The U.S. government has a myriad of laws, regulations, policies, and processes intended to identify and protect critical technologies so they can be transferred to foreign parties in a manner consistent with U.S. national security, foreign policy, and economic interests. Advanced weapons and militarily useful technologies are sold by U.S. companies for economic reasons and by the U.S. government for foreign policy, security, and economic reasons. Yet, the technologies that underpin U.S. military and economic strength continue to be targets for theft, espionage, reverse engineering, and illegal exports. As a result, the safety net of programs, many which were put in place decades ago, not only has to protect critical technologies but it also has to do so in a manner that allows legitimate trade with allies and other friendly nations. The U.S. export control system for defense-related items involves multiple federal agencies and is divided between two regulatory bodies--one managed by State for arms and another managed by Commerce for dual- use items (see table 1). State's and Commerce's implementing regulations contain lists that identify the items and related technologies each department controls and establish requirements for exporting those items. Exporters are responsible for determining which department controls the items they seek to export and what the regulatory requirements are for export. The two departments' controls differ in several key areas. In most cases, Commerce's controls over dual-use items are less restrictive than State's controls over arms. Many items controlled by Commerce do not require licenses for export to most destinations, while State-controlled items generally require licenses for most destinations. Also, some sanctions and embargoes only apply to items on State's U.S. Munitions List and not to those on the Commerce Control List. For example, Commerce-controlled items may be exported to China while arms exports to China are generally prohibited. Even when items are exempt from licensing requirements, they are still subject to U.S. export control laws. Responsibility for enforcing those laws and their associated regulations largely rests with various agencies within Commerce, Homeland Security, Justice, and State. These enforcement agencies conduct a variety of activities, including inspecting items to be exported, investigating potential export control violations, and pursuing and imposing the appropriate penalties. Punitive actions, which are either criminal or administrative, can be taken against violators of export control laws and regulations. Justice can prosecute criminal cases, where the evidence shows that the exporter willfully and knowingly violated export control laws. Prosecutions can result in imprisonment, fines, and other penalties. State or Commerce can impose fines, suspend export licenses, or deny export privileges for administrative violations. Reviews of export license applications require time to deliberate and ensure that license decisions are appropriate. Such reviews, though, should not be unnecessarily delayed due to inefficiencies or be eliminated for efficiency's sake--both of which could have unintended consequences for U.S. security, foreign policy, and economic interests. However, State and Commerce have not managed their respective export licensing processes to ensure their efficient operation. As we have previously reported, inefficiencies have contributed to increases in State's processing times for license applications and related cases and its inability to keep pace with a growing workload. State's processing times for arms export cases began increasing in fiscal year 2003--with median processing times nearly doubling from 14 days to 26 days by fiscal year 2006 (see fig. 1). During this period, State's workload increased by 20 percent, from about 55,000 to 65,000 cases. State was unable to keep pace with this growing number of cases, which resulted in a significant number of open cases awaiting review and final action. At the end of fiscal year 2006, this so called "backlog" reached its peak at over 10,000 open cases, prompting State to undertake extraordinary measures--such as extending work hours and canceling training and industry outreach--to reduce the number of open cases. However, such measures were not sustainable and did not address underlying inefficiencies. Concerns were also raised that these measures could have the unanticipated effect of shifting the focus from the mission of protecting U.S. interests to simply closing cases to reduce the number of open cases. At the time of our 2007 review, we found that State had not analyzed licensing data to identify inefficiencies and develop sustainable solutions to manage its review process and more effectively structure its workforce. Through our extensive analysis of State's data, we determined that the overall trend of increased processing times and open cases was attributable to several factors, including procedural weaknesses, problems with its new electronic processing system, and human capital challenges, many of which had gone unnoticed and unaddressed by State. Procedural Weaknesses: State lacked screening procedures to promptly identify those cases needing interagency review. As a result, cases often languished for weeks