The sale or transfer of U.S. defense items to friendly nations and allies is an integral component of both U.S. national security and foreign policy. The U.S. government authorizes the sale or transfer of military equipment, including spare parts, to foreign countries either through government-to-government agreements or through direct sales from U.S. manufacturers. The Arms Export Control Act and the Foreign Assistance Act of 1961 authorize the DOD foreign military sales program. From 1993 through 2002, DOD delivered over $150 billion worth of services and defense articles to foreign countries through foreign military sales programs administered by the military services. The articles sold include classified and controlled cryptographic spare parts. The Department of State sets overall policy concerning which countries are eligible to participate in the DOD foreign military sales program. DOD identifies military technology that requires control when its transfer to potential adversaries could significantly enhance a foreign country’s military or war-making capability. Various agencies such as the Department of State and DOD are responsible for controlling, in part, the transfer or release of military technology to foreign countries. The Defense Security Cooperation Agency, under the direction of the Under Secretary of Defense for Policy, has overall responsibility for administering the foreign military sales program, and the military services generally execute the sales agreements with the individual countries. A foreign country representative initiates a request by sending a letter to DOD asking for such information as the price and availability of goods and services, training, technical assistance, and follow-on support. Once the foreign customer decides to proceed with the purchase, DOD prepares a Letter of Offer and Acceptance stating the terms of the sale for the items and services to be provided. After this letter has been accepted, the foreign customer is generally required to pay, in advance, the amounts necessary to cover the costs associated with the services or items to be purchased from DOD and then is allowed to request spare parts through DOD’s supply system. Generally, the military services use separate automated systems to process requisitions from foreign countries for spare parts. While the Air Force has retained responsibility for its system, responsibility for the Army’s and the Navy’s systems was transferred to the Defense Security Assistance Development Center in October 1997. The Center, which is part of the Defense Security Cooperation Agency, has overall responsibility for providing system information technology maintenance support, such as testing the system. For blanket orders, the systems use various codes and item identifiers to restrict the spare parts available to the countries. In cases where the systems validate a requisition, the requisition is sent to a supply center to be filled and shipped. In cases where the systems reject a requisition, the requisition is sent to a country manager for review. The country manager will either validate the requisition and forward it to the supply center to be filled and shipped or reject the requisition, in which case the requisition is canceled. Our reviews showed that the Army, the Navy, and the Air Force were not testing their automated systems to ensure that the systems were accurately reviewing and approving blanket order requisitions for compliance with restrictions and operating in accordance with foreign military sales policies. Our tests of the services’ automated systems used to manage foreign countries’ requisitions for spare parts made through blanket orders showed that classified and controlled spare parts that the services did not want released were being released to countries. For example, we identified 5 out of 38 blanket order requisitions for which the Navy’s system approved and released 32 circuit card assemblies’ controlled cryptographic spare parts to foreign countries. According to Defense Security Assistance Development Center officials, who are responsible for this portion of the Navy’s system, the system was not programmed to review the controlled cryptographic items codes, and as a result, the system automatically approved and released the parts requested by the foreign countries. Navy and DOD officials were unaware that the system was not reviewing controlled cryptographic parts prior to their release to foreign countries. For another example, the Air Force’s system used controls that were based on supply class restrictions and that were ineffective and resulted in erroneously approving requisitions for shipment. Included in an item’s national stock number is a four-digit federal supply class, which may be shared by thousands of items. The national stock number also contains a nine-digit item identification number that is unique for each item in the supply system. We found that countries requisitioning parts under the Air Force’s system could obtain a classified or controlled spare part by using an incorrect, but unrestricted, supply class with an item’s correct national item identification number. The Air Force was unaware of this situation until our test of the system identified the problem. In response to our work, the Air Force corrected the problem. GAO’s internal control standards require periodic testing of new and revised software to ensure that it is working