DOD assigns demil codes to all military property to identify their required disposition when no longer needed. Demil codes are contained in the Defense Demilitarization Manual, which implements DOD policy to apply appropriate controls and prevent improper use or release of these items outside of DOD. Demil codes indicate whether property is available for public use without restriction or whether specific restrictions apply, such as removal of classified components, destruction, or trade security controls. For example, if an item is designated as demil D, DOD requires this item to be totally destroyed "so as to preclude restoration or repair to a usable condition" rather than allowing a member of the general public to purchase the item. According to DOD's Defense Logistics Information Service, it considers sensitive defense-related items to be U.S. Munitions List items. This list, which is maintained by the State Department, identifies defense-related items that require government approval prior to export or temporary import. There are 20 categories of items on the U.S. Munitions List, including firearms and ammunition; aircraft and associated components; protective personnel equipment (such as body armor); nuclear weapons and related items; and directed energy weapons. Some of these items are also defined as significant military equipment, which are items for which special export controls are warranted because of their capacity for substantial military utility or capability. Any person or company in the United States that engages in either manufacturing or exporting U.S. Munitions List items must register with the State Department. Prior to exporting these items, a State Department-issued license is generally required. The table below defines the DOD demil codes, their associated designation as U.S. Munitions List items or Significant Military equipment, and DOD's approach to disposing of the item under each code. Despite the use of demil codes and other safeguards, our prior reports show that DOD faces significant challenges in properly disposing of sensitive military property. For example, in our May 2005 report on excess property, we found that some sensitive defense-related items in the DOD excess property system were lost, stolen, or damaged before DOD could decide what to do with them. Losses included nearly 150 chemical and biological protective suits, over 70 units of body armor, and 5 guided missile warheads. Because 43 percent of the reported losses involved military and commercial technology requiring demilitarization, we reported that these losses posed a security risk. In follow-up work reported in July 2006, we found that the Government Liquidation Web site sold over 2,500 sensitive-defense related items to nearly 80 individuals between November 2005 and June 2006. We also reported that our undercover investigators purchased items from the Government Liquidation Web site that should not have been sold to the public, including SAPIs (which were in demand by U.S. service members in Iraq and Afghanistan); a time-selector unit used to ensure the accuracy of computer-based equipment, such as global positioning systems and system-level clocks; digital microcircuits used in F-14 fighter aircraft; and numerous other items. In our most recent July 2007 report, we found that DOD has made significant improvements in preventing the sale of sensitive defense-related items through the Government Liquidation Web site. Throughout our investigation, we detected items that were potentially sensitive, but DOD or Web site employees regularly identified the same property items and removed them from the site before they were sold. In addition to the improper sale of sensitive defense-related items, we have also reported that the sale of demil code A and other nonsensitive military items can result in waste and reduces the efficiency of DOD operations. For example, in our May 2005 report, we found that DOD sold new and unused items to the general public for pennies on the dollar through the Government Liquidation Web site at the same time other DOD agencies requested these items. Rather than allocate its resources effectively, DOD simply paid the full acquisition cost again to purchase the same new and unused items. We determined that, from fiscal years 2002 through 2004, $3.5 billion in new, unused, and excellent condition items were being transferred or donated outside of DOD, sold on the Internet for pennies on the dollar, or destroyed rather than being reutilized. DOD has made progress in this area, with improved utilization of property resulting in millions of dollars in recent savings. Another area involving waste where we have performed investigative work involves the sale of military MREs. Although military MREs are nonsensitive items and are not on the U.S. Munitions List, we have identified civilians and service members selling military MREs on eBay for commercial gain. We concluded that military MREs are procured by government entities using taxpayer dollars, and consequently, if they are sold to the general public on eBay, they are clearly not