Export Controls: Agencies Should Assess Vulnerabilities and Improve Guidance for Protecting Export-Controlled Information at Companies
Released: 2006-12-05T00:00:00

Letter

Background

Under the U.S. export control system, agencies expect companies to be responsible for determining if the items or information they intend to export are controlled by the government’s export control regulations and for implementing procedures to safeguard their protection and transfer. The corresponding regulations are designed to keep specific military and dual-use items and technologies from being diverted to improper end users. These export control regulations, initially established more than 30- years ago, aim to balance national security, foreign policy, and economic interests. In today’s global economy, U.S. companies’ exchanges of technology and information occur with ease and include the transfer of export-controlled technologies to foreign nationals through routine business practices such as transmission of a data file via an e-mail sent from a laptop computer, cell phone, or a personal digital assistant, using company electronic networks to make intra-company transfers of information to overseas subsidiaries or affiliates, visual inspection of U.S. equipment and facilities during company site e-commerce transactions—sales of software over the Internet to oral exchanges of information when working side-by-side with U.S. citizens.

See figure 1 for an illustration of various types of exchanges of export- controlled information in relation to the export of goods.

While an export often involves the actual shipment of goods or technology out of the U.S., under Commerce’s and State’s export control regulations, transfers of U.S. export-controlled information to foreign nationals within the U.S. are also considered to be an export to the home country of the foreign national and thus may require an export license. For export control purposes, the term “foreign national” includes any person who is not a U.S. citizen or lawful permanent resident.

The U.S. government’s controls on the export of defense-related items are primarily divided between the departments of Commerce and State, with the assistance of the Department of Defense (DOD).

Department of Commerce: Commerce, through its Bureau of Industry and Security (BIS), controls the export of dual-use items and information primarily through implementation of the Export Administration Act. Commerce’s Export Administration Regulations (EAR) establish the Commerce Control List, which generally contains detailed controls for dual-use items. BIS has two branches: Export Administration and Export Enforcement. Export Administration is responsible for processing export license applications, outreach, and counseling efforts to help ensure exporters’ compliance with the EAR as well as monitoring certain license conditions to determine exporters’ compliance with their conditions. Export Enforcement investigates alleged dual-use export control violations and coordinates its enforcement activities with other federal agencies, such as the Department of Justice’s Federal Bureau of Investigations (FBI) and the Department of Homeland Security’s Customs and Border Protection (CBP).

Department of State: State, through its Directorate of Defense Trade Controls (DDTC), regulates exports of defense items and information under the authority of the Arms Export Control Act. State’s International Traffic in Arms Regulations (ITAR) provides controls over defense articles and services, which are identified in broad categories on the U.S. Munitions List (USML). DDTC works to implement and enforce these laws and regulations using three key offices: Licensing, Compliance, and Policy. The Office of Licensing is responsible for reviewing license applications and addressing correspondence from exporters, such as providing advice on questions to businesses, known as advisory opinions. The Office of Compliance checks for company violations of the export regulations and conducts end-use checks on exports and company visits to achieve this goal. The Policy Office provides training through a third party organization, and outreach to companies on the export regulations.

DOD: The Defense Technology Security Administration (DTSA) represents DOD on export control issues and administers development and implementation of technology security policies for the international transfers of defense-related goods, services and technologies, which DOD oversees. DTSA serves an advisory role in State’s and Commerce’s export license review processes and offers technical reviews on licenses for national security concerns. DTSA may also provide guidance regarding commodity jurisdiction requests from State, and DTSA often issues advice regarding advisory opinions submitted to both State and Commerce. The agency is responsible for maintaining contact with industry regarding changes in technologies and licensing initiatives. DTSA plays a significant role in coordinating any proposed changes to the ITAR or EAR, with DTSA’s opinion serving as the final DOD position regarding such matters.