in a queue awaiting assignment or initial review before being referred to another agency, such as Defense, for further review. State also lacked procedures to expedite certain cases. We found that processing times in fiscal year 2006 for exports to the United Kingdom and Australia, which by law were to be expedited, did not differ significantly from processing times for other allied countries. Similarly, processing time goals for applications in support of Operations Iraqi Freedom and Enduring Freedom were not being met. Electronic Processing Problems: State officials have cited D- Trade--its new automated system for processing cases--as the most significant effort to improve efficiency. However, State's implementation of D-Trade has been problematic and has not been the promised panacea for improving processing times. Our analysis showed that there was no significant difference in processing times for similar cases whether they were submitted via D-Trade or the traditional paper-based system. State relied on this automated solution without reengineering the underlying processes or developing tools to facilitate the licensing officer's job. For example, D-Trade has limited capabilities to reference precedent cases that would allow licensing officers to leverage work previously done on similar cases, which could not only help to expedite the processing of a case but could also ensure greater consistency among similar cases. Further, D-Trade experienced performance problems that State officials attributed to poorly defined requirements and a rush to production. For example, because of a glitch in January 2007, 1,300 cases received during a 3-day period had to be resubmitted by exporters, which resulted in rework. Human Capital Challenges: State has also faced human capital challenges in establishing and retaining a sufficient workforce with the experience and skills needed to efficiently and effectively process arms export cases. For example, the number of licensing officers on board was at the same level in fiscal years 2003 and 2006, despite an almost 20 percent increase in cases over that period. As a point of comparison, in fiscal year 2005, State had 31 licensing officers who closed approximately 63,000 cases while Commerce had 48 licensing officers who closed approximately 22,000 cases. Additionally, Defense had not been providing State with its full complement of detailed military officers, who are generally assigned to review complex agreements. State officials have acknowledged that more work was falling on fewer experienced staff. According to these officials, in the summer of 2006, about half of State's licensing officers had less than a year of experience, and many lacked the authority needed to take final action on cases. These findings prompted us to recommend that State conduct analyses of its licensing data to assess root causes of inefficiencies and then identify and implement actions that would allow it to better manage its workload, reexamine its processes, and determine the most effective workforce structure. We are encouraged to learn that, under the direction of new leadership responsible for managing the arms export control system, State has recently committed to implementing these recommendations and taking actions to address the issues we identified. Specifically, State has informed us that it (1) has implemented procedures to more quickly determine whether cases should be referred to other agencies or State bureaus for review and instituted senior level reviews of cases that are over 60 days old, (2) is planning future D-Trade upgrades that are expected to facilitate case reviews by licensing officers and allow managers to better oversee the processes, and (3) has restructured its licensing divisions to ensure a more equitable distribution in the workload and skill level of licensing officers based on our analysis. While these recently reported actions are encouraging, we have not yet examined them to determine their effects. Concerns about efficiency have largely focused on State's processing of applications for arms exports, in part, because few dual-use exports subject to Commerce's controls require licenses. In 2005, for example, 98.5 percent of dual-use exports, by dollar value, were not licensed. While few dual-use exports are licensed, the number of license applications processed by Commerce has increased in recent years--increasing by over 50 percent from fiscal years 1998 through 2005. During that time period, Commerce's overall median processing times have remained stable, around 40 days, and are consistent with time frames established by a 1995 executive order. However, the overall efficiency of Commerce's licensing process is unknown in part because Commerce lacks efficiency-related measures and analyses that would allow it to identify opportunities for improvement. For example, to determine the efficiency of its license application review process, Commerce only measures its performance in terms of how long it takes to refer an application to another agency for review. Commerce does not have efficiency-related measures for other steps in its review process, such as how quickly a license should be issued once other agencies provide their input, or for the entire process. During the course of our prior