reaching their intended recipients. We found numerous defense-related items for sale to the highest bidder on eBay and Craigslist from January 2007 through March 2008. Undercover investigators purchased a dozen sensitive items to demonstrate how easy it was to obtain them. The items were shipped to us "no questions asked." Many of these items were stolen from the U.S. military. According to DOD, it considers the sensitive items we purchased to be on the U.S. Munitions List, meaning that there are restrictions on their overseas sales. However, if investigators had been members of the general public, there is a risk that they could have illegally resold these items to an international broker or transferred them overseas. Some items we purchased were assigned demil code D, meaning that, if the items were in DOD's possession, the item should be destroyed rather than made available to members of the general public. Our investigators also identified examples of U.S. government property--both sensitive and nonsensitive items--being stolen and sold for personal profit rather than being utilized by DOD (i.e., conversion of government property). In addition to being cases of probable theft, these examples represent a waste of resources because DOD is effectively purchasing items that are subsequently not used for their intended purpose. While some sellers were active-duty members of the military, other sellers included retired or reserve status military members and civilians. Our investigation of the sellers found that they obtained the sensitive defense- related items in various ways, though in many cases theft from DOD was involved. According to DOD officials, U.S. military personnel are not authorized to sell certain items that have been issued to them, such as body armor; doing so is considered theft of government property. Moreover, if a civilian (such a surplus store owner) receives military property that they know has been stolen from the government, they are in violation of the law. See figure 1 for a photograph of the defense-related items we purchased from eBay and Craigslist sellers during our investigation. The sale of sensitive defense-related items over the Internet can have serious consequences, both abroad and here in the United States. In addition to the threat that sensitive items could be used directly against U.S. troops or allies, criminals could take advantage of some sensitive items to commit domestic crime. Sensitive defense-related items could also be reverse-engineered to develop countermeasures or equivalent technologies. Our investigators purchased a dozen sensitive defense-related items from Internet sellers during the period of our review. According to DOD, these items are on the U.S. Munitions List, meaning that there are restrictions on their overseas sales. Table 2 summarizes the majority of the items we purchased, followed by detailed case-study narratives. In addition to the items in the above table, we also purchased other items including an F-14 radio receiver and a body armor vest with SAPI plate. According to DOD, these are U.S. Munitions List items. We also purchased nonsensitive defense-related items such as boots, berets, patches, and an ACU chest rig. On October 10, 2007, we purchased a new antenna for the F-14 Tomcat from an eBay seller located in Loveland, Colorado. The seller lives about 60 miles from Buckley Air Force Base in Colorado. The antenna has a demil code of D, which requires DOD to destroy it when no longer needed. Our past work identified the control of excess F-14 components as a major challenge for DOD. The only country with operational F-14s, Iran, is known to be seeking such components. We interviewed the seller, who told us that he sells industrial electronic surplus items. He said he purchases these items from individuals, Internet sales sites, other eBay sellers, manufacturers, and occasionally the Government Liquidation Web site. The seller told us that he obtained this antenna from an individual located in the Denver, Colorado, area, whose name and address he could not remember. We were unable to determine how this part became available to the general public. We referred the seller to DCIS for criminal investigation. See figure 2 for a picture of the antenna. On September 19, 2007, we purchased a used flush-mount antenna, which is currently in use by the military in the Blackhawk, Apache, and Chinook helicopters, from an eBay seller located in The Colony, Texas. This city is located about 130 miles from Sheppard Air Force Base. The antenna is assigned demil code D, which requires DOD to destroy it when no longer needed. Chinook components are reportedly in demand by Iran, making this a national security issue. We interviewed the seller, who told us that he buys aircraft components from auctions and companies that are going out of business (not from Government Liquidation). He explained that he targets specific aircraft components that can be used in both military and commercial aircraft because he can better market these items to collectors. For example, he said that if he buys a Boeing 707 