Recent congressional hearings and intelligence reports have highlighted threats to U.S. companies’ sensitive information—such as intellectual property, trade secrets, and financial data—from foreign economic and military surveillance and the associated challenges of balancing U.S. security and economic interests. These threats may weaken U.S. military capability and hinder U.S. industry’s competitive position in the world marketplace. According to a recent counterintelligence estimate, factors that have contributed to U.S. economic and technological success have also facilitated foreign entities’ technology acquisition efforts. For example, the openness of the United States has provided foreign entities easy access to sophisticated technologies; new electronic devices have vastly simplified the potential for illegal retrieval, storage, and transportation of massive amounts of information, including trade secrets and proprietary data; and information systems that create, store, process, and transmit sensitive information have become increasingly vulnerable to hacking attempts.

The challenges to the government in protecting export-controlled information at companies are interrelated to the challenges we previously reported facing the departments of Commerce, State, and Defense in overseeing the export of controlled technologies in today’s rapidly evolving international security and business environments. For example, in June 2006, we reported Commerce has not systematically evaluated the overall effectiveness and efficiency of its dual-use export control processes to determine whether it is meeting its goal of protecting U.S. national security and economic interests in the wake of the September 2001 terror attacks. In 2005, we reported that State has not made significant changes to its arms export control regulations in response to the terror attacks.

Agency Processes Provide Limited Oversight of Export- Controlled Information and Rely on Companies for Its Protection

U.S. government export control agencies have less oversight on exports of controlled information than they do on exports of controlled goods. Commerce’s and State’s export control requirements and processes—such as export documentation, reporting requirements, and monitoring— provide physical checkpoints on the means and methods companies use to export controlled goods to help them ensure such exports are made under their license terms, but the agencies cannot easily apply these same requirements and processes to exports of controlled information. Consequently, U.S. export control agencies rely on individual companies to develop practices for the protection of export-controlled information. Officials from one third of the companies we interviewed told us they do not have internal control plans to protect their export-controlled information.

Some Current Export Control Processes and Requirements Are Not Easily Applied to Export- Controlled Information

Government export control processes provide physical checkpoints for the export of goods, but the same checkpoints are not easily applied to electronic and other intangible transfers of export-controlled information. Both Commerce and State oversee exports of goods and information— regardless of their form or method of transfer—through their licensing and compliance programs. Both agencies’ programs require companies to apply for export licenses under their respective regulations and to keep records on such exports for possible agency monitoring and inspection. However, certain export documentation, agency reporting requirements, and agency monitoring processes for exports of controlled goods are not easy or practical to apply to the oversight of exports of information, which limits the agencies’ ability to monitor exports of licensed controlled information.

Means of Transportation or Transfer Reported on Export Documentation: When shipping a controlled good overseas, a company is generally required to file a Census Bureau Shippers’ Export Declaration (SED) form with CBP, within the Department of Homeland Security.Companies generally are required to file the SED form for every export made under a specific license, which requires companies to specify the method of transportation for the exported goods, such as vessel or air. However, exports of controlled information transmitted electronically or in an otherwise intangible form are specifically exempted from SED filing. Commerce and State export license applications require exporting companies to report the name of the freight forwarder or other agents to be used for the shipment of goods, which provides the agencies with some oversight on how companies intend to conduct such exports. However, agency export license applications do not require companies to report information on the means of transmission they intend to use to transfer export-controlled information. In the absence of information on the means of transmission used to export-controlled information, Commerce and State lack information that could help provide some level of oversight as they do for physical shipment of goods.

Agency Reporting Requirements: Certain agency reporting requirements for goods do not apply to export-controlled information. Companies are generally required to present the SED form before any export. As previously described, the SED Form is not required for electronically transmitted export-controlled information. Further, companies are not otherwise required to notify Commerce when exports of licensed controlled information take place. While in certain circumstances State requires companies to notify it when they transmit licensed export-controlled information, this requirement only applies to the first instance of transfer. Beyond these notifications, Commerce and State cannot be sure that all exports of controlled information under the license are made to the designated end-user and are within the terms of the license approval.

Agency Monitoring: Commerce and State monitor exports to help ensure company compliance with license requirements and to assess industry areas where export licenses may be required. However, the two agencies’ efforts focus on export-controlled goods, and not information, due in part to the nature of transfers of export-controlled information, which makes elements of agency monitoring processes inapplicable. For goods, the SED can be used to aid the government in tracking exported goods and determining whether or not they reach the specified end-user. The SED also provides a feedback mechanism, which the lead export-control agencies may use to measure the effectiveness of their activities and processes. A similar feedback mechanism does not exist for export-controlled information transmitted electronically and by other intangible methods. Since the agencies cannot completely monitor these exports, their reliance on companies to implement control mechanisms becomes increasingly important for protecting export-controlled information.

