Critical Technologies: Agency Initiatives Address Some Weaknesses, but Additional Interagency Collaboration Is Needed
Released: 2015-02-10T00:00:00

Letter

Background

In 2007, we identified eight key programs that aim to protect critical technologies: Arms and Dual-Use Export Controls, Anti-Tamper Policy, the Foreign Military Sales Program, the National Disclosure Policy Committee, the Militarily Critical Technologies Program, the National Industrial Security Program, and the Committee on Foreign Investment in the United States. Responsibilities for these programs are shared among multiple federal agencies and offices, primarily within the Departments of Commerce, Defense, Homeland Security, Justice, State, and Treasury. As shown in table 1, multiple agencies either have the lead or are stakeholder agencies for the programs for the identification and protection of critical technologies. In our 2013 high-risk update, we noted that these programs do not work collectively as a system and that the administration had not taken steps to re-examine the portfolio of programs to address their collective effectiveness; any actions to improve programs had largely focused on addressing challenges in individual programs. Although we did not previously divide this list of programs into export control and non- export-control programs, an ongoing presidential initiative known as Export Control Reform has emphasized the relationship between two of the programs on the list: the Arms Export Control System and the Dual- Use Export Control System. These two programs—which we refer to collectively as export control programs—impose licensing requirements on persons that create or trade in specified categories of items and information. The other programs in the portfolio—which we refer to as non-export-control programs—are not part of this system for controlling exports.

Agencies Have Made Progress in Addressing Previously Identified Weaknesses for Critical Technologies Programs, But Face Some Implementation Challenges

The cognizant agencies have taken actions in each of the programs designed to protect critical technologies since our January 2007 high-risk update, in response to changes in law, our prior recommendations, or their own internal identification of weaknesses. For instance, initiatives are under way in the area of export controls, which comprises two of the eight programs, based on an April 2010 framework announced by the administration. The six non-export-control programs have undergone changes through internal agency or department initiatives, or through legislative requirements. However, some of these eight programs are facing implementation or additional challenges.

Export Control Reform Is Under Way, but Challenges to Full Implementation Exist

In 2009, the administration directed an interagency review of the U.S. export control system that resulted in the establishment of an Export Control Reform initiative a year later. This initiative is under way and actions have been implemented using a phased approach, with three planned phases—Phase I developed plans and made preparations for Phase II, which is the implementation of steps to reconcile various definitions, regulations, and policies for export controls, all while building toward Phase III. This third phase is to result in implementation of major changes supported by these reconciliations, by consolidating export control efforts in four reform areas, to create a single, consolidated control list, a single licensing agency, a primary export enforcement coordination agency, and a unified information technology system. As we concluded in our November 2010 review of the Export Control Reform initiative, this approach has the potential to address weaknesses in the U.S. export control system, including areas where agencies have not addressed prior The reform effort is currently in Phase II, and changes are GAO findings.occurring in each of the four reform areas, to varying degrees. Challenges are also present in each, such as achieving full implementation of the Federal Export Enforcement Coordination Center, designed to coordinate enforcement efforts across all export agencies. Further, delays exist in agencies’ use of DOD’s USXPORTS system as the unified information technology system for licensing. Moreover, full implementation of Export Control Reform in Phase III is dependent upon congressional action to revise legislation, particularly in licensing and enforcement activities.

Steps Toward a Consolidated Export Control List Are Under Way

In order to regulate the export of items and information with military applications, State and Commerce each maintain a separate control list of items that require a license before they can be exported—the U.S. Munitions List, for State, and the Commerce Control List, for Commerce. Because State and Commerce have different restrictions on the items they control, determining which agency controls exported items is fundamental to the effectiveness of the U.S. export control system. Over 10 years ago, we found that both departments had claimed jurisdiction over the same items, such as certain missile-related technologies, and the administration noted that these types of jurisdictional issues were still present in 2010, when they began Export Control Reform. Such jurisdictional disagreements and problems in the past have often resulted from the departments’ differing interpretations of the regulations and from minimal or ineffective coordination among the departments. As part of the reform initiative, a task force created new export control criteria to determine which items and technologies should be controlled by Commerce and which by State, thus helping to reduce uncertainty. In implementing this process, Commerce, State, and Defense officials involved in the reform initiative are working to reach agreement on the appropriate controls over items in the 21 categories of State’s U.S. Munitions List and the corresponding controls for items Commerce, State, and Defense officials determine should be moved to the Commerce Control List.