part he will resell it and advertise the part as belonging to a KC-135 Stratotanker (a midair refueling aircraft) because it would better pique the interest of a collector. According to eBay records, winning eBay bidders for other auctions held by this seller were located in Cyprus, the Czech Republic, Malaysia, and Slovenia. The seller said he did not recall the sale of this particular part, and it is unclear how it became available to the general public. We referred the seller to DCIS for criminal investigation. We obtained both milspec night vision goggles and IR tabs on the Internet. Although night vision goggles are commercially available to the public, the milspec tube in the goggles we purchased is a sensitive component that allows U.S. service members on the battlefield to identify friendly fighters wearing infrared (IR) tabs. These tabs are known as an IFF (identification friend or foe) element and can be detected at night by both ground troops and airborne combat pilots equipped with night vision equipment. Obtaining either of these two items could give enemies an undue advantage in night combat situations, either by using the night vision goggles to detect U.S. troops or by posing as U.S. troops (or friendly forces) with the IR tabs. We purchased these items directly from distributors who could sell these products domestically without violating any laws. However, officials representing the manufacturer of the night vision goggles told us that the goggles should not be sold on eBay and that, consequently, a violation of its distribution policies had occurred at some point in the distribution process. Officials told us they would conduct an investigation into where the violation of policy occurred and would remove the offending distributor from its list of authorized distributors. Case #3: Night Vision Goggles. On March 29, 2007, we purchased new/unused milspec night vision goggles from an eBay seller located in Tequesta, Florida. The fully operational goggles have a demilitarization code of F, meaning that, if the goggles are part of DOD inventory, they cannot be sold to the general public unless the milspec image intensifier tube has been removed. The image intensifier tube was included in the goggles we purchased. See figure 3 for a picture of the night vision goggles. Our investigators determined that the seller is a retired U.S. Marine Corps Colonel. The seller is the manager of business development for a General Services Administration scheduled business that distributes tactical, surveillance, and force protection equipment. According to the retired Colonel, he originally obtained 28 night vision goggles from an authorized distributor and sold most of them to active-duty military units, the U.S. Fish and Wildlife Service, U.S. Department of Homeland Security, U.S. Bureau of Land Management, and a number of municipal and state law enforcement agencies. The retired Colonel told us that, when he was unable to sell all 28 goggles, he used his personal eBay account to sell the remaining goggles to 10 individuals across the United States. He represented to us that he asked all potential clients for the goggles whether they were U.S. citizens as part of the eBay sales process. However, he did not ask our undercover investigator this question. Based on interviews with the goggle manufacturer and our legal research, we determined that the seller did not violate the law by selling these goggles domestically to members of the general public. However, it does appear the sale and distribution of these goggles violated the manufacturer's policy. Officials representing the goggle manufacturer told us they would conduct an investigation into where the violation of policy occurred and would remove the offending distributor from its list of authorized distributors. We referred this matter to DCIS for investigation. Case #4: IR tabs. We purchased new/unused IR tabs from an Internet store front (not eBay or Craigslist) maintained by a business owner in Marlboro, New York. We were alerted to this seller through his eBay advertisements and located the associated online store front. An enemy fighter wearing these IR tabs could pass as a friendly service member during a night combat situation, putting U.S. troops at risk. Prior to this purchase, our investigators had visited the physical store location, which is near the U.S. Military Academy at West Point. The physical store sells a variety of military items ranging from parachute cords to military patches. Our investigators identified themselves as GAO investigators and asked the store owner, a former Army Captain, whether he sells IR tabs to the general public. The store owner stated that he only sells the tabs to U.S. military personnel and that he always obtains proof of employment before completing an order. Several days after the interview, our investigator ordered and received several tabs from the seller's online store front. The validity of the order was never questioned, and the owner did not attempt to verify the employment of our investigator, as he stated during the interview. According to