For example, Commerce and State do not systematically monitor whether companies abide by the conditions of their “deemed” export licenses, which permit the transfer of export-controlled information to specific foreign nationals. Consequently, agencies have no way of knowing if all licensed export-controlled information was exported according to the terms of the license—for example, if it was sent within the permitted time period, if the information exported was appropriate, and if the export reached its intended end-user. In 2002, we recommended that Commerce—in consultation with the Secretaries of Defense, State, and Energy—establish a risk-based program to monitor compliance with deemed export license conditions. Commerce officials told us they recently completed a limited pilot program to monitor company compliance with deemed exports and did not find any compliance issues in the sample of deemed export licenses they reviewed. However, Commerce officials told us that this pilot did not address the issue of export-controlled information transferred by electronic means, such as e-mail, and that they have not decided whether they will perform similar monitoring efforts on an annual basis.

Table 1 provides an overview of the key agency checkpoints generally related to export-controlled goods and information.

Companies Use a Variety of Practices to Protect Export-Controlled Information

Under the U.S. export control system, companies are responsible for implementing procedures to protect export-controlled information regardless of how it is exported. We found a range of company practices for protecting export-controlled information from our discussions with officials from 46 companies, including the use of internal control plans, limiting employee access, and computer security technologies. Almost two thirds of the company officials we interviewed told us their companies use internal control plans, which establish procedures to protect proprietary and export-controlled information and also set requirements for access to such material by foreign employees and visitors. However, other companies we interviewed exported controlled information or employed foreign nationals, but had not yet developed internal control plans for such transactions. While Commerce and State generally do not require companies that export controlled information to use such plans, an industry report on export control best practices includes internal control plans as a best practice to safeguard export-controlled products and technologies against improper access by foreign nationals—employees, customers, and visitors. For example, companies can use such internal control plans to provide specific procedures and processes addressing physical and computer access to export-controlled information; such as employee badging, record-keeping procedures for all relevant export- related documents; the use of internal audits on export transactions; and the use of electronic surveillance, such as hidden cameras, where appropriate, for physical security. Almost half of the company officials we interviewed told us they encounter uncertainties when determining what measures should be included within their internal control plans to help ensure the proper protection of export-controlled information. Officials from larger companies who expressed such concerns added that these uncertainties may be magnified in smaller companies due to their inexperience with export regulations, a point confirmed by officials from five small companies we interviewed.

In addition to the companies’ stated use of internal control plans, we found companies also had practices related to employee access and foreign national access to export-controlled information. Examples include the following: Two thirds of the companies indicated that all employees—including foreign nationals—wear identification badges that contain information such as a picture, a color-code indicating the employee’s security clearance, and encoded data that allows access to only those areas authorized for the employee.

About three fifths of the companies we interviewed indicated that they protect export-controlled information by storing it within restricted components of the company’s computer server, and requiring employees to gain permission through a network administrator before obtaining access to such information.

Some companies also use information security protections for their electronic transfers of export-controlled information. More than two fifths of the companies we interviewed use encryption; an information technology process used to obscure data files, making them inaccessible without the appropriate code to decipher the meaning. Neither Commerce’s nor State’s regulations require companies to use encryption when transferring export-controlled information. According to the International Standards Organization, a nongovernmental organization that provides technical standards to the public and private sectors, organizations should consider using some form of encryption when transferring sensitive information. Commerce and State export control officials told us they do not specifically recommend that companies use encryption for various reasons, such as agencies’ inability to keep current on rapid developments in this field and possible liability issues surrounding their recommendation of a particular encryption product for e-mail security.