correctly, while the Office of Management and Budget’s internal control standards require periodic reviews to determine how mission requirements might have changed and whether the information systems continue to fulfill ongoing and anticipated mission requirements. The importance of testing and reviewing systems to ensure that they are operating properly is highlighted in the Federal Information Security Management Act of 2002. The act requires periodic testing and evaluation of the effectiveness of information security controls and techniques. Moreover, the act requires agencies, as part of their information security program, to include a process for planning, implementing, evaluating, and documenting remedial actions to address deficiencies. Under guidance from the Office of Management and Budget, agencies are to develop a Plan of Actions & Milestones to report on the status of remediation efforts. This plan is to list information security weaknesses, show estimated resource needs or other challenges to resolving them, key milestones and completion dates, and the status of corrective actions. In commenting on our prior reports, DOD either concurred or partially concurred with our recommendations for testing the services’ requisition- processing systems. The department, however, does not have a plan specifying the remedial actions to be taken to implement these recommendations. If actions are not taken to implement testing and reviews, the potential benefits of these controls in preventing the inadvertent release of classified or controlled spare parts may not be realized. Regarding our recommendation to periodically test the Army’s system, DOD concurred and stated that testing of the Army system and its logic would occur, given the funding and guidance required to do so. In response to our recommendation to periodically test the Navy’s system, DOD concurred. Concerning our recommendation to periodically test the Air Force’s system, DOD partially concurred and stated that a program was being developed to test new modifications to the Air Force’s system and that testing of old modifications would be an ongoing effort. Testing only the modifications to the Air Force’s system, as DOD commented, will not necessarily ensure that the system’s logic is working correctly. Subsequently, the Air Force concurred with our recommendation and reported that it had modified its system and would be conducting annual tests of the system’s logic. The Defense Security Cooperation Agency and the military services are developing a new automated system, the Case Execution Management Information System, to process foreign military sales requisitions. The new system will replace the services’ existing legacy systems with a standard DOD system. DOD expects to deploy the new system in fiscal year 2007. Internal control standards requiring testing will be applicable to the new system. Our reviews showed that the Navy’s and the Air Force’s systems allowed country managers, who are responsible for managing the sale of items to foreign countries, to override system decisions not to release to foreign countries classified or controlled parts that are requisitioned under blanket orders. We identified instances where Navy and Air Force country managers overrode the systems’ decisions without documenting their reasons for doing so. For example, of the 123 Air Force requisitions we reviewed, the Air Force’s system identified 36 requisitions for country manager review. For 19 of the requisitions, the managers overrode the system’s decisions and shipped classified and controlled spare parts without documenting their reasons for overriding the system. The managers we queried could not provide an explanation for overriding the system. In 1999, the Army modified its system to reject requisitions that are made under blanket orders for classified or controlled parts. As a result, Army country managers were precluded from manually overriding the Army system’s decisions. Compared with the Navy’s and the Air Force’s systems, the Army’s system provides more stringent protection against releasing classified or controlled parts that are not authorized for release under blanket orders to foreign countries. Preventing the inadvertent release of classified and controlled spare parts that are not authorized for release under blanket orders to foreign countries deserves the highest level of management attention. The preemptive nature of testing and reviewing systems allows this internal control to identify system weaknesses prior to the inadvertent release of classified or controlled spare parts. Had the services conducted periodic tests of their systems, the instances of releasing spare parts that DOD did not want released that we identified in our reports could have been significantly reduced, if not eliminated. Developing effective corrective action plans is key to ensuring that remedial action is taken to address significant information-system internal control deficiencies. We believe the department could demonstrate its commitment to addressing this systemic weakness by providing specific information on its planned remedial actions. Documenting country managers’ decisions to override system decisions is a control that could help prevent the release of classified or controlled parts that are not authorized for release under blanket orders to a foreign country. However, modifying systems, as the Army did, to