the manufacturer, these tabs have the same properties as the IR tabs affixed to ACUs and are a comparable product. Our own in-house tests confirmed that the tabs had IR properties and appeared to function the same way. We referred this matter to DCIS for investigation. During the course of this investigation, we purchased all the items necessary to build a complete, current U.S. military uniform--from boots to beret--using only the Internet Web sites eBay and Craigslist. Our intent was to demonstrate that the general public can purchase, over the Internet, all the gear necessary to dress and look like a U.S. service member. DOD has recognized the security risk associated with a member of the general public being able to acquire a full uniform. In January 2007, Iraqi insurgents dressed in U.S. military uniforms were allowed to pass through a police checkpoint in Karbala, Iraq. They subsequently broke into a secure compound using percussion bombs and killed five U.S. service members. After this incident, DOD issued a Demil Bulletin noting that ACUs "...will only be released to Army, Navy, Air Force, Marines and their Guard or Reserve components." On April 17, 2007--after the Demil Bulletin had been issued by DOD--we purchased a new/unused ACU with IR tabs from an eBay seller located in Fayetteville, North Carolina. As discussed above, IR tabs allow U.S. service members to identify friendly fighters during night combat. In addition to the risk that an enemy could pose as a U.S. service member in this ACU, the readily available IR tabs would also allow an enemy fighter to pose as a friendly fighter during night combat. The DOD-issued IR tabs are demil code D, which requires DOD to destroy them when no longer needed. According to the Defense Logistics Agency, the ACU that we purchased from this seller is ineligible for resale or release to the general public. The seller told us that he purchased the ACU at a flea market near Fort Bragg, North Carolina, and added that, on many occasions, he has observed flea market vendors purchasing military items from individuals who arrive at the flea market. The vendors then sell the items to the general public at the flea market. After concluding the interview, our investigators visited the flea market and observed several vendors selling used ACUs (none contained IR tabs). The flea market vendors told our undercover investigators that they obtain the ACUs at yard sales in the area and from soldiers. This ACU appears to have been stolen from DOD. We referred this matter to DCIS for criminal investigation. See figure 4 for a picture of the ACU. On April 21, 2007, we purchased a used Kevlar helmet from a civilian eBay seller located in Bloomingdale, Illinois. Even though the eBay seller's ad indicated that the helmet could not be exported, our investigation of his eBay history indicated that buyers in countries such as Costa Rica, the Czech Republic, Hungary, and Thailand had won eBay auctions for the helmets. When we interviewed the seller, he told us that he had never shipped Kevlar helmets overseas and he canceled sales when overseas buyers won these auctions. He said he originally obtained the helmets from the Government Liquidation Web site, which required him to sign an end use certificate stating, among other things, that the helmets would not be exported without a license from the State Department. Further review of the seller's eBay records reveals that he had completed auctions for $21,000 worth of Kevlar helmets from February 2007 to July 2007. We referred this matter to DCIS for criminal investigation. On August 23, 2007, we purchased a used Nuclear Biological Chemical (NBC) protective suit, used gas mask, used gloves and boots, and unused chemical-biological canister (containing the gas mask filter that is used to protect against chemical and biological warfare agents) from a Craigslist seller located in Oxnard, California. Although the NBC suit was removed from packaging and therefore not usable to protect against an attack, according to a DOD Product Specialist with whom we spoke, the NBC suit is susceptible to reverse engineering and should not be sold to the public. The Craigslist advertisement stated that the seller was a former member of the military and that he was selling the gear because he needed money. When we interviewed the seller, he claimed that, despite what he wrote in the Craigslist advertisement, the gear was not his. He said that he left the Marines in 2002 and that the suit was given to him by an acquaintance who was also a Marine. Upon further questioning about the origin of the gear, the seller stated that (1) he did not remember his acquaintance's first name; (2) his acquaintance had not been issued the gear either, obtaining it at what he called a "swap meet" and; (3) his acquaintance had recently died in a motorcycle accident. This property was likely stolen from DOD. We referred this matter to DCIS for criminal investigation. See figure 5 for a picture of the NBC gear (worn by a GAO investigator). Our May 2005 and July 2006 work identified two types of body armor that DOD's excess