Since the first set of revised rules went into effect in 2013, 15 of the 21 categories of the U.S. Munitions List have been reviewed and final rules have been issued to clearly identify the jurisdiction of controlled items. These revisions are intended to move certain less sensitive items from State’s U.S. Munitions List to the Commerce Control List, while leaving high-risk and high-priority items and information on State’s list. The moved items are subject to Commerce’s more flexible Export Administration Regulations. The aim of these revisions is to enhance national security by increasing interoperability with allies, maintaining the U.S. defense industrial base, and enabling the U.S. export control agencies to focus on items and destinations of greater concern. For example, military aircraft instrument flight trainers not specially designed to simulate combat have been transitioned from the U.S. Munitions List to the Commerce Control List. An additional three categories of the U.S. Munitions List, pertaining to arms and ammunition, are on hold because they relate to the politically sensitive issue of gun control policy, according to senior level export administration officials at both State and Commerce. The final three categories are still under review.

Current efforts have focused on transitioning less sensitive items from the U.S. Munitions List to a new section of the Commerce Control List called the 600 Series, which was added in order to provide a separate classification for munitions newly under Commerce’s jurisdiction. According to Commerce’s Assistant Secretary for Export Administration, the completion of all of these revisions is expected by late 2015. As a result of the control list revision process, however, licensing staff and industry are contending with three general types of controls—the U.S. Munitions List, the 600 Series controls on the Commerce Control List, and the dual-use controls on the Commerce Control List. This is intended as an intermediary step on the path to a single list, but an official from State’s Directorate of Defense Trade Controls noted that, for now, some exporters are confused by the multiple lists. This confusion among exporters, although typically expected when there are various lists, could delay or impair achievement of the Export Control Reform’s goal of overcoming the inefficiencies of the previous export control system until the final integration to a single list is completed.

These changes to the lists are also affecting export control enforcement actions that rely on processing of commodity jurisdictions—which determine whether an item is controlled by State or Commerce—by the Department of State, according to enforcement agency officials. Two officials from the Department of Justice, as well as the Deputy Assistant Director of the Department of Homeland Security’s (DHS) Homeland Security Investigations Counter-Proliferation Investigations Program, told us that it is taking longer for State to issue decisions, including commodity jurisdiction determinations, because of the recent changes to the control lists. They stated that the changing jurisdiction of items is resulting in a greater need for investigators to obtain timely commodity jurisdictions than in the past. Consequently, these officials noted that, given the time it is taking to complete the commodity jurisdiction decision—upwards of 6 months in some cases, which is well beyond State’s goal of 60 days—it is difficult for law enforcement to build a case and receive timely information to take specific enforcement actions, such as authorization to execute a search warrant or to obtain criminal indictments. The Deputy Assistant Director of DHS’s Homeland Security Investigations Counter-Proliferation Investigations Program also noted that commodity jurisdictions often involve review by other agencies, such as DOD technical experts in addition to the licensing agencies of State and Commerce, and that this involvement, in addition to the limited staff at the State Department available to conduct commodity jurisdictions for law enforcement agencies, may be contributing to the length of time taken. Compliance officials at State indicated that they try to prioritize commodity jurisdiction requests from law enforcement, but increases in the frequency of these requests and duplication of requests has made it difficult for them to keep up with law enforcement needs.

According to the Department of Justice officials, the length of time it takes to receive the certification necessary from the State Department to proceed with their enforcement actions, such as search warrants, results in cases losing momentum. These delays also contribute to increased difficulty in keeping witnesses interested and available if and when the case goes to trial. In addition, the Deputy Assistant Director of DHS’s Homeland Security Investigations Counter-Proliferation Investigations Program told us that DHS is experiencing the same challenge in conducting enforcement activities. Officials with both Homeland Security Investigations and the Executive Office for U.S. Attorneys stated that these delays are having an adverse effect on numerous cases and investigations. DHS documents show that the number of requests for support by State that would include a commodity jurisdiction have doubled since 2008, reaching more than 250 requests in 2014. Further, two officials from the Department of Justice told us that in this transitional period, the revisions to the control list are creating some degree of confusion and it is becoming more subjective to prosecute cases. The burden of export control cases is to establish that the individual or entity willfully and knowingly intended to violate the law, and the increased confusion can complicate efforts to prove that intent. These officials stated that they are beginning to collect information on the impact of this confusion; and according to officials at State, DHS, and Justice, they are working together to develop updated procedures for requesting commodity jurisdictions that will facilitate the process on both sides and reduce confusion. In the meantime, some export control enforcement actions may continue to be inhibited.

