming expiration date. Officials at another university explained that their system also enables them to track all the approved technology control plans to quickly identify who is working under a technology control plan on campus at any point in time.

Five of the nine universities we visited have written export compliance program manuals, and all of those universities’ manuals include information concerning recordkeeping requirements. For example, four of the five manuals specifically note that export control-related files must be maintained for at least 5 years, and four identify the types of records that need to be maintained, including export reviews, contracts, licenses, technology control plans, and shipping documents, among others.

Element 5—Training

For this element, we assessed universities’ activities within two sub- elements: whether the university (1) provided export control-related training to all employees involved in exports and (2) required any individuals to complete mandatory export control-related training. See figure 10 for the results of our assessment.

University Policies and Practices Related to Element 5—Training

Seven of the nine universities we visited have developed policies and practices that fully align with this element concerning training, while the other two have not. Below, we provide additional detail on universities’ activities within the following two sub-elements:

Provides export control-related training to all employees involved in exports. Seven of the nine universities we visited stated that they provide export control-related trainings to researchers and other officials involved in the implementation of export control regulations. The export control-related training available to various university officials at the universities we visited varies depending on officials’ level of interaction with export controls. For example, at least five of the universities’ export control officers we interviewed provide export control-related training tailored to the needs of staff whom the university relies on to identify requests for export-controlled items or research involving export-controlled items, including the procurement office and the Office of Grants and Contracts. One export control officer stated that he provides annual training to officials in the Office of Grants and Contracts and provides biannual training to officials in the procurement office. He noted that he spends the most time training officials responsible for reviewing grants and contracts because they are the “gate keepers” for all research proposals and research funding coming into the university. The two universities that do not provide export control-related training to all employees involved in exports do make some export control-related information available. An official from one of the universities said that the university provides access to online export control-related trainings developed by a for- profit entity. The export control officer at the other university said that although the university does not conduct formal training, he conducts frequent outreach and provides materials to increase university officials’ awareness of export control regulations.

Conducts mandatory training for researchers conducting research involving export-controlled items. Seven of the nine universities we visited require researchers conducting research involving export-controlled items to complete training with the export control officer prior to beginning their project. Furthermore, researchers at four of these universities are required to complete additional periodic training to refresh their understanding of their compliance roles and responsibilities every 1 to 3 years. Most of the universities that conduct required export control training have varying systems in place to document attendance. For example, three of the nine universities we visited require attendees to sign a form certifying that they have completed the technology control plan training and understand their responsibilities.

Element 6—Internal Audits

For this element, we assessed the extent to which the university conducted periodic audits of its export control compliance program to assess its effectiveness and integrity. See figure 11 for the results of our assessment.

University Policies and Practices Related to Element 6—Internal Audits

Eight of the nine universities we visited have developed policies and practices that fully or partially align with this element concerning internal audits, while one of the universities’ policies and practices did not align with this element. Below, we provide additional detail on universities’ efforts to conduct periodic audits of their export control compliance programs to assess their effectiveness and integrity.

Eight of the nine universities we visited conduct some type of internal audit to assess the export compliance program’s effectiveness. For example, five export control officers at these universities review all technology control plans annually. One official said her office conducts these annual reviews to ensure that researchers are properly implementing the technology control plans and to determine if the plans need to be updated to address any changes to the export control regulations.

In addition, seven of the nine universities we visited have an internal audit group, and four of these audit groups had conducted an audit of the export compliance program within recent years. One university official explained that the audit group’s periodic review of the export compliance program once found that the project management system did not provide enough transparency, and on the basis of this finding, the export control officer was able to petition the university for additional funding to further improve the system in place to track all research projects. According to an official at another university, a quality assurance official at his university audits a sample of research awards each month. Every few months, this official identifies a mistake, such as a failure to screen a foreign party against the lists of restricted parties. When a mistake is identified, the export control officer then screens the foreign party and counsels the person who missed this step. These audits provide universities with an opportunity to identify any potential gaps and continually improve their programs.

Element 7—Reporting and Addressing Violations

For this element, we assessed the extent to which the university had developed clear procedures outlining the actions employees should take in the event that potential noncompliance is identified. See figure 12 for the results of our assessment.

University Policies and Practices Related to Element 7—Reporting and Addressing Violations

All nine of the universities we visited have developed policies and practices that fully align with this element concerning the reporting of violations. For example, officials at seven universities told us that they have a compliance hotline that people can use to report suspected violations. Two of these seven universities described additional actions they have taken to further educate their university community about the need to report potential export control violations by adding such information to flyers for the university compliance hotline and advertising this information online. Officials at three of the universities also discussed escalation procedures they have in place to investigate a potential export control violation. For example, one export control officer explained that he is responsible for investigating and reporting any violations. If he needs to initiate an investigation, he will select a team of university officials to enquire about the violation and determine whether a violation has occurred. Following the investigation, the Vice President for Research is responsible for determining whether the university needs to self-disclose a violation to the relevant federal regulatory agency.

Five of the nine universities we visited had written export compliance program manuals, and all of those universities’ manuals included information concerning export control violations. For example, some of the manuals include a discussion about the legal and criminal penalties associated with export control violations and emphasize the importance of reporting any potential violations. In addition, two of the universities’ manuals describe the need to develop corrective action plans to prevent recurrence of any violations arising from systemic institutional practices or procedures.

Three of the nine universities we visited had voluntarily disclosed export control violations. For example, one university disclosed information regarding a foreign person’s unauthorized access to ITAR-controlled technology because the lead researcher on the project and the procurement office did not know the technology was controlled. According to the export control officer at this university, her office is working with the procurement office to ensure that the future procurement of controlled technologies is flagged for review by the export control officer prior to ordering. This updated procedure will enable the export control officer to work with the lead researcher to develop a technology control plan if the university agrees to support the procurement of such a technology.