reviews, Commerce did not provide us with evidence that would indicate it has undertaken analyses of licensing data to determine if previously established time frames are still appropriate or to identify the drivers of its workload or the bottlenecks in its processes that would allow it to implement actions to improve efficiency. Since multiple departments have a role to play in the export control system, its effective operation depends on those departments working together. However, we have identified instances related to export control jurisdiction, the use of license exemptions, and the dissemination of enforcement information when poor coordination among the departments has created vulnerabilities in the system's ability to protect U.S. interests. The departments have taken action to address some--but not all--of these vulnerabilities. Given the different restrictions State and Commerce have on the items subject to their controls, the determination of which items fall under State's export jurisdiction and which fall under Commerce's is fundamental to the U.S. export control system. However, we have previously reported that State and Commerce have disagreed on which department has jurisdiction over certain items. In some cases, both departments have claimed jurisdiction over the same items, which was the case for certain missile-related technologies. In another case, for example, Commerce improperly determined that explosive detection devices were subject to Commerce's less restrictive export control requirements when they were, in fact, State-controlled. Such jurisdictional disagreements and problems are often the result of minimal or ineffective coordination between the two departments and the departments' differing interpretations of the regulations. Despite our recommendations to do so, the two departments have not yet come together to resolve these jurisdictional disputes or develop new processes to improve coordination. Until these disagreements and coordination problems are resolved, exporters--not the government--will continue to determine which restrictions apply and, therefore, the type of governmental review that will occur. Not only does this create an unlevel playing field and competitive disadvantage--because some companies may gain access to markets that others will not--but it also increases the risk that critical items will be exported without the appropriate review and resulting protections. Even when jurisdiction over an export-controlled item is clearly established, there is not always agreement among the departments on when an export license is required. While State generally requires a license for most arms exports, its regulations exempt exports that meet specific criteria from licensing requirements. For a limited number of licensing exemptions, Defense may confirm that the export qualifies for the use of an exemption in support of Defense activities, such as sharing of technical data related to defense acquisition programs and defense cooperative agreements with allies and friendly nations. However, our work revealed that State and Defense had different interpretations of the exemptions and what exports could be certified by Defense. For example, State officials maintained that one exemption was only for use by U.S. government personnel, while Defense officials stated it was available for use by contractors working in direct support of Defense activities. For approximately 4 years, the lack of a common understanding of the exemption created a vulnerability as regulations and licensing requirements could have been inconsistently applied. Further, we found that State and Defense lacked comprehensive data to oversee the use of these exemptions. Such data would allow the departments to identify and assess the magnitude of transfers certified for exemption use. Specifically, Defense's 2006 annual report to State on the use of the exemptions provided data on 161 certifications, but we identified 271 additional certifications that were not included in Defense's report because they were not entered into a centralized Defense database. We understand that, in response to our recommendation, State and Defense established a working group and recently reached agreement to resolve the issues identified in our report. When an exporter applies for a license, both State and Commerce are to consider whether the parties to the proposed export are eligible to sell or receive controlled items and technologies. Individuals or companies indicted or convicted of violating various laws may be denied from participating in proposed exports. Therefore, information on criminal export control prosecution outcomes should help inform the export control process by providing State and Commerce with a complete picture of the individual or company seeking an export license. Prosecuting export cases can be difficult, since securing sufficient evidence to prove the exporter intentionally violated export control laws can represent unique challenges, especially when the item being exported is exempted from licensing or the case requires foreign cooperation. We reported in 2006 that while Justice and the other enforcement agencies have databases that capture information on their enforcement activities, the outcomes of criminal cases were not consistently shared with