Streamlining of Licensing Activities May Face Resource Challenges

Efforts to create a single licensing agency are awaiting Phase III legislative authorization, but Phase II actions are under way. In order to address the national security risks of controlled items falling into the wrong hands, the export control programs may require licenses for the export of controlled items. Under the current export control system, the Departments of State and Commerce each have the authority to issue export licenses for items within their respective jurisdictions. In 2010, licensing agencies within these departments processed over 100,000 For some transactions, exporters were required to apply for licenses.licenses from both departments, because the transactions contained both U.S. Munitions List and Commerce Control List items. The goal of the reform initiative is to create a single licensing agency, which would act as a single source for businesses seeking an export license and for the U.S. government to coordinate review of license applications. As one step, State has been authorized to issue licenses for items subject to Commerce’s jurisdiction that are used in or with items subject to State’s jurisdiction. Such action—when combined with the revised control lists— is expected to result in fewer license requests and the use of a greater number of license exceptions.

GAO, Export Controls: U.S. Agencies Need to Assess Control List Reform’s Impact on Compliance Activities, GAO-12-613 (Washington, D.C.: Apr. 23, 2012).

U.S. Munitions List to the Commerce Control List is completed.assessment of licensing resources is important, but does not fully address our 2012 recommendation that Commerce review its resource needs for all of its compliance activities.

Steps Toward a Primary Enforcement Export Coordination Agency Have Expanded Interagency Communication, but Efficiency and Coordination Challenges Remain

GAO, Export Controls: Challenges Exist in Enforcement of an Inherently Complex System, GAO-07-265 (Washington, D.C.: Dec. 20, 2006). goal of limiting duplicative or counterproductive activities. The Director of the E2C2 provided data showing that over 3,000 submissions have been made through the deconfliction process, and slightly over half have resulted in additional information-sharing of some kind. Enforcement officials at multiple agencies described positive effects of the E2C2 deconfliction process in enabling coordination amongst the agencies. According to key enforcement officials that we spoke with at the E2C2, DHS, and at the Departments of Justice and Commerce, this is a resource intensive process, in part, because it is still managed manually, which slows down their ability to quickly deconflict information. Initial steps to address these inefficiencies by automating the deconfliction process are under way. These efforts taken by the E2C2 are not yet complete, but they are a good start to achieving a more coordinated approach to the enforcement of export controls.

State and DOD Have Implemented Efforts to Move Towards a Unified Information Technology System, but Commerce Faces Delays

Finally, the Export Control Reform initiative proposes a single information technology system to administer the export control system and share information regarding licensing and related actions among the export control agencies. According to administration Export Control Reform plans, DOD’s USXPORTS database will eventually serve as the single electronic system to process export licensing. Several agencies, including State and DOD, are using USXPORTS for export control licensing; however, Commerce is not yet using this system—a more than 2-year delay from the originally anticipated migration date of May 2012; which, according to the Assistant Secretary for Export Administration, was largely a result of sequestration and budget issues. According to Commerce officials, Commerce is working with the DOD contractor to mitigate issues with two major system requirements concerning crossover from classified to unclassified domains and interface between Commerce’s licensing and enforcement databases. The Commerce officials stated that once these issues have been addressed, Commerce’s export licensing process will transfer to the USXPORTS system.

Additionally, the unified information technology system may not address all the information technology needs of the export control enforcement agencies. The other agencies that conduct export enforcement activities, within DHS and Justice, are not presently using USXPORTS because it is not intended as a repository of enforcement information, but stated that the licensing data it will contain may be a useful tool for them in the future. Moreover, in November 2010, we found that the Export Control Reform initiative for information technology did not fully address findings from our previous work. In addition, in October 2007, we found that export control enforcement agencies lack a system to identify all parties that engage in nuclear proliferation and are impaired from judging their progress in preventing nuclear networks because they cannot readily identify basic information on the number, nature, or details of all their enforcement activities involving nuclear proliferation. Since that report was issued, Commerce has implemented procedures to address a recommendation on this issue, but Treasury has not.

Single Licensing and Primary Export Enforcement Coordination Agencies Expected in Phase III

Across all four areas of Export Control Reform, full implementation is expected to occur in its third and final phase—Phase III—which focuses on implementing the reform proposals that are dependent upon congressional action, such as creating a single licensing agency and a primary export enforcement coordination agency. For example, because there are separate statutory bases for State and Commerce to review and issue export licenses, legislation will be required to consolidate the current system into a single licensing agency. Further, Phase III of the reform initiative plans to merge export control investigative resources from Commerce into DHS’s Immigration and Customs Enforcement. Moreover, officials from Justice’s National Security Division noted that the enforcement agencies at Commerce, DHS, and the Federal Bureau of Investigation currently provide for a diverse group of investigators with varying, but valuable assets to the prosecutorial community, which they hope will be sustained through the Phase III effort. For these reasons, significant collaboration by the participating agencies is essential to the Phase III consolidation efforts.

