In regulating dual-use exports, the Commerce Department’s BIS faces the challenge of weighing various U.S. interests, which can be divergent or even competing, so U.S. companies can compete globally while minimizing the risk of controlled dual-use items falling into the wrong hands. Under the authority granted in the Export Administration Act (EAA), BIS administers the EAR that require exporters to either obtain a license from BIS or determine government authorization is not needed before exporting controlled items. Even when a license is not required, exporters are required to adhere to the provisions of the EAR when exporting controlled dual-use items. Whether an export license is required depends on multiple factors including the country of ultimate destination, individual parties involved in the export, parties’ involvement in proliferation activities, and planned end use of the item. Dual-use items specified in the EAR’s Commerce Control List are controlled for a variety of reasons, including restricting exports that could significantly enhance a country’s military potential, preventing exports to countries that sponsor terrorism, and limiting the proliferation of chemical, biological, and nuclear weapons and their delivery systems. The U.S. government controls many of these items under its commitments to multilateral export control regimes, which are voluntary agreements among supplier countries that seek to restrict trade in sensitive technologies to peaceful purposes. For those exports requiring a license, Executive Order 12981 governs the dual-use license application review process and establishes time frames for each step in the review process (see fig. 1). One of the first steps in the license application review process is the screening of parties on the application, such as the planned exporter or end user, against BIS’s internal watchlist to identify ineligible parties or parties that warrant closer scrutiny. Neither the EAA nor the EAR provide specific criteria as to which parties are to be included on the watchlist. However, under the EAR, BIS may deny export privileges to persons convicted of export violations, and the watchlist serves as a mechanism for identifying parties that have been denied exporting privileges. This screening process can also serve as a tool for identifying proposed end users sanctioned for terrorist activities and, therefore, ineligible to receive certain dual-use items. BIS has the discretion to add other parties to the watchlist. A match between the watchlist and a party on an application does not necessarily mean that the application will be denied, but it can trigger additional scrutiny by BIS officials, including BIS enforcement officials, during the license application review process. While BIS is responsible for administering the dual-use export control system and licensing dual-use exports, other federal agencies play active roles. As provided for under Executive Order 12981, the Departments of Defense, Energy, and State have the authority to review any export license applications submitted to BIS. These departments specify through delegations of authority to BIS the categories of applications that they want to review based, for example, on the item to be exported. License applications can also be referred to the Central Intelligence Agency (CIA) for review. After reviewing an application, the agencies are to provide the BIS licensing officer with a recommendation to approve or deny the application. In addition to reviewing license applications, the Defense, Energy, and State Departments are also involved in the regulatory process. Before changes are made to the EAR and the Commerce Control List, such as the addition of an item to the list, proposals are reviewed through an interagency review process. BIS is responsible for issuing the regulatory changes related to dual-use exports. For fiscal year 2005, BIS had a budget of $67.5 million, of which $33.9 million was for the administration of the export control system. Of the 414 positions at BIS in fiscal year 2005, 48 were licensing officers. These officers are responsible for developing the Commerce Department position as to whether an application should be approved and responding to exporter requests for commodity classifications as well as performing other duties related to administering the dual-use export control system. BIS has not systematically evaluated the overall effectiveness and efficiency of the system to determine whether its stated goal of protecting U.S. national security and economic interests is being achieved. Specifically, it has not comprehensively analyzed key data on actual dual- use exports, including unlicensed exports that represent the majority of exports subject to its controls. Further, contrary to what is called for under government management standards, BIS has not established performance measures to assess how effectively the system is protecting U.S. interests in the existing security and economic environment. While BIS has established some measures related to the system’s efficiency, those measures focus on narrow aspects of the licensing process. BIS officials also rely on intelligence reports and meetings with industry officials to provide insight into how the system is operating. After the events of September 2001, BIS conducted an ad hoc review of the system to determine if changes were needed. According to BIS officials, no fundamental changes to the system were needed, but they cited the review as the basis for some adjustments—primarily related to controls on chemical and biological agents. However, because BIS did not document its review, we could not assess the sufficiency of the review and the resulting changes. In managing the dual-use export control system, BIS has not conducted comprehensive analyses of available data on items under its control that have