State and Commerce. Instead State and Commerce relied on informal processes to obtain information on indictments and convictions, which created gaps in their knowledge. For example, we found that the watchlist used by Commerce to screen applications was incomplete as it did not contain 117 companies and individuals that had committed export control violations. Prompted by our recommendation, Justice began providing State and Commerce with quarterly reports on criminal enforcement actions so that such information can be considered upfront during the license application review process. To adapt to the accelerating pace of change in the global security, economic, and technological environment, federal programs need to systematically reassess priorities and approaches and determine what corrective actions may be needed to fulfill their missions. For example, to meet the challenges of the 21st century, agency leaders need to reexamine their programs, asking questions related to their program's relevance and purpose, how success should be measured, and whether they are employing best practices. Given the two departments' missions of controlling defense-related exports while allowing legitimate trade, State and Commerce should not be exceptions to this basic management tenet. Although dramatic changes have occurred in the security and economic environment since the start of the 21st century, State and Commerce have not conducted systematic assessments to determine whether their controls and processes are sufficient and appropriate or whether changes are needed to better protect U.S. interests. Despite providing us with no basis for their positions and the existence of known vulnerabilities, both departments informed us that no fundamental changes to their respective systems were needed. Earlier this year, the President signed a package of directives that, according to the White House, will ensure that U.S. export control policies and practices support national security while facilitating economic and technological leadership. Relatively few details about the directives or the basis for particular initiatives have been publicly released, though they reportedly incorporate recommendations provided by industry. We have not had an opportunity to review the specifics of the directives, how they were formulated, or how they will be implemented. Legislation has also been introduced to make changes to the export control system. While we have not had an opportunity to evaluate the new directives, a note of caution may be drawn from our work regarding a prior set of initiatives that were also designed to improve the export control system. In 2000, the Defense Trade Security Initiatives (DTSI), which was characterized as the first major post-Cold War revision to the U.S. export control system, was unveiled. DTSI was comprised of 17 different initiatives developed by State and Defense to expedite and reform the U.S. export control system. At the time, we determined that no analysis of the problems that the initiatives were intended to remedy or demonstration of how they would achieve identified goals had been conducted. It turned out that the justifications for the initiatives was, in part, based on anecdotes that were factually incorrect or only told part of the story. In one example cited by Defense, the lengthy processing time for an export license caused a foreign firm to cancel its contract with a U.S. aerospace company, but upon closer examination, we learned that U.S. government had denied the license because of concerns regarding the foreign firm's ties with the Chinese military. Because there was little assurance that DTSI would result in improvements to the system, we were not surprised during our subsequent work when we found that the initiatives had generally not been successful. For example, D-Trade was one of the initiatives, but as already discussed, its anticipated efficiencies have not yet been realized. Additionally, processing time goals established in DTSI for applications to assist allies in increasing their military capabilities have not been met. Other initiatives have not been widely used by exporters. For example, we reported that between 2000 and 2005, State had only received three applications for comprehensive export authorizations for a range of exports associated with multinational defense efforts, including the Joint Strike Fighter. According to Defense and contractor officials, while such authorizations were intended to lessen the administrative burden and improve processing times for routine export authorizations, companies have opted not to use them because of the extra costs associated with their compliance requirements. The government's safety net of programs is intended to protect critical technologies while still allowing legitimate trade. Therefore, the components of that system must address known vulnerabilities and be able to adapt to a changing global environment if they are to individually and collectively protect and promote U.S. national security, foreign policy, and economic interests. Our past work demonstrates that State and Commerce have not managed the export control system to better ensure its overall effectiveness in protecting U.S. interests. Recent actions taken by the departments to begin addressing some of the