Our review of selected companies’ export control internal control practices highlights how uneven company practices can contribute to vulnerabilities associated with the protection of export-controlled information. For example, officials from three of the companies we interviewed told us that they exported controlled information—through electronic transmissions or interpersonal interactions with foreign nationals—but that they did not have technology control plans that provided company-wide policies and procedures to limit their foreign national employees’ access to export-controlled information. However, in situations when companies manufacture or research sensitive technologies that are export-controlled, they are required to register with the government, even if they are not planning to export. In situations including these, the extent of company internal control practices could affect its vulnerability. For example, a nanotechnology company official intending to export technology in the immediate future told us a former Chinese foreign national employee had full electronic access to the same sensitive company information as its U.S. employees. The official also told us this foreign employee was not physically segregated from any portions of the company facilities or lab where more sensitive technology functions were performed. Under these circumstances, we believe that the company official could not have determined whether the employee improperly accessed company information that potentially could be export-controlled.

Government Lacks Sufficient Knowledge of the Risks Associated with the Protection of Export- Controlled Information to Identify the Minimal Safeguards

The lead government agencies have not fully assessed the risks of protecting export-controlled information to help identify the minimal level of protection for such exports. Commerce and State do not strategically use existing resources, such as export license data, to identify potential risks when such information is exported and are not fully aware of the consequences of companies using a variety of measures for protecting export-controlled information. Such analysis is critical because government export-control processes provide less oversight for export- controlled information than exports of goods. Improved knowledge of the risks associated with such exports could improve agency outreach and training efforts, which now offer limited assistance to companies to mitigate risks when protecting such information.

Agencies Have Not Systematically Assessed the Risks with Company Protection of Export- Controlled Information

Commerce and State have not strategically used existing information resources, such as export license data, to identify possible vulnerabilities and risks related to company protection of export-controlled information for use in oversight of such exports. GAO has identified managing risk both as an emerging area of high risk for the government and a part of governance challenges for the 21st century.

Commerce and State do collect a range of basic information on company exports, some of which could prove valuable in understanding export- controlled information, such as technologies exported and their end-users. However, neither Commerce nor State has implemented systematic risk- assessment practices for its oversight of export-controlled information. Applying systematic risk-based strategies to export-controlled information could enable Commerce and State officials to focus their resources on information exports that may pose a higher risk to national security. As shown in figure 2, risk management aims to integrate systematic concern for risk into the usual cycle of agency decision-making and implementation.

Threat, vulnerability, and criticality are frequently used aspects of risk assessment. Our internal control standards state that once risks have been identified, they should be analyzed for their possible effects. Our standards also state that because economic and industry conditions continually change, entities should provide mechanisms to identify and deal with any special risks prompted by such changes. Risk analysis generally includes estimating the risk’s significance, assessing the likelihood of its occurrence, and deciding how to manage the risk and what actions should be taken. The threats to the protection and transfer of export-controlled information include the inadvertent exposure of such information to unauthorized foreign parties as well as foreign economic espionage. For example, several of the larger defense and commercial companies we interviewed told us their computer networks are routinely subject to hacking attempts by individuals attempting to steal or corrupt information, which officials said can number in the hundreds daily. Currently, Commerce and State rely on companies to identify and protect export-controlled information whether it is transferred orally, electronically, or visually—or through traditional physical shipment methods used for goods, such as a courier transporting a compact disk containing export-controlled information to a customer. The vulnerability of export-controlled information may be increased by companies not using computer or physical security mechanisms that help protect against physical and electronic diversions during its transmission. The consequences of such risks to export-controlled information may include the loss of sensitive information to foreign entities with interests contrary to our own as well as significant and costly civil and criminal penalties for violations of the export control regulations.

At present, both agencies’ approaches to conducting company compliance visits generally target specific industries and industry practices, but are not based on thorough knowledge of possible weaknesses and vulnerabilities in company protection of export-controlled information. Commerce officials told us the agency primarily conducts company visits based on company size and technology produced. Commerce officials also told us they also target companies and industry associations based on a variety of other factors, including their analysis of license data and publicized company export control developments, such as announcements in local business newsletters reviewed by Commerce export officials. Through its company visit plan, State performs its company compliance visits based on general knowledge of topic areas its staff believe may be vulnerable to compliance problems and discrete compliance issues, such as companies that employ foreign nationals. However, Commerce and State do not use available licensing data to strategically target both established and emerging business sectors to aid in their monitoring and oversight of exports of controlled information. For example, agency license databases and company records provide a pool of information, which Commerce and State could analyze to help them discern trends in export-controlled information, such as identifying which companies are involved in cutting-edge commercial and military technology developments. Increased agency knowledge in these technology fields that transmit export-controlled information and are known to be subject to foreign espionage would help increase agency oversight and may reduce such vulnerabilities.