reject requisitions that are made under blanket orders for classified or controlled parts and to preclude country managers from manually overriding system decisions would provide more stringent protection against releasing classified or controlled parts that are not authorized for release under blanket orders to a foreign country. To reduce the likelihood of releasing classified and controlled spare parts that DOD does not want to be released to foreign countries, we recommend that you take the following three actions: Direct the Under Secretary of Defense for Policy, in conjunction with the Secretaries of the Army and the Navy, and direct the Secretary of the Air Force to develop an implementation plan, such as a Plan of Actions & Milestones, specifying the remedial actions to be taken to ensure that applicable testing and review of the existing requisition-processing systems are conducted on a periodic basis. Direct the Under Secretary of Defense for Policy, in conjunction with the Secretaries of the Army, the Air Force, and the Navy, to determine whether current plans for developing the Case Execution Management Information System call for periodic testing and, if not, provide for such testing. Direct the Under Secretary of Defense for Policy, in conjunction with the Secretary of the Navy, and direct the Secretary of the Air Force to determine if it would be beneficial to modify the Navy’s and the Air Force’s requisition-processing systems so that the systems reject requisitions for classified or controlled parts that foreign countries make under blanket orders and preclude country managers from manually overriding system decisions, and to modify their systems as appropriate. The Director of the Defense Security Cooperation Agency provided written comments on a draft of this report for DOD and partially concurred with one recommendation and concurred with two recommendations. DOD partially concurred with our recommendation to develop a Plan of Actions & Milestones specifying the remedial actions to be taken to ensure that applicable testing and review of the existing requisition- processing systems is conducted on a periodic basis. DOD stated that the services have made appropriate changes to their systems in response to our prior reports and routine maintenance and have tested the applications accordingly. DOD also stated that, in lieu of a formal Plan of Actions & Milestones, the military services, in concert with DOD, can institute a practice of testing the applications on an annual basis, if those applications are not otherwise changed and tested as a matter of routine maintenance, to satisfy the requirement for periodic testing. We agree that alternatives to a formal Plan of Actions & Milestones may address the needed remedial actions. However, we believe any alternative should specify the remedial actions to be taken to ensure that applicable testing and review of the existing requisition-processing systems are conducted on a periodic basis, and we have modified our recommendation accordingly. DOD concurred with our recommendation regarding the Case Execution Management Information System. DOD stated that the system’s software program testing will adhere to software-testing standards in place at the time of implementation, including testing to ensure that the functionality of existing software code is not changed when the coding is modified or enhanced. DOD also concurred with our recommendation to determine if it would be beneficial to modify the Navy’s and the Air Force’s requisition-processing systems so that the systems reject requisitions for classified or controlled parts that foreign countries make under blanket orders and preclude managers from manually overriding system decisions, and to modify their systems as appropriate. DOD stated that it will review the Navy’s and the Air Force’s business processes, as well as the requisition-processing systems. DOD noted that a better option may be to mandate that country managers seek the appropriate waivers in accordance with DOD policy to allow the release of a classified or controlled spare part under a blanket order; provide sufficient documentation for doing so; and make sure it is done as the exception, not the rule. We agree that this option would enhance the Navy’s and the Air Force’s controls and could help prevent the release of classified or controlled parts that are not authorized for release under a blanket order to a foreign country. DOD also provided technical and editorial comments, which we have incorporated as appropriate. DOD’s comments are reprinted in appendix I of this letter. As you know, 31 U.S.C. 720 requires the head of a federal agency to submit a written statement of the actions taken on our recommendations to the Senate Committee on Governmental Affairs and to the House Committee on Government Reform not later than 60 days from the date of the report and to the House and Senate Committees on Appropriations with the agency’s first request for appropriations made more than 60 days after the date of the report. Because agency personnel serve as the primary source of information on the status of recommendations, we request that DOD also provide us with a copy of DOD’s statement of action to serve as preliminary information on the status of open recommendations. Please provide me with a copy of your responses. My e-mail address is solisw@gao.gov. We are sending copies of this report to Senator Tom Harkin; the Senate and House Committees on Armed Services; the Secretaries of the Army, the Navy, and the Air Force; the Director, Office of Management and Budget; and other interested congressional committees. The report is also available on GAO’s home page at http://www.gao.gov. If you have any questions, please call me at (202) 512-8365. Key contributors to this report were Thomas Gosling, Louis Modliszewski, and R. K. Wild. Key contributors to our prior reports are listed in those reports. The following are GAO’s comments on the Department of Defense’s letter dated October 8, 2004. 