Non-Export-Control Programs Designed to Protect Critical Technologies Have Also Undergone Positive Changes, But Implementation is Not Yet Complete

The remaining programs that have a role in protecting critical technologies—designated as non-export-control—have also undergone individual changes in response to previously identified weaknesses. Four of the major programs in the portfolio are led by offices at DOD—Anti- Tamper Policy, the National Disclosure Policy Committee, the Militarily Critical Technologies Program, and the National Industrial Security Program—with a fifth, the Foreign Military Sales Program, led by State in approving the transfers and administered by DOD. Another program, the Committee on Foreign Investment in the United States (CFIUS), is led by Treasury, with participation from several other agencies, and has undergone changes in response to legislative action in 2007. We found that some of these programs have processes in place for sharing information on potential threats or needed actions between the programs, but these actions have not yet been completed.

Anti-Tamper Policy Has Undergone Positive Changes

DOD established its Anti-Tamper Policy in 1999, requiring the military departments to implement techniques to protect critical technologies that might be vulnerable to exploitation—through such means as reverse engineering—when weapons leave U.S. control through export or loss on the battlefield. Examples of anti-tamper techniques include software encryption, which scrambles software instructions to make them unintelligible without first being reprocessed through a deciphering technique, and hardware protective coatings designed to make it difficult to extract or dissect components without damaging them. We reviewed this program in 2008, and at that time we found that, although DOD program managers were ultimately responsible for implementing its anti- tamper policy, a lack of direction, information, and tools created significant challenges for them. Since 2008, in response to our recommendation that DOD identify and provide additional tools to assist program managers in the anti-tamper decision process, DOD’s Anti- Tamper Executive Agent’s Office has improved the training for anti- tamper policies that it offers to program managers. In addition, DOD’s acquisition reform initiatives of Better Buying Power 2.0, including the Defense Exportability Features, are building anti-tamper features into the design phase of a weapon system’s development process—much earlier than in the past.these changes, but they represent positive actions to improve past weaknesses in this program.

A Newly Created Steering Group Supports the Foreign Military Sales Program and National Disclosure Policy Process

Each year, the U.S. government sells billions of dollars of defense articles and services to foreign governments through the Foreign Military Sales program. The Arms Export Control Act authorizes the sale of defense articles and services to eligible foreign customers by the President under the Foreign Military Sales program. The President has delegated transfer approval to State under the Foreign Military Sales program and implementation authority to DOD to administer it. Both agencies have taken steps to reform the program in response to some, but not all, of our findings and recommendations from multiple prior reports examining this program. Specifically, in May 2009, we recommended that DOD take actions to improve its verification and tracking of Foreign Military Sales shipments, which led to DOD improvements in its systems to expand the available information for tracking Foreign Military Sales shipments, as well as its guidance on how to verify those shipments. However, although the agencies generally concurred with it, our interagency recommendation on ensuring Customs and Border Protection officials have the necessary information to verify shipments remains unaddressed. Based on recommendations from a report we issued in November 2012, the Defense Security Cooperation Agency has updated its policies to improve the quality of information sharing and to better track timeliness of shipments. However, additional recommendations on metrics for assessing timeliness of other aspects of the shipping process have not yet been implemented, although DOD concurred with these recommendations and told us it is working to collect the necessary information to better measure timeliness.

The National Disclosure Policy Committee determines the releasability of classified military information, including classified weapons and military technologies, to foreign governments. As members of the Committee, each military department has its own administrative process for reviewing requests for transfers of classified weapons and information, within the parameters of the National Disclosure Policy. Since 2008, in support of its portfolio of security cooperation programs, which include the Foreign Military Sales program and the National Disclosure Policy Committee, a DOD coordinating body has met monthly to discuss potential technology transfers to foreign governments and improve processes for reviewing transactions that implicate critical technologies protection issues. The Arms Transfer and Technology Release Senior Steering Group (ATTR SSG) brings together representatives from numerous DOD offices. It is co-chaired by the Office of the Under Secretary of Defense for Acquisition, Technology and Logistics and the Office of the Under Secretary of Defense for Policy, and members include the Defense Security Cooperation Agency, the military departments, the Joint Staff, and other DOD agencies with technology security and foreign disclosure responsibilities. Additionally, due to their shared responsibilities on Foreign Military Sales and export controls, two offices from the Department of State participate in the ATTR SSG, as well. A representative of State’s Office of Regional Security and Arms Transfers was formally added as an observer to the ATTR SSG in 2012 and a representative from the Directorate of Defense Trade Controls has been added more recently.