State and Commerce told us they perform company outreach and training visits as part of their oversight of company export control activities, but neither agency considers export-controlled information in determining which companies they should visit. For example, State officials told us they conduct these visits when requested by companies. Consequently, companies without knowledge of the export regulations would not know to request this additional assistance. Commerce officials told us the agency conducts over 100 company training seminars nationwide annually on topics ranging from an exporting primer, product classifications, and deemed exports for both novice and experienced exporters. These seminars are held in conjunction with local business cosponsors, and Commerce develops specific training topics to reflect the interests of local industry. Commerce officials told us they conduct a limited number of visits to specific companies as part of their company outreach, which are usually prompted by information and intelligence obtained through their compliance efforts. Such training and outreach is particularly important because we found during our company interviews that newly-formed smaller businesses working in advanced technology areas were not as aware of the extent of their responsibilities to protect export-controlled information, and their company officials suggested that their protection measures did not follow best practices to safeguard such information as used by experienced exporters. Furthermore, in our prior work we recommended that Commerce and State should better coordinate their efforts on analysis and export oversight.

Improved Knowledge of the Risks Associated with the Protection of Export- Controlled Information Could Improve Agency Outreach and Training

Government export control agencies use a variety of means—including Internet Web sites, advisory opinions, and company training to communicate information on export controls to industry. However, we found that because these agency outreach and training efforts are not developed based on a thorough knowledge of the risks associated with such exports, they do not specifically address the protection of export- controlled information.

Agency Internet Web sites: Commerce and State have Internet Web sites that provide the public information about the agencies’ export control roles and responsibilities. However, these Web sites do not communicate information such as industry best practices or identify specific protection measures for companies to use to securely transfer export-controlled information electronically. For example, we found while Commerce’s Web site provides information to businesses on the Export Administration Regulations, such as frequently asked questions and guidance for deemed exports, it does not provide information on measures companies could use to protect the transmission of export- controlled information, such as encrypting e-mails used to transmit export-controlled information to a company’s foreign subsidiary. State’s Web site does not provide information or guidance to exporters on accepted practices for protecting export-controlled information and managing deemed exports, such as suggested security measures to implement when foreign employees work in close proximity to export- controlled information. Almost one fourth of the company officials we interviewed told us they would like additional guidance on export- controlled information posted on Commerce’s and State’s Web sites, such as agency-accepted employee training on export-controlled information. Commerce and State export control officials told us they have not provided such guidance on their Internet Web sites for reasons such as their inability to keep current on developments in these areas, such as recommended particular encryption standards, and possible liability issues related to recommending a particular protection measure.

In 2004, the Office of Management and Budget (OMB) endorsed recommendations from the Interagency Committee on Government Information on guidelines to help make federal agency Web sites more user-friendly and to better enable companies to understand agencies’ regulatory requirements. These standards for agency Web sites include providing a list of frequently asked questions to users and Web links to other federal agencies that can provide additional information on a particular issue. State’s Web site does not provide users with answers to frequently asked questions, such as common questions companies have on the export process. The State Web site also does not link to the Commerce Web site or provide information on best practices companies use to comply with the regulations. By providing this type of information on its Web site, State could help enhance its communication to companies and alleviate company confusion surrounding the protection of export-controlled information.

Advisory Opinions: As part of their export control activities, Commerce and State provide nonbinding advice to companies, called advisory opinions, on specific questions they submit to the agencies regarding the export regulations. Officials from about two fifths of the companies we interviewed told us they submitted questions to the agencies regarding export-controlled information. However, under the Commerce and State advisory opinion programs, the agencies do not publicly share all agency responses to these requests for guidance and information due to concerns about inadvertently releasing a company’s proprietary information to the public as well as agency officials’ judgment that such opinions do not have broad utility to the export community. From our review of Commerce’s and State’s export control activities, we found while Commerce provides a few public examples of advisory opinions on its Web site that address deemed exports and the employment of foreign nationals, none specifically address the electronic transfer of export-controlled information. State officials told us State does not provide any advisory opinions to the public. By publicizing their advisory opinions, Commerce and State could possibly leverage their limited outreach resources and help a greater number of companies attain clarifying information on agency policies on export- controlled information.