management issues and vulnerabilities identified in our prior reports are encouraging. However, other recommendations, most notably those related to export control jurisdiction, remain unimplemented. While the implementation of our recommendations is an important first step for improving the efficiency and effectiveness of the export control system, a sustained commitment on the part of the departments to engage in a continuous process of evaluation, analysis, and coordination is needed. It is only then that meaningful and sustainable improvements to the export control system can be developed and implemented to ensure the efficiency and effectiveness of the system in protecting U.S. interests. Mr. Chairman this concludes my statement. I would be happy to answer any questions you or other members of the subcommittee may have. For questions regarding this testimony, please contact me at (202) 512- 4841 or calvaresibarra@gao.gov. Johana R. Ayers, Assistant Director; Marie Ahearn, Jennifer Dougherty, Karen Sloan, and Anthony Wysocki made key contributions to this statement. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this statement. Defense Trade: State Department Needs to Conduct Assessments to Identify and Address Inefficiencies and Challenges in the Arms Export Process. GAO-08-89. Washington, D.C.: November 30, 2007. Defense Trade: Clarification and More Comprehensive Oversight of Export Exemptions Certified by DOD Are Needed. GAO-07-1103. Washington, D.C.: September 19, 2007. Export Controls: Vulnerabilities and Inefficiencies Undermine System's Ability to Protect U.S. Interests. GAO-07-1135T. Washington, D.C.: July 26, 2007. High Risk Series: An Update. GAO-07-310. Washington, D.C.: January 2007. Export Controls: Challenges Exist in Enforcement of an Inherently Complex System. GAO-07-265. Washington, D.C.: December 20, 2006. Analysis of Data for Exports Regulated by the Department of Commerce. GAO-07-197R. Washington, D.C.: November 13, 2006. Export Controls: Agencies Should Assess Vulnerabilities and Improve Guidance for Protecting Export-Controlled Information at Universities. GAO-07-70. Washington, D.C.: December 5, 2006. Export Controls: Agencies Should Assess Vulnerabilities and Improve Guidance for Protecting Export-Controlled information at Companies. GAO-07-69. Washington, D.C.: December 5, 2006. Defense Technologies: DOD's Critical Technologies Lists Rarely Inform Export Control and Other Policy Decisions. GAO-06-793. Washington, D.C.: July 28, 2006. Export Controls: Improvements to Commerce's Dual-Use System Needed to Ensure Protection of U.S. Interests in the Post-9/11 Environment. GAO-06-638. Washington, D.C.: June 26, 2006. Defense Trade: Arms Export Control Vulnerabilities and Inefficiencies in the Post-9/11 Environment. GAO-05-468R. Washington, D.C.: April 7, 2005. 21st Century Challenges, Reexamining the Base of the Federal Government. GAO-05-325SP. Washington, D.C.: February 2005. Defense Trade: Arms Export Control System in the Post-9/11 Environment. GAO-05-234. Washington, D.C.: February 16, 2005. Nonproliferation: Further Improvements Needed in U.S. Efforts to Counter Threats from Man-Portable Air Defense Systems. GAO-04-519. Washington, D.C.: May 13, 2004. Nonproliferation: Improvements Needed to Better Control Technology Exports for Cruise Missiles and Unmanned Aerial Vehicles. GAO-04-175. Washington, D.C.: January 23, 2004. Export Controls: Post-Shipment Verification Provides Limited Assurance That Dual-Use Items Are Being Properly Used. GAO-04-357. Washington, D.C.: January 12, 2004. Joint Strike Fighter Acquisition: Cooperative Program Needs Greater Oversight to Ensure Goals Are Met. GAO-03-775. Washington, D.C.: July 21, 2003. Defense Trade: Better Information Needed to Support Decisions Affecting Proposed Weapons Transfers. GAO-03-694. Washington, D.C.: July 11, 2003. Nonproliferation: Strategy Needed to Strengthen Multilateral Export Control Regimes. GAO-03-43. Washington, D.C.: October 25, 2002. Export Controls: Processes for Determining Proper Control of Defense- Related Items Need Improvement. GAO-02-996. Washington, D.C.: September 20, 2002. Export Controls: Department of Commerce Controls over Transfers of Technology to Foreign Nationals Need Improvement. GAO-02-972. Washington, D.C.: September 6, 2002. Export Controls: More Thorough Analysis Needed to Justify Changes in High Performance Computer Controls. GAO-02-892. Washington, D.C.: August 2, 2002. Export Controls: Rapid Advances in China's Semiconductor Industry Underscore Need for Fundamental U.S. Policy Review. GAO-02-620. Washington, D.C.: April 19, 2002. Defense Trade: Lessons to Be Learned from the Country Export Exemption. GAO-02-63. Washington, D.C.: March 29, 2002. Export Controls: Issues to Consider in Authorizing a New Export Administration Act. GAO-02-468T. Washington, D.C.: February 28, 2002. Export Controls: Reengineering Business Processes Can Improve Efficiency of State Department License Reviews. GAO-02-203. Washington, D.C.: December 31, 2001. Export Controls: Clarification of Jurisdiction for Missile Technology Items Needed. GAO-02-120. Washington, D.C.: October 9, 2001. Export Controls: State and Commerce Department License Review Times are Similar. GAO-01-528. Washington, D.C.: June 1, 2001. Export Controls: Regulatory Change Needed to Comply with Missile Technology Licensing Requirements. GAO-01-530. Washington, D.C.: May 31, 2001. Defense Trade: Analysis of Support for Recent Initiatives. GAO/NSIAD-00-191. Washington, D.C.: August 31, 2000. Defense Trade: Status of the Department of Defense's Initiatives on Defense Cooperation. GAO/NSIAD-00-190R. Washington, D.C.: July 19, 2000. Export Controls: Better Interagency Coordination Needed on Satellite Exports. GAO/NSIAD-99-182. Washington, D.C.: September 17, 1999. Export Controls: Change in Export Licensing Jurisdiction for Two Sensitive Dual-Use Items. GAO/NSIAD-97-24. Washington, D.C.: January 14, 1997. This is a work of the U.S. government and is not subject to copyright protection in the United States. It may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.