The Militarily Critical Technologies Program Remains Underutilized

In response to the Export Administration Act of 1979, DOD established the Militarily Critical Technologies Program in 1980 to develop the Militarily Critical Technologies List (MCTL) of technologies possessed by sources in the U.S. that, if exported, would permit a significant advance in Its original purpose was to inform the military system of another country.export licensing determinations, and it was to be integrated into the Commerce Control List on an ongoing basis. Since then, the list has expanded to capture technology capabilities developed worldwide. In January 2013, we found that the MCTL was out-of-date and was no longer being published online, but that widespread requirements to know what is militarily critical remained. We recommended that the Secretary of Defense (1) determine the best approach to meeting users’ needs for a technical reference, whether it be MCTL, other alternatives being used, or some combination thereof; and (2) ensure that resources are coordinated and efficiently devoted to sustain the approach chosen. We further recommended that if DOD determines that the MCTL is not the optimal solution for aiding programs’ efforts to identify militarily critical technologies, the Secretary of Defense seek necessary relief from DOD’s current responsibility. According to DOD officials responsible for the MCTL, they are no longer updating the list, and are in the process of determining whether it is appropriate to seek relief from the requirement to maintain the list. They stated that alternatives to the MCTL are being employed based on the specific needs of each agency, and DOD offices are using the U.S. Munitions List, the Commerce Control List 600 Series, and the Industrial Base Technology List as alternatives to the MCTL. For example, officials in the Office of the Under Secretary of Defense for Acquisition, Technology and Logistics stated that DOD offices and agencies are using the U.S. Munitions List in support of export license processing and foreign disclosure decisions. However, DOD has not formally determined the best approach to meet users’ needs for a technical reference and to ensure that resources are coordinated and efficiently devoted to sustain the approach chosen.

National Industrial Security Program Reports Significantly Reducing a Backlog of Cases

DOD’s National Industrial Security Program (NISP) was established in 1993 to ensure that federal contractors cleared for classified information, including information associated with critical technologies, are taking the proper steps to appropriately safeguard that information. DOD’s Defense Security Service administers NISP by reviewing contractor applications for clearance and overseeing cleared facilities. NISP’s role within the critical technologies portfolio relates to its review of contractors under foreign ownership, control, or influence (FOCI). In our previous work on this topic, we found insufficient oversight to ensure the security of classified information (including critical technology information) from foreign interests and cited lengthy delays in security reviews. In 2004, we reviewed the NISP program and recommended improvements to oversight of contractor protection of classified information. Although DOD concurred with these recommendations, they were not implemented. In 2005, we made a number of recommendations for better administration of FOCI oversight, including two, which DOD subsequently implemented, on efforts to develop a human capital strategy that would better serve the needs of FOCI security representatives. In a recent interview with officials in charge of this program, they told us that they have increased their staff resources approximately from 5 people in 2004 to 40 people presently; and also implemented a risk-based decision-making and evaluation process for overseeing facilities that handle classified information. This risk-based approach to reviewing facilities includes an annual update of the list of facilities in the United States that conduct classified work, and a prioritization of which facilities will be visited based on criteria and input from key stakeholders within DOD and the intelligence community. Prior to these changes, many cases were taking upwards of one year to conduct reviews and put FOCI measures in place for companies that conduct classified work for the U.S. government. According to the head of the Defense Security Service’s FOCI Operations Division, these changes in staffing and taking a risk-based approach have reduced the backlog of reviews of new companies handling classified information. The Analytic Division now conducts FOCI reviews of all of the roughly 1300 new companies seeking clearance each year. For previously cleared facilities, officials stated that this risk-based approach allowed Defense Security Service staff to complete security vulnerability assessments at about half of the roughly 13,500 cleared facilities under their purview in 2014. They told us that this process also allows staff to prioritize and target those reviews to higher risk facilities; for example, in 2014, they conducted reviews at 586 of the roughly 600 cleared facilities that have FOCI mitigation in place.

NISP had previously used the MCTL to categorize the types of classified information by technology that was being targeted in cleared facilities by foreign entities. However, according to the officials with Defense Security Service’s Counterintelligence Directorate, MCTL was not broad enough to cover non-defense-related technologies, in fields such as agriculture. With the transition away from MCTL, the Defense Security Service developed the Industrial Base Technology List to better cover the range of categories of concern to NISP; and according to these officials, Counterintelligence continually updates this list to include new technologies requiring oversight as they are developed, as well as including non-defense technologies that fall under the purview of NISP.