Element 8—Export Compliance Manual

For this element, we assessed the extent to which each university documented export control compliance processes, roles and responsibilities, and other relevant information in a manual to help the university implement its compliance program. See figure 13 for the results of our assessment.

University Policies and Practices Related to Element 8—Export Compliance Manual

Five of the nine universities we visited have developed export compliance manuals, consistent with this element, while the other four have not. These manuals describe the export control-related roles and responsibilities of various offices and officials on campus, including the export control officer and university researchers, among others. In general, the manuals also describe a number of export control compliance procedures, including the initial review of research proposals, development of technology control plans for research involving export- controlled items, training requirements, and processes for investigating potential violations, among others. Four of the five universities developed manuals in 2015 or earlier, and one university developed a manual in 2018. Three of the universities that published manuals in or before 2015 have updated their manuals at least once, but one of these universities has not updated its manual since 2013.

Appendix IV: Analysis of Export Compliance- Related Information on U.S. Universities’ Websites

We reviewed the public websites of a statistically generalizable sample of 100 U.S. universities expending more than $15 million for research and development annually, on average, to determine the extent to which universities publicly share export control-related information with their campus community. Using research expenditure data collected by the National Science Foundation for 2013 through 2017, we identified 292 public and private U.S. universities that expended more than $15 million on research and development, on average, over a 5-year period. We selected a stratified, random sample of 100 universities from this list to provide representation from a diverse set of universities in our sample. Next, we created a top and bottom stratum based on total research and development expenditures. The top stratum included universities with expenditures above $250 million (85 universities) and the bottom stratum included universities with expenditures between $15 million and $250 million (207 universities). The sample included 55 universities from the bottom stratum and 45 from the top stratum. Of the 55 universities from the bottom stratum, 30 are public and 25 are private. Of the 45 universities from the top stratum, 25 are public and 20 are private.

We assessed the information on the selected universities’ websites against six of the eight elements of an effective export compliance program: 1. Management commitment and organizational structure 2. Export authorization and tracking export-controlled items 5. Reporting and addressing violations 6. Export compliance manual We did not review information related to risk assessments or internal audits on the selected universities’ websites because we did not expect universities to publicly publish this type of information.

Management Commitment and Organizational Structure

Of the 100 universities in our sample, 77 maintained a dedicated web page for export control-related information, and 79 provided contact information for the person or office responsible for complying with export control regulations on their website. However, only about half of the universities’ websites identified an export control officer or similar official, and only 24 included a public statement from university management supporting the export compliance programs. See table 8 for additional results from our website analysis.

Management commitment and organizational structure Entities should have public management support for their compliance program, sufficient resources to conduct compliance activities, and a clear organizational structure identifying individuals responsible for compliance. related information?

Export Control Officer or similar title identified?

Export control roles and responsibilities of researchers described?

Export Authorization and Tracking Export-Controlled Items

Export authorization and tracking export- controlled items Entities should develop processes to (1) ensure the organization makes correct export decisions, including identifying when U.S. government authorization is required prior to exporting; (2) track and protect any export- controlled items being used or developed by the organization; and (3) screen all parties associated with an export transaction against the U.S. proscribed/restricted parties lists prior to exporting.

A majority of the 100 universities’ websites included information about relevant export regulations and a definition of exports, and almost half provided additional resources or tools for researchers to better understand how or whether their research involves items subject to export control regulations; however, a limited number provided information about practices the university may employ to protect export-controlled items. For example, 74 of the 100 universities published information about the International Traffic in Arms Regulations (ITAR) and the Export Administration Regulations (EAR) on their websites. About half of the universities also maintained a frequently asked questions section concerning export control regulations and about half provided tools such as decision tree matrices to help researchers determine whether an export may require a license. However, less than a third of the universities’ websites included any information about technology control plans or guidance regarding foreign visitors, which are practices that universities may undertake to protect export-controlled items used in university research or other academic activities. For example, only 27 of the 100 universities’ websites contained explanations of when a technology control plan would be necessary. See table 9 for additional results from our website analysis.

Recordkeeping

Twenty of the 100 universities’ websites provided information regarding export compliance recordkeeping requirements. See table 10 for these results.

Training

About half of the universities’ websites provided information about export control trainings available online, developed by the university, associations, or for-profit organizations, among others. However, only 21 of the 100 universities’ websites provided information about how to request university-provided, in-person training regarding export compliance. See table 11 for additional results from our website analysis.

Reporting and Addressing Violations

Only about a quarter of the universities’ websites provided guidance about when to report potential violations, but about half of the universities’ websites provided information about the potential administrative or criminal penalties associated with export control violations. See table 12 for additional results from our website analysis.

Reporting and addressing violations Entities should develop clear procedures outlining the actions employees should take in the event that potential noncompliance is identified. Entities should also develop processes for identifying and addressing the root cause of any noncompliant activity.

Guidance on when to report a potential export control violation?

Export Compliance Manual

Less than half of the universities in our sample published an export compliance manual on their website. See table 13 for these results.

Appendix V: Comments from the Department of State

Appendix VI: Comments from the Department of Defense

Appendix VII: GAO Contact and Staff Acknowledgments

GAO Contact Staff Acknowledgments

Kimberly Gianopoulos, (202) 512-8612 or gianopoulosk@gao.gov.

In addition to the contact named above, Juan Gobel (Assistant Director), Drew Lindsey (Assistant Director), Amanda Bartine (Analyst-in-Charge), Taylor Bright, Debbie Chung, Neil Doherty, Tina Huang, Kathryn Long, Sulayman Njie, and Jina Yu made key contributions to this report. Ashley Alley and Justin Fisher provided technical assistance.