Other federal agencies, such as the Department of Labor (DOL), share advisory opinions with the public on their Web sites but redact company proprietary information to protect identifying information. This allows other companies with similar questions to benefit from the additional agency guidance. One company export control official we interviewed suggested companies could submit two letters simultaneously to either Commerce or State to request advisory opinions on export control issues. In the first letter the company would include all necessary information to distinguish the export, so the agency could make an appropriate decision on the specific export control matter. In the second letter the company would redact all proprietary and company identifying information, which the agency would be allowed to publicize to other companies. DOL uses this approach to alleviate itself of the burden from identifying and redacting proprietary information from advisory opinions it shares publicly.

Agency Training on Export-Controlled Information: While Commerce and State provide export-control training to companies, we found the agencies do not strategically target companies and industry sectors where the greatest risk of violations of the export regulations on export-controlled information may exist. While Commerce and State have significantly different approaches towards company training, neither offers specific training opportunities focusing exclusively on export-controlled information. Furthermore, officials from approximately 20 percent of the companies we interviewed told us agency training on export controls does not provide specific guidance to companies on the adequate protection of export-controlled information. For example, these officials said agency training does not provide information protection options to companies, such as using dedicated communication lines for e-mail transmissions or limiting employee access to servers that contain export-controlled information. Company officials told us government-sponsored training does not target smaller companies new to the exporting process, which may not be familiar with necessary measures to securely transfer export- controlled information. Furthermore, we found agency training, in particular State’s training, is limited to specific geographic regions of the U.S., which company officials stated hinders smaller companies with limited budgets from attending. Although State and Commerce have separate export control jurisdictions, the 2004 Interagency Offices of Inspector General report stated that Commerce and State could improve their outreach by providing joint training that explains the differences between the two agencies’ licensing requirements and procedures—a recommendation that, according to the report, was shared by company officials.

Conclusion

The globalization of the U.S. economy and economic interdependence with the rest of the world has many dimensions. While the export of controlled information from U.S. companies to foreign business partners is a key component to maintaining a strong and developing economy, the improper export of such technology can be detrimental to U.S. security and economic interests. Developing effective oversight to help ensure the protection of export-controlled information poses a challenge to the federal agencies responsible for export control. These risks may increase as electronic communications and information-transfer capabilities used by companies that export-controlled information continue to grow. Moreover, the lack of coordination between Commerce and State on outreach, analysis, and oversight could hamper their ability to determine whether export-controlled information may be at risk when foreign nationals are in U.S. company settings. Without leveraging and properly utilizing available export license data, these agencies will not be able to fully understand and assess potential risks associated with the export of controlled information and develop the proper protections and outreach to help mitigate the risks associated with such information. Further, in the absence of guidance from the government, some U.S. companies may not fully understand these associated risks and the need for applying corresponding measures of protection.

Recommendations

To improve the Department of Commerce’s oversight of export-controlled information at companies, we recommend that the Secretary of Commerce direct the Administrator of the Bureau of Industry and Security to take the following actions: Strategically assess potential vulnerabilities in the protection of export- controlled information using available resources, such as licensing data, and evaluate company practices for protecting such information.

Based on such a strategic assessment, improve its interagency coordination with the Department of State in the following areas (1) provide specific guidance, outreach, and training on how to protect export-controlled information and (2) better target compliance activities on company protection of export-controlled information.

To improve the Department of State’s oversight of export-controlled information at companies, we recommend that the Secretary of State direct the Director of the Directorate of Defense Trade Controls to take the following actions: Strategically assess potential vulnerabilities in the protection of export- controlled information using available resources, such as licensing data, and evaluate company practices for protecting such information.