property system did not manage adequately--body armor vests and SAPIs. SAPIs are ceramic plates designed to slide into pockets sewn into the front and back of body armor vests in order to protect the warfighter's chest and back from small arms fire. They are currently used by service members in Iraq and Afghanistan. According to DCIS, service members are not authorized to sell body armor vests or SAPIs, and selling these items is considered theft of government property. Moreover, body armor vests and SAPIs are designated demil code D, meaning that DOD should destroy them when no longer needed. We purchased three body armor vests and seven SAPIs, including two current-issue E-SAPIs, on eBay and Craigslist. Because service members are not authorized to sell these items, we concluded that they were stolen from the military. See figure 6 for a picture of some of the stolen SAPIs and body armor vests we purchased. The availability of body armor and SAPIs to the general public has both national security and domestic safety implications. Regarding national security, reverse engineering could allow the creation of equivalent technology or the discovery of countermeasures based on potential weaknesses in the armor. On the domestic front, it is prohibited for violent felons to purchase, own, or possess body armor. Although sellers do not have a responsibility to determine whether they are selling body armor to a violent felon, and it is not illegal to do so, the wide availability of body armor online makes it easier for violent felons to break the law by obtaining body armor. The following case studies describe three of the four investigations we conducted into body armor we purchased online. Case #8: E-SAPI. On September 13, 2007, we purchased two new/unused body armor inserts identified as E-SAPIs from an eBay seller located in Arlington, Texas. This city is about 120 miles from Sheppard Air Force Base. The E-SAPI plates were manufactured in June 2007 and are currently used by U.S. service members in Iraq and Afghanistan. We determined that, from September 2006 to February 2008, the seller, who did not appear to be affiliated with the U.S. military, had completed eBay auctions of over 600 body-armor-related items totaling approximately $60,000. Much of the body armor appears to have been stolen from the military. In addition to domestic sales in the United States, the seller's eBay history indicates that the highest bidders on auctions for other body armor items were located overseas in such countries as China (Hong Kong), Poland, Taiwan, and Thailand. We referred this matter to DCIS for criminal investigation Case #9: Body Armor and SAPIs. On September 22, 2007, we purchased a used body armor vest and two SAPIs from a Craigslist seller located in Fayetteville, North Carolina. Our investigation determined that the seller is an active-duty Staff Sergeant in the U.S. Army stationed at Fort Bragg. We interviewed the Staff Sergeant about the purchase. He claimed that he purchased the body armor at a garage sale while he was stationed at Fort Stewart, Georgia. He could not recall the specific location of the sale or the name of the seller and said that he paid cash. He stated that he thought it was "OK" to sell body armor on Craigslist because he had seen other advertisements for it. This is another case of theft of government property, which we referred to DCIS for criminal investigation. Case #10: Body Armor and SAPIs. On March 30, 2007, we purchased a used body armor vest and two SAPIs from an eBay seller located in Minot, North Dakota. The seller lives near Minot Air Force Base. Our investigation determined that the seller was a Senior Airman with the Air Force Reserve. Further, we determined that the individual had completed eBay auctions for 18 body armor vests and SAPIs from June 2006 to April 2007 for a total of over $3,300. According to eBay records, an individual in Japan was the highest bidder in one of the auction rounds. After we referred this matter to Air Force OSI, we learned that the Minot Air Force Base security police and the county sheriff's office had investigated the matter and determined that the body armor was stolen from the base. According to Air Force OSI, this individual knew that the items were government property when he sold them on eBay. Our investigators also identified examples of U.S. government property-- both sensitive and nonsensitive--that was likely stolen and sold for personal profit rather than being utilized by DOD (i.e., conversion of government property). In addition to being cases of probable theft, these examples represent a waste of resources because DOD is effectively purchasing items that are subsequently not used for their intended purpose. We identified two civilian sellers with eBay store fronts who bought defense-related items from service members and sold these items to the general public on eBay. These items could have been stolen from the military. If these sellers knew the property they bought from the service members was stolen, they too would be violating the law. Gun-Store Owner. This eBay seller