The Committee on Foreign Investment in the United States Faces Changes in the Risks It Must Address

CFIUS is an interagency committee that serves the President by overseeing the national security implications of foreign investment in the U.S. economy. CFIUS is chaired by Treasury, and includes members from other federal agencies such as Commerce, Defense, Energy, Homeland Security, Justice, and State, among others. CFIUS reviews foreign acquisitions, mergers, or takeovers of a U.S. business to determine whether it poses a threat to the national security of the United States. CFIUS may also enter into an agreement with, or impose conditions on, parties to mitigate national security risks. One component of this review involves discussion of any relevant critical technologies and the potential impacts of foreign ownership of, or access to, such technologies. In 2008, in response to Congressional action partially driven by findings and recommendations that we raised in earlier reports, CFIUS implemented reforms increasing its efforts on national security- related topics and defining categories of transactions subject to review, such as those resulting in control of critical U.S. infrastructure by a foreign person. In 2012, the growing number of investments in the United States by Chinese firms sparked concerns by a number of groups over the economic and security impact of the investments, according to a report by the Congressional Research Service.

The scope of potential national security risks presented by foreign investment in the United States has evolved beyond ownership and control concerns. Specifically, the issue of proximity has broadened to consideration of the geographic location of foreign-owned businesses and their capability to collect intelligence on U.S. military installations. For example, the CFIUS review process came under increased scrutiny after the attempted purchase by a Dubai company, Dubai Ports World, of a company that operated various U.S. port facilities. Although initially allowed to proceed by CFIUS in 2006, subsequent congressional and media attention ultimately caused the company to sell the U.S. portion of the business to another U.S. company. In addition to the Dubai Ports case, according to a Congressional Research Service report, an investment by a Chinese firm in a wind farm project in Oregon recently attracted public and congressional attention. CFIUS recommended that the company stop operations until an investigation could be completed as a result of objections by the U.S. Navy over the placement of wind turbines near or within restricted Naval Weapons Systems Training Facility airspace where unmanned aerial vehicles are tested. After a full investigation, CFIUS recommended that the President block the investment and he issued an Administrative Order stating that there was credible evidence that the acquisition threatened to impair U.S. national security; the case is under appeal. Further, in December 2014, we issued a report that examined DOD military installations and critical infrastructure which included information on the proximity of foreign- owned businesses near military bases. Although this report did not have any findings or recommendations related to the CFIUS process, it identifies foreign-owned businesses near military bases as another potential area for CFIUS consideration.

Interagency Collaboration Exists among Agencies but Improvements Could Be Made

Recent initiatives in response to identified weaknesses in the critical technologies programs have resulted in improved interagency collaboration. Some programs have developed mechanisms for interagency collaboration across the participating agencies for their individual program. However, current collaboration mechanisms do not involve direct communication among all the programs in the protection of critical technologies portfolio.

Some Agencies’ Policies and Mechanisms Support Interagency Collaboration in the Critical Technologies Portfolio

There are both existing mechanisms and new initiatives among the critical technologies programs that support collaboration. In some cases, these programs promote interagency collaboration through formal and long- standing mechanisms. Most notably, CFIUS was established as an interagency body to review transactions that could result in a foreign party’s gaining control over a U.S. company. Under the CFIUS process, CFIUS member agencies work toward reaching a consensus on decisions. The consensus-based decision-making process ensures that representatives of each stakeholder agency are aware of the basis of the decision, including any future actions that CFIUS might be relying on each agency to take to address national security risks. CFIUS, or a lead agency, may negotiate agreements with any party to a covered transaction in order to mitigate the national security risks that may result from the transaction, when other provisions of law do not adequately address these risks. The CFIUS lead agency on the transaction is responsible for monitoring the agreement to ensure compliance with it. GAO has not recently examined CFIUS agencies’ efforts to enforce these security agreements, and we are not aware of any ongoing changes or initiatives that involve CFIUS.

We also found that agencies have fostered new opportunities to promote interagency collaboration in their shared goal of protecting critical technologies. For example, the creation of the ATTR SSG created new opportunities for regular communication, through monthly meetings, among DOD offices and between DOD and State, while preserving DOD’s control over the coordinating body. A new office, the Technology Security and Foreign Disclosure Office, serves as the administrative arm of the ATTR SSG and participates in creating and disseminating policies in this area. State Department officials from the Regional Security and Arms Transfers office and the Directorate of Defense Trade Controls participate in the ATTR SSG as observers. These State representatives have raised concerns about individual transactions at the ATTR SSG and initiated policy discussions, but are considered non-DOD participants; therefore they do not have voting rights within the group.