been exported. According to BIS officials, they recently began conducting limited analyses of export data to evaluate the potential effects of proposed regulatory changes on U.S. industry. While BIS is cognizant of dual-use exports authorized through the license application review process, it has not analyzed export data to determine the extent to which approved licenses resulted in actual exports. BIS also does not routinely analyze data on the items and destinations for unlicensed exports, which represent the majority of exports subject to BIS’s controls. BIS has not established measures to assess whether it is effectively achieving its goal of protecting national security and economic interests. Under the performance management framework established by the Government Performance and Results Act of 1993, federal agencies are to develop objective performance measures for assessing how well they are achieving their goals over time. These measures should focus on an agency’s outcomes as opposed to its processes. BIS’s lack of effectiveness measures was noted in a 2005 review by the Office of Management and Budget (OMB). In response to OMB’s review, BIS indicated plans for developing measures to assess the system’s effects on national security and economic interests in consultation with the other agencies involved in the export control system. BIS officials informed us that their attempt to devise effectiveness measures did not succeed due to a lack of cooperation and that they opted not to independently pursue the development of effectiveness measures. Without measures of effectiveness to assess it performance, BIS relies on measures related to the efficiency of the dual-use export control system. These efficiency-related measures generally focus on the first steps in the license application review process—how long it takes to review a license application internally and refer an application to another agency. Over the last 3 fiscal years, BIS has reported meeting its licensing-related time frames. However, BIS does not have efficiency-related measures for other steps in the license application review process, such as how quickly a license should be issued or denied once other agencies provide their input, or for the review process as a whole. BIS also does not evaluate the efficiency of other aspects of the system. Most notably, it does not measure whether it is meeting the regulatory time frame for the processing of commodity classification requests, of which there were 5,370 in fiscal year 2005 or about 24 percent of licensing officers’ workload (see app. I for additional information on BIS’s processing times). BIS officials acknowledged that they have not systematically evaluated the dual-use export control system. Instead, BIS officials informed us that they regularly review intelligence reports and meet with industry officials to gauge how well the system is working. A senior BIS official stated there are no anecdotal indications that the system is not effective. The official added that “it stands to reason” that BIS’s controls have limited various parties’ access to U.S. dual-use technologies but that it is difficult to determine how controls are affecting U.S. industry. Also, as evidence of how the system is operating, BIS officials referred us to BIS’s annual report on its foreign policy-based controls. This report summarizes various regulatory changes from the previous year and what the newly imposed controls were intended to achieve. However, this report does not contain an assessment of the impact these controls have had on U.S. interests. To address its lack of evaluations, BIS officials informed us that they are in the process of establishing an Office of Technology Evaluation. BIS is hiring analysts to evaluate topics including how dual-use items should be controlled and how export controls have affected industry. Absent systematic evaluations, BIS conducted an ad hoc review after the September 2001 attacks to determine what changes, if any, needed to be made to the system in light of the new security environment. However, according to BIS officials, they did not produce a report or other documentation regarding their review. Therefore, we could not assess the validity or sufficiency of BIS’s review and the resulting changes. BIS officials told us they determined that, other than some adjustments to its controls, no fundamental changes to the system were needed because they already had controls and procedures in place to deny terrorists access to dual-use technologies. Of the hundreds of regulatory changes made since September 2001, BIS officials identified the following specific changes as stemming from their ad hoc review establishing a worldwide licensing requirement for exports of changing the licensing requirement for biological agent fermenters from fermenters larger than 100 liters to those larger than 20 liters; controlling components that can be used in the manufacture of chemical agents; including additional precursors for the development of chemical agents on the Commerce Control List; revising licensing requirements to further restrict U.S. persons from designing, developing, producing, stockpiling, or using chemical or biological weapons; requiring licenses for exports of equipment related to the production of chemical or biological agents to countries that are not members of the Australia Group; imposing controls on exports of unmanned aerial vehicles capable of dispersing more than 20 liters of chemical or biological agents; and adding amorphous silicon plane arrays, which can be used in night vision or thermal imaging equipment, to the Commerce Control List. According to BIS officials, their review did not result in changes to the license application review process after the events of September 2001. However, decisions by other agencies—namely the Energy Department and