owns a gun store in Barstow, California. He lists U.S. military items on his eBay store front, including sensitive defense-related items such as Kevlar helmets and NBC gear. When we asked the seller to identify the source of the items listed on his eBay store front, he told us that military personnel frequently arrive at his shop with the items for sale. He gave us a record of the military items he had purchased from military personnel. For each sale, the gun-store owner obtained the signature of the seller and photocopied their identification card--in some cases, sellers provided him with their military IDs. We cross-matched the names of the individuals who sold items to the gun- store owner with the DEIDS database to determine whether any of the sellers were currently serving in the military. Table 5 contains details about selected service members who sold items to the gun-store owner and the nature of the items. We investigated this seller in 2005 in our report related to stolen MREs sold over eBay and referred him to the DOD Inspector General (IG) for review and criminal investigation. We have not received specific information from the DOD IG regarding their actions on this referral. We continue to believe this matter requires investigation and have made an additional referral to Army CID for criminal investigation. Military Surplus Store Owner. This eBay seller owns a military surplus store in Abilene, Texas. Our investigators visited the physical store location associated with the eBay store and observed a number of new ACUs with IR tabs affixed to them. As discussed above, IR tabs are an IFF element that can be detected at night by both ground troops and airborne combat pilots equipped with night vision equipment and represent one part of the military's night-fighting system. IR tabs on ACUs are demil code D. When our investigators pointed this out to the store owner, he said he was unaware of the restriction and removed the ACUs from the sales rack. The store owner said he purchased the ACUs from service members. He added that many of the items in his store were acquired from local military personnel who arrive, unannounced, at his shop with items for sale. He said that he maintains a record of transactions and provided a copy to our investigators. We cross-matched information on these individuals with the DEIDS database to determine whether any of the sellers were currently serving in the military. Table 4 contains details about selected service members who sold items to the store owner and the nature of the items. We referred this matter to Air Force OSI for criminal investigation. Military MREs are designed to sustain an individual engaged in strenuous activity, such as military training or actual military operations, when normal food service facilities are not available. In general, military MREs are boxed in cases of 12. Each MRE contains a full meal packet in a flexible bag. The cases and bags for military MREs are marked with the words "U.S. Government Property, Commercial Resale Is Unlawful." Although we do not consider MREs to be sensitive property, military MREs are procured by government entities using taxpayer dollars and are intended to be consumed by individuals from authorized organizations and activities. Consequently, if military MREs are sold to the general public on the Internet, they are clearly not reaching their intended recipients and represent a waste of taxpayer dollars. Since service members are not authorized to take MREs and sell them for personal gain, the vast majority of the military MREs for sale on the Internet represent stolen military property. During our investigation, we purchased numerous cases of MREs from eBay and Craigslist sellers. The sellers were mostly civilians. Three examples of our investigative work related to military MREs follows: One civilian seller in Louisiana indicated that she has been selling military MREs on eBay for a number of years. She said that she acquires the MREs from service members assigned to a nearby military base, and that they arrive at her home unannounced. She added that most of the service members have 2 or 3 MRE cases but that others have had as many as 10 to 12 cases. She told us that she does not know any of the service members or where they get the MREs, but suggested they are "left over" from field exercises. She said that she usually pays service members about $20 per case in cash and that she can sell the cases on eBay for about $55 per case. We reviewed eBay records and learned that, from September 2006 through February 2008, she completed eBay auctions totaling about $55,000 for MREs. These MREs were likely stolen from the nearby military base. We referred this case to Army CID for criminal investigation. A second seller living in Phenix City, Alabama, is employed as a civilian aircraft mechanic at Fort Benning, Georgia. She told us that she obtains military MREs from dumpsters at Fort Benning. She stated that she visits the dumpsters several times a week, removing unopened MREs from the dumpsters and cleaning, packaging, and mailing them to her eBay