In 2014, DOD organized a new office within the Office of the Under Secretary of Defense for Policy, devoted to improving the strategic posture of DOD security cooperation activities by, among other things, coordinating DOD’s use of legal authorities, including Foreign Military Sales and the National Disclosure Policy, for transfers to foreign partners. To this end, the office facilitates the inclusion of key stakeholders in its strategic initiatives, including those involved in critical technologies protection and foreign disclosure within DOD, as well as at State. At this point, it is too early to determine what effects this office will have on intra- and inter-agency coordination.

In addition to the formal coordinating bodies discussed above, the agencies also make use of informal processes to ensure an ongoing flow of information. As part of the administration’s Export Control Reform initiative, State and Commerce regularly consult with DOD officials and subject matter experts about revisions to export control regulations. DOD and State also have plans to detail staff to their counterpart’s offices in order to improve communication on their shared programs, particularly Foreign Military Sales. Officials stated that this should enable them to learn about how information is handled at the other agency and about one another’s practices.

Collaboration among Lead and Stakeholder Agencies Remains a Challenge Across the Critical Technologies Portfolio

Agencies have taken steps to collaborate with other agencies to manage their individual critical technologies programs; however, current collaboration mechanisms do not involve direct communication among all the programs in the protection of critical technologies portfolio. For example, although the ATTR SSG has developed processes for interagency collaboration on security cooperation programs, it does not provide a forum for direct communication among all programs with critical technologies responsibilities, such as Commerce’s export control officials. All of the eight critical technology programs in this portfolio share a goal of protecting national security. In January 2007, when we designated the protection of critical technologies as high risk, our body of work on programs designed to protect critical technologies showed fragmentation, including poor coordination among the multiple agencies involved. The agencies responsible for many of these programs have since made progress toward improving coordination and reducing fragmentation, individually, and in some instances collectively. Past work on interagency collaboration notes that many of the results that the federal government seeks to achieve require the coordinated efforts of more than one federal agency and often more than one sector and level of government.

Both Congress and the executive branch have recognized the need for improved collaboration across the federal government, as stated in our September 2012 report on interagency collaboration. In a June 2010 report on interagency collaboration in national security, we also concluded that when multiple agencies are managing similar information, challenges may exist among agencies regarding redundancies in information sharing, unclear roles and responsibilities, and data comparability.including differences in agencies’ structures, planning processes, and funding sources—can hinder interagency collaboration.

That report also noted that organizational differences— According to officials involved in administering critical technologies programs, different programs use different terminology, and the usage and understanding of terms can vary. Under the administration’s Export Control Reform initiative, State and Commerce have worked together to revise regulatory definitions of key terms, and this collaboration is ongoing. Across the broader portfolio of critical technologies programs, however, definitions may not always be clearly aligned, and categories such as critical technologies may be understood in different ways at different programs. Best practices for interagency collaboration include using consistent terminology to establish a common understanding and improve collaboration among the various programs. In some cases, distinct uses of the same or similar terms may be appropriate, but make it more important that the programs have a plan for sharing these distinctions to ensure a common understanding. As the use of the U.S. Munitions List and the Commerce Control List expands to areas beyond export controls, taking steps to apply the concepts and terms used by the lists consistently would help eliminate confusion and facilitate collaboration. State’s export compliance officials noted that the U.S. Munitions List sets out a procedure for assessing items to determine whether they are subject to State’s export control regulations, and that other potential users of this list need to understand how this procedure works in order to avoid confusion.

Some impediments to collaboration could be addressed when the implementation of certain initiatives is completed. For example, DOD’s use of Better Buying Power 2.0’s Defense Exportability Features enables DOD to more clearly inform acquisition programs about their responsibilities for critical technologies programs such as Anti-Tamper Policy and Foreign Military Sales at the design stage, rather than waiting until decisions are made about where to deploy or sell a system. DOD plans to continue the Defense Exportability Features initiative in Better Buying Power 3.0, which launched in September 2014. In addition, the establishment of the E2C2 was a step toward addressing concerns about collaboration we had raised in prior reports, and the E2C2’s deconfliction process provides significant opportunities for improved information sharing. However, the full benefit of export enforcement coordination is limited until all of the standard operating procedures are completed, including the one that allows for greater collaboration between the enforcement and intelligence communities.