Based on such a strategic assessment, improve its interagency coordination with the Department of Commerce in the following areas (1) provide specific guidance, outreach, and training on how to protect export-controlled information and (2) better target compliance activities on company protection of export-controlled information.

Agency Comments and our Evaluation

We provided a draft of this report to the departments of Commerce, Defense, and State for their review and comment. Commerce and State provided written comments, which are reprinted in appendixes II and III, respectively. Defense did not have any comments on our draft report.

Commerce generally agreed with our recommendations to assess potential vulnerabilities related to export-controlled information and to conduct more targeted outreach and compliance activities. Commerce, in its response, described planned and recent activities related to its oversight and outreach efforts on deemed exports, such as the Deemed Export Advisory Committee and increased export outreach and compliance activities. While these activities address some unique cases where companies are required to have a Technology Control Plan (TCP) in place when employing foreign nationals, they do not fully address how to protect export-controlled information when transferred electronically and by other intangible means. As noted in our report, almost half of the company officials we interviewed told us they have difficulty determining the proper measures to protect export-controlled information. Commerce also cited a September 2006 American Society for Industrial Security trade association meeting where it addressed the protection of export- controlled information. Actions such as this, if conducted on a regular basis, could improve companies’ understanding of how to protect export- controlled information in today’s commonplace business transactions, such as e-mail, e-commerce exchanges, and intracompany transfers.

State agreed with our recommendation to improve guidance for exports of controlled information and disagreed with our report’s finding that it does not assess the potential vulnerabilities associated with export-controlled information. State responded that it recently tasked its Defense Trade Advisory Group to develop a best practice guide for industry on how to comply with the regulations. Such guidance, particularly if it addresses export-controlled information and is shared on State’s Web site, can help to improve companies’ understanding of accepted practices for protecting such information. Regarding its assessment of potential vulnerabilities associated with export-controlled information, State responded that its individual licensing and compliance activities strategically target its concerns related to exports of controlled technical data. State added that its assessments of the vulnerabilities and risks associated with export- controlled information form the basis for topics addressed at training events and industry conferences, as well as many regulatory changes. While State’s activities may help inform its individual licensing decisions and identification of specific companies for possible compliance visits, we found that State is not proactively using available information to strategically assess the vulnerabilities associated with the transfer of export-controlled information. For example, we found State does not use available data from its licensing activities to strategically target established and emerging business sectors to aid in its monitoring and oversight of exports of controlled information. These license data and company records provide a pool of information, which State could analyze to help discern trends in export-controlled information. Furthermore, State told us its outreach visits do not consider export-controlled information in determining companies to visit and we found that State’s training does not provide specific guidance on export-controlled information. Broader assessments of the risks and vulnerabilities associated with export-controlled information will help the department identify ways to improve its oversight of these exports and its guidance to companies.

We are sending copies of this report to appropriate congressional committees and to the Secretary of Commerce, the Secretary of Defense, the Secretary of State. Copies will be made available to others upon request. In addition, this report will be available at no charge on the GAO Web site at http://www.gao.gov.

If you or your staff have any questions about this report, please contact me at (202) 512-4841 or John Neumann, Assistant Director. Other major contributors to this report were Marie Ahearn, Patrick Baetjer, Jessica Berkholtz, Amanda Seese, Karen Sloan, Najeema Washington, and Anthony Wysocki.

Appendix I: Scope and Methodology

To assess how the government’s export control processes apply to the protection of export-controlled information by U.S. companies, we analyzed the export control regulations, policies, and compliance practices of the Department of State and the Department of Commerce. Our analyses of the regulations included the review, comparison, and contrast of the Department of State’s International Traffic in Arms Regulations (ITAR) and the Department of Commerce’s Export Administration Regulations (EAR), identifying information pertinent to the export of controlled information via electronic means and other intangible transfers, or through foreign national access. We also reviewed export- control policies and practices within the Department of Defense, including proposed changes to the Defense Federal Acquisition Regulation Supplement (DFARS) to identify requirements related to export controls and foreign national access to sensitive information. We interviewed officials from DTSA to gain more information regarding the agency’s activities as they relate to the export control practices and policies of Commerce and State. We interviewed agency officials from the Commerce Department’s Bureau of Industry and Security (BIS) who perform export control related functions, such as enforcement and administration. Within the State Department’s Directorate of Defense Trade Controls (DDTC), we interviewed officials from the areas of licensing, compliance, and policy to obtain information on agency efforts to protect export-controlled information. We also analyzed information on existing data the lead agencies have at their disposal regarding the export of controlled information.