customers. According to sales data provided by eBay, from July 30, 2006, to February 6, 2008, this individual had completed approximately $54,000 in MRE auctions. Because of the volume of sales activity we referred this case to Army CID for criminal investigation. A third seller was a Private First Class in the U.S. Army stationed in Camp Casey, South Korea. Based on our referral, Army CID executed a search warrant at the seller's residence and discovered a substantial amount of stolen U.S. military property, as well as nearly $2,000 in cash. According to Army officials, the seller was charged with drug possession and use in the summer of 2006. He was demoted and placed in a supply clerk position in charge of MRE inventories while awaiting discharge from the military, which gave him the opportunity to steal MREs and sell them over eBay. Army CID linked the seller to a series of unsolved larcenies on base. The seller was sentenced to over 3 years in prison. Advertisements for the sensitive defense-related items we purchased were not removed by eBay and Craigslist Web site administrators, allowing us to complete the transactions. Both Web sites maintain published lists of items that are prohibited from sale, including stolen items, but only eBay contains warnings related to sensitive defense-related or export-controlled items even though both Web sites have an international reach. eBay employs administrative staff and investigative teams intended to deter fraud and prohibited sales from occurring on the site. Meanwhile, Craigslist has a smaller staff and largely relies on its user community for identifying inappropriate advertisements or postings. Officials with both Web sites told us they cooperate with law enforcement agencies to stop the sale of illegal, counterfeit, or stolen items, and identify and deter individuals from using these Internet services for a fraudulent or improper purpose. Generally, neither eBay nor Craigslist can incur criminal liability for being the conduit through which stolen or export-controlled items are sold, even if the items are sold overseas. Because the Web sites never take possession of the goods, do not set the price of transactions, and do not actually deliver the items, no relevant federal criminal statute applies to their activities. Table 5 summarizes the policies, proactive enforcement efforts, and penalties that each of these Internet companies maintain to deter the sale of prohibited items. Advertisements for the sensitive defense-related items we purchased were not removed by eBay administrators, allowing us to complete the transactions. According to its prohibited items list, eBay prohibits stolen property from being sold. eBay also provides extensive information about international trading on its prohibited items list, including a link to a government Web site on export controls. There are no explicit references to the sale of military MREs and other stolen military property on the prohibited items list. However, eBay does discuss a prohibition on defense-related items that have not been disposed in accordance with DOD demilitarization policies. According to an eBay official with whom we spoke, his company has created two teams that inspect user sales--the Fraud Investigations Team and the Prohibited Items Team. The Fraud Investigations Team deals directly with law enforcement organizations and provides information on sales or seller activity. We received invaluable assistance from the Fraud Investigations Team during our investigation. The official stated that the Fraud Investigations Team also proactively refers cases to relevant law enforcement agencies for further investigation and prosecution. Meanwhile, the Prohibited Items Team has an automatic filtering system to identify potentially prohibited sales and responds to reports on prohibited activity. If the Prohibited Items Team discovers a prohibited item, its mandate is to remove the advertisement for the item, educate the seller, and suspend the seller's account if the activity continues. When we asked the eBay official about the sale of military body armor on eBay, he admitted that it was a difficult issue for eBay because some body armor can be sold legally. He said that the Fraud Investigations Team does not scan eBay sales to try to identify what body armor is illegal to sell, e.g., body armor that has been stolen from the military. Regarding the sale of military MREs, the official stated that "nobody has indicated to us that it's illegal to sell MREs." To penalize users who violate eBay policies, eBay officials can cancel listings, limit account privileges, eliminate users' "Power Seller" status, and suspend accounts. Advertisements for the sensitive defense-related items we purchased were not removed by Craigslist administrators, allowing us to complete the transactions. Craigslist policies and procedures prohibit the sale of stolen property. However, its prohibited items list does not mention sensitive defense-related items, export controls, or international trading despite the fact that the Web site serves cities around the world. Further, there