Summary:
In controlling the transfer of weapons and related technologies overseas, the U.S. government must limit the possibility of sensitive items falling into the wrong hands while allowing legitimate trade to occur. Achieving this balance has become more challenging due to redefined security threats and a globalized economy. The export control system is a key component of the safety net of programs intended to balance multiple U.S. interests. The export control system is managed primarily by the State Department, which regulates arms exports, and the Commerce Department, which regulates dual-use exports that have military and civilian applications. Unless an exemption applies, arms exports require licenses, while many dual-use exports do not require licenses. Based on GAO's extensive body of work on the export control system, this testimony focuses on export licensing inefficiencies, poor interagency coordination, and limits in State's and Commerce's ability to provide a sound basis for changes to the system. In prior work, GAO made recommendations to address vulnerabilities in the export control system, but many have not been implemented. Because of these vulnerabilities and others identified in the larger safety net of programs, GAO has designated the effective protection of technologies critical to U.S. national security interests as a high risk area warranting strategic reexamination. State and Commerce have not managed their respective export licensing processes to ensure their effective operations. In November 2007, GAO reported that procedural and automation weaknesses, along with workforce challenges, created inefficiencies in State's arms export licensing process. In less than 4 years, median processing times for license applications nearly doubled, with State's backlog of open cases peaking at 10,000. According to State officials, the department has begun analyzing its licensing data and implementing actions that will allow it to better manage its workload and determine the most effective workforce structure. While Commerce's license application processing times for dual-use exports have remained relatively stable, the overall efficiency of its process is unknown. This is due in part to Commerce's lack of performance measures for all steps in its process and analyses that would allow it to identify opportunities for improvement. Poor coordination among State, Commerce, and the other departments involved in the export control system has created vulnerabilities. State and Commerce have disagreed on which department has jurisdiction over the export of certain items. In one case, Commerce determined that an item was subject to its less restrictive export requirements when, in fact, it was State-controlled. Such improper determinations and unclear jurisdiction not only create an unlevel playing field--because some companies may gain access to markets that others will not--it also increases the risk that sensitive items, such as missile-related technologies, will be exported without the appropriate review and resulting protections. Further, State and Defense took almost 4 years to reach agreement regarding when certain arms export licensing exemptions could be used by exporters in support of Defense-certified programs. This lack of agreement could have resulted in export requirements being applied inconsistently. Also, in response to a GAO recommendation, State and Commerce only recently began regularly receiving information on criminal enforcement actions--information that is important to consider upfront when reviewing license applications for approval. Despite dramatic changes in the security and economic environment, State and Commerce have not undertaken basic management steps to ensure their controls and processes are sufficient and appropriate for protecting U.S. interests. Notably, neither department has assessed its controls in recent years. Nevertheless, State and Commerce maintained that no fundamental changes to their export control system were needed. Earlier this year, the White House announced that the President signed directives intended to ensure that the export control system focuses on meeting security and economic challenges. Similarly, legislation to make changes to the export control system has been introduced. However, few details about the basis for these initiatives are known. In the past, GAO has found that export control initiatives not grounded in analyses have generally not resulted in the desired improvements to the system.