In a September 2014 meeting with senior representatives of the agencies involved in the protection of critical technologies, we discussed their efforts to address our designation of this area as high risk and also discussed the possibility of having one agency in charge of this area. These agencies expressed concern over their distinct roles and responsibilities and which agency would take the lead for coordinating efforts to protect critical technologies. In subsequent discussions with these agencies, the officials responsible for the operations of these programs generally agreed with the need for better collaboration among the programs, including actions not currently being taken. Such actions could include holding an annual meeting of the programs designed to protect critical technologies to discuss the technologies they are protecting, their programs’ intent, and any new developments or changes planned for their programs. For example, the Director of DOD’s Defense Technology Security Administration stated that, even within DOD, these programs expand beyond any one organization and initiatives are occurring within these programs. Interagency collaboration mechanisms for various agencies involved in common goals, such as the protection of critical technologies, are essential to avoid the potential for a patchwork of activities that could waste scarce funds and limit the overall effectiveness of federal efforts. Cross agency collaboration may strengthen the alliance of these programs and create common understanding of these technologies and better ensure that they are provided to foreign entities in a manner consistent with U.S. interests. For these reasons, it is important that the agencies responsible for the protection of critical technologies continue to promote and strengthen mechanisms for effective collaboration, both within their programs and agencies, as well as across the interagency community.

Conclusions

In the 8 years since critical technologies programs were added to the GAO high-risk list, the agencies responsible for their implementation have taken positive steps and developed a number of initiatives to improve their individual programs. The critical technologies portfolio is a complex array of programs, subject to a myriad of laws, regulations, and policies, and administered by multiple offices across several departments. Effective coordination across the portfolio of programs is important to mitigate national security risks, and interagency collaboration is essential to realizing the potential effectiveness of the programs. This is especially true in light of the initiatives under way and the changing nature of issues related to the protection of critical technologies. It is important that collaboration and information sharing is optimized among agencies, not just within each agency. Doing so would improve their ability to protect critical technologies and national security interests. Within individual or closely related programs, ensuring that a consistent approach is taken by the lead and stakeholder agencies in meeting the program goals would help coordinating bodies to ensure that the protecting of critical technologies remains up to date and effective. Ongoing improvements to the individual programs may help to address some of these coordination issues, but interagency collaboration across the portfolio remains an important challenge as these changes occur.

Recommendation for Executive Action

To ensure a consistent and more collaborative approach to the protection of critical technologies, we recommend that the Secretaries of Commerce, Defense, Homeland Security, State, and the Treasury; as well as the Attorney General of the United States, who have lead and stakeholder responsibilities for the eight programs within the critical technologies portfolio, take steps to promote and strengthen collaboration mechanisms among their respective programs while ongoing initiatives are implemented and assessed. These steps need not be onerous; for example, they could include conducting an annual meeting to discuss their programs, including the technologies they are protecting, their programs’ intent, any new developments or changes planned for their programs, as well as defining consistent critical technologies terminology and sharing important updates.

Agency Comments

We provided a draft copy of this product to the Departments of Commerce, Defense, Homeland Security, Justice, State, and the Treasury for comment. Each concurred with our recommendation that they take steps to promote and strengthen collaboration mechanisms among their respective programs. Justice and Treasury stated their concurrence with our recommendation in e-mailed comments. Commerce, Defense, Homeland Security, and State provided written comments and identified approaches to implementing our recommendation, including continuing existing collaborative initiatives as well as working with other departments to seek new opportunities for collaboration; and these are reproduced in Appendixes I, II, III, and IV, respectively. Commerce, Defense, and Homeland Security also provided technical comments that were integrated into the report, as appropriate.

We are sending copies of this report to appropriate congressional committees; the Secretaries of Commerce, Defense, Homeland Security, State, and the Treasury; the Attorney General of the United States; and other interested parties. This report will also be available at no charge on GAO’s website at http://www.gao.gov.

If you or your staff have any questions about this report, please contact me at (202) 512-4841 or makm@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix V.

Appendix I: Comments from the Department of Commerce

Appendix II: Comments from the Department of Defense

Appendix III: Comments from the Department of Homeland Security

Appendix IV: Comments from the Department of State

Appendix V: GAO Contact and Staff Acknowledgments

GAO Contact

Marie A. Mak, (202) 512-4841, or makm@gao.gov.

Staff Acknowledgments

In addition to the contact named above, Lisa Gardner, Assistant Director; Scott Purdy; Ted Alexander; Robert Swierczek; Susan Ditto; Marie Ahearn; Kenneth Patton; and Hai Tran made key contributions to this report.

Related GAO Products