are no explicit references to the sale of military MREs and other stolen military property on the prohibited items list. Because these items are not included on the list, Craigslist officials and users are unlikely to prohibit these sales. Craigslist maintains a much smaller staff than eBay (25 people according to its Web site). When we asked a Craigslist manager about whether his company had a Fraud Investigations Team (FIT), he said, "I am the FIT for Craigslist." This official added that Craigslist relies primarily on its user community to identify suspicious advertisements and report prohibited item sales. We observed this in several cases during our investigation, when questionable advertisements for weapons and other obviously prohibited sales we identified were also apparently noticed by Craigslist users, leading to removal of the items from the Web site. The Craigslist official with whom we spoke indicated that Craigslist works with law enforcement agencies but does not proactively call issues to their attention. The official said that Craigslist deletes advertisements for questionable items, such as body armor and night vision goggles, when contacted by law enforcement. However, unlike eBay, Craigslist will not provide seller information to a law enforcement agency without a subpoena. To penalize users who do not comply with Craigslist policies, company officials can delete the user's account or otherwise attempt to prevent the user from accessing the site. For further information about this testimony, please contact Gregory D. Kutz at (202) 512-6722 or kutzg@gao.gov. Major contributors to this testimony include Mario Artesiano, Johana Ayers, Nabajyoti Barkakati, Norman Burrell, Shafee Carnegie, Bruce Causseaux, Thomas Denomme, Dennis Fauber, Richard Guthrie, Kenneth Hill, Jason Kelly, Barbara Lewis, Andrew McIntosh, James Murphy, Gertrude Moreland, and Richard Newbold. This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.

Summary:
Unauthorized individuals, companies, terrorist organizations, and other countries continue their attempts to obtain sensitive items related to the defense of the United States. The Internet is one place that defense-related items can be purchased, raising the possibility that some sensitive items are available to those who can afford them. In addition to the risk that sensitive defense-related items could be used to directly harm U.S. service members or allies on the battlefield, these items could be disassembled and analyzed (i.e., reverse engineered) to develop countermeasures or equivalent technology. Given the risks posed by the sale of sensitive defense-related items to the public, and the Internet's international reach and high volume of commerce, the Subcommittee asked GAO to conduct undercover testing to determine whether the general public can easily purchase these items on the Internet, including on the Web sites eBay and Craigslist. To perform this work, GAO investigators used undercover identities to pose as members of the general public, meaning that they conducted their work with names, credit cards, and contact information that could not be traced to GAO. Investigators interviewed sellers where possible and referred cases to the appropriate law enforcement entities for further investigation. GAO found numerous defense-related items for sale to the highest bidder on eBay and Craigslist. A review of policies and procedures for these Web sites determined that there are few safeguards to prevent the sale of sensitive and stolen defense-related items using the sites. During the period of investigation, GAO undercover investigators purchased a dozen sensitive items on eBay and Craigslist to demonstrate how easy it was to obtain them. Many of these items were stolen from the U.S. military. According to the Department of Defense (DOD), it considers the sensitive items GAO purchased to be on the U.S. Munitions List, meaning that there are restrictions on their overseas sales. However, if investigators had been members of the general public, there is a risk that they could have illegally resold these items to an international broker or transferred them overseas. GAO investigators also identified examples of U.S. government property that was stolen and sold for a profit rather than being utilized by DOD. For example, GAO found two civilian store owners who acted as conduits for defense-related property that was likely stolen from the military. The store owners told GAO they purchased gear from service members--including Kevlar vests, flak jackets, and gas masks--and sold it through eBay to the general public. GAO also purchased stolen military meals, ready-to-eat (MRE) and found a robust market for stolen military MREs on eBay and Craigslist. Advertisements for the sensitive defense-related items GAO purchased were not removed by Web site administrators, allowing investigators to buy the items. Both Web sites maintain lists of items that are prohibited from sale, including stolen items, but only eBay contains warnings related to overseas sales and the improper sale of sensitive defense-related items.