1. In our report, we modified the text to clarify that the parts were not authorized for release under blanket orders. The title of this report is consistent with the titles of our prior reports on this subject, as listed on page 1, and we did not modify it as DOD suggests. 2. In response to DOD’s comments, we modified the text to state that DOD does not have a plan specifying the remedial actions to be taken to implement our recommendations. The Government Accountability Office, the audit, evaluation and investigative arm of Congress, exists to support Congress in meeting its constitutional responsibilities and to help improve the performance and accountability of the federal government for the American people. GAO examines the use of public funds; evaluates federal programs and policies; and provides analyses, recommendations, and other assistance to help Congress make informed oversight, policy, and funding decisions. GAO’s commitment to good government is reflected in its core values of accountability, integrity, and reliability. The fastest and easiest way to obtain copies of GAO documents at no cost is through GAO’s Web site (www.gao.gov). Each weekday, GAO posts newly released reports, testimony, and correspondence on its Web site. To have GAO e-mail you a list of newly posted products every afternoon, go to www.gao.gov and select “Subscribe to Updates.”

Summary: Under Department of Defense (DOD) policy, the export of classified and controlled spare parts must be managed to prevent their release to foreign countries that may use them against U.S. interests. GAO has issued a series of reports on the foreign military sales program in which weaknesses in the military services' internal controls were identified. This report highlights (1) a systemic problem that GAO identified in the internal controls of the military services' requisition-processing systems and (2) a potential best practice that GAO identified in one service that provides an additional safeguard over foreign military sales of classified and controlled parts. At the time GAO conducted its reviews, the Army, the Navy, and the Air Force were not testing their automated requisition-processing systems to ensure that the systems were accurately reviewing and approving blanket order requisitions for compliance with restrictions on the sale of classified and controlled spare parts and operating in accordance with foreign military sales policies. Blanket order requisitions are based on agreements between the U.S. government and a foreign country for a specific category of items for which foreign military sales customers will have a recurring need. GAO's tests of the services' requisition-processing systems showed that classified and controlled spare parts that the services did not want to be released to foreign countries under blanket orders were being released. GAO's internal control standards require periodic testing of new and revised software to ensure that it is working correctly, while the Office of Management and Budget's internal control standards require periodic reviews to determine how mission requirements might have changed and whether the information systems continue to fulfill ongoing and anticipated mission requirements. DOD either concurred or partially concurred with GAO's recommendations for testing the requisition-processing systems. The department, however, does not have a plan specifying the remedial actions to be taken to implement these recommendations. Internal control standards requiring testing also will be applicable to the Case Execution Management Information System, an automated requisition-processing system that DOD and the military services are developing to replace the existing individual military service systems. The Army's automated requisition-processing system incorporates a potential best practice that helps to prevent the release of classified or controlled parts that are not authorized under blanket orders to foreign countries. The automated systems used by the Navy and the Air Force allow country managers to override system decisions not to release to foreign countries classified or controlled parts that are requisitioned under blanket orders. GAO found instances where Navy and Air Force country managers overrode the systems' decisions without documenting their reasons for doing so. In contrast, the Army's system automatically cancels requisitions that are made under blanket orders for classified or controlled parts. Because the requisitions are automatically canceled, country managers do not have an opportunity to override the system's decisions. Compared with the Navy's and the Air Force's systems, the Army's system provides more stringent protection against releasing classified or controlled parts that are not authorized under blanket orders to foreign countries.