To assess steps the government has taken to identify and mitigate risks in protecting export-controlled information, we analyzed Commerce’s and State’s use of existing resources, such as licensing data, to identify trends and vulnerable areas within company transfers of controlled information and assessed each agency’s export control training and outreach programs. We examined the extent to which agency resources are leveraged to mitigate risks associated with the export of controlled information by reviewing other government-accepted forms of risk assessment. We reviewed our prior work on risk assessment, which includes items such as the Federal Information Systems Controls Audit Manual and the Internal Control Management and Evaluation Tool.

To assess Commerce’s and State’s export control training and outreach programs, we reviewed each agency’s Web site and training materials issued by the agencies. We assessed training seminars sponsored by the Departments of State and Commerce. Specifically, we reviewed information and practices used at Society for International Affairs (SIA) conferences, which State sponsors, and BIS training seminars. We also reviewed the agencies’ methodologies for conducting company outreach visits. As part of our work, we attended several agency-sponsored export control training events aimed at increasing company knowledge of the export control regulations.

To further assess our objectives, we interviewed officials from 46 U.S. companies. We asked them how they protect export-controlled information through the use of internal controls. We reviewed, and in some instances obtained various company export control-related documents including, internal control plans, technology control plans, training manuals related to export controls, and policies regarding the transfer of electronic controlled information, including when accessed by foreign national employees. We also asked company officials to share their views and experiences regarding government training and outreach pertinent to the area of export-controlled information. Company officials responded to our targeted questions regarding export-controlled information, including views on the effectiveness of government training seminars, the extent of content provided on agency Web sites, and the quality of advice provided on agency customer service telephone lines.

We selected our sample of 46 companies from a universe of companies we developed to represent a wide variety of companies, industry types, and exporting experiences by analyzing the following sources and databases: Commerce Department’s Export Control Automated Support System (ECASS) export license database, looking specifically for companies that held licenses in the D (Software) and E (Technology) product groups, which are more prone to be export-controlled information, for fiscal years 2000-2004.

State Department’s Defense Trade Application (DETRA) licensing database, looking specifically for companies that held a permanent license for the export of technical data, which are more prone to be export-controlled information over fiscal years 2000-2004.

DOD’s Contracting Action Report database (DD 350), for Research Development Test and Evaluation (RDT&E) contracts with small businesses that are more prone to be export-controlled information, for fiscal years 2000-2004.

Commerce’s and State’s industry outreach, training, and advisory committee membership lists.

Industry-specific company directories and our work with agency and industry experts.

To select companies from the universe that represented a range of company experiences, we applied selection criteria, specifically; companies had to meet at least one of the following criteria: Held a Commerce Department ECASS export license in the D (Software) and E (Technology) product groups.

Held a State Department DETRA permanent license for technical data.

Held both Commerce and State export licenses. Specifically, the company held both the aforementioned Commerce Department ECASS export licenses as well as the State Department DETRA licenses.

Exporter frequency. We classified a company as a high, medium, or low frequency exporter based upon its number of export applications submitted to Commerce, for the Commerce ECASS D&E product group licenses; and State for DETRA permanent technical data licenses, using the following categories: high—800 or more licenses, medium—100-799 licenses, and low—1-99 licenses.

Had a foreign employee presence. The company held Commerce and/or State export licenses for the export of controlled information to its foreign national employees, or conducts business with foreign subsidiaries or partners.

Was a small business recipient of a DOD RDT&E contract, for fiscal years 2000-2004.

Were new exporters or potential exporters, in the process of applying for an export license to either Commerce or State.

We did not generalize the information and findings we developed from our work with these 46 companies to the broad universe of all U.S. companies that export. We conducted this review from January through November 2006 in accordance with generally accepted government auditing standards.

Appendix II: Comments from the Department of Commerce

Appendix III: Comments from the Department of State