the CIA—have resulted in BIS referring more license applications to them. Specifically, in response to Energy’s request, BIS began referring applications related to missile technologies and chemical or biological agents, in addition to the nuclear-related applications Energy was already reviewing. Similarly, based on discussions between BIS and the CIA, the decision was made to refer more applications to the CIA for review to determine whether foreign parties of concern may be involved in the proposed export (see app. I for information on BIS referral rates). Additionally, in response to the changing security environment after September 2001, BIS reprioritized its enforcement activities. Specifically, BIS enforcement officials are to give highest priority to dual-use export control violations involving the proliferation of weapons of mass destruction, terrorist organizations, and exports for unauthorized military or government uses. Further, senior BIS officials noted that they have made regulatory changes to reflect the dynamic geopolitical environment, such as changing licensing requirements for exports to India, Iraq, Libya, and Syria. BIS’s watchlist is intended to facilitate the identification of license applications involving individuals and companies representing an export control concern. However, BIS’s watchlist is incomplete, as numerous export control violators and terrorists are not included on the list. Further, BIS’s process for screening applications does not ensure that all parties on all applications are screened against the watchlist. As a result, the watchlist’s utility in the license application review process is undermined, which increases the risk of dual-use items falling into the wrong hands. BIS’s watchlist does not include certain companies, organizations, and individuals that are known entities of export control concern and, therefore, warrant inclusion on the watchlist. Based on our comparison of the watchlist to publicly available U.S. government documents, including ones available through BIS’s Web site, we identified 147 parties that had either violated U.S. export control requirements, been determined to be suspicious end users, or committed acts of terror but were not on BIS’s watchlist. BIS officials confirmed that, at the time of our review, the parties we identified were not on BIS’s watchlist. Specifically, we identified 5 export control violators that have been denied dual-use export 60 companies and individuals that had committed export control violations and were, therefore, barred by the State Department from being involved in the export of defense items; 52 additional companies and individuals that have been investigated, charged, and, in most cases, convicted of export control violations; 2 overseas companies whose legitimacy as end users could not be established by BIS; and 28 organizations identified by the State Department as committing acts of terror. The above individuals and companies we identified as not being on the BIS watchlist include those that have exported or attempted to export weapons to terrorist organizations, night vision technologies to embargoed countries, and materials that can be used in biological and missile programs. The terrorist organizations include one that has staged attacks against U.S. and coalition forces in Afghanistan and another that has attacked and abducted large numbers of civilians, including children. BIS’s standard for including a party on its watchlist is that the party represents an export control concern. BIS does not have an official definition or explanation as to what constitutes an export control concern. As a result, the decision as to whether a party should be added to the watchlist is left to the judgment of the BIS personnel responsible for maintaining the watchlist. The only specific guidance BIS provides is that parties under investigation by BIS enforcement officials must be added to the watchlist. BIS officials told us that the reasons a company, organization, or individual should be added to the watchlist include previous violations of U.S. export control regulations, inability to determine a party’s legitimacy, possible support of international terrorism, and possible involvement with missile programs of concern. The 147 parties we identified fall within these categories. In addition, BIS officials do not regularly review the watchlist to ensure its completeness. BIS officials said they do not conduct periodic checks as to whether particular parties have been added to the list. They also do not compare the BIS watchlist to other federal agencies’ lists or databases used for similar purposes to determine whether the BIS watchlist is missing pertinent parties. BIS officials offered several explanations for why the 147 parties were not on the watchlist. First, they acknowledged it was an oversight on their part not to include several of the parties on the watchlist. For example, at least two parties were not added to the watchlist because the BIS personnel involved thought they had been added by someone else. Second, for some of the parties, BIS did not receive information from another agency about export control-related investigations. However, these parties could have been identified through publicly available reports. Third, BIS relies on limited sources to identify parties involved in terrorist activities. The officials explained that their primary source for identifying terrorist organizations is the Treasury Department’s public listing of designated terrorists. While Treasury maintains a list of terrorists, its list is not exhaustive and therefore, does not include all known terrorist organizations. Finally, BIS officials noted that many of the parties we identified were individuals and that they do not typically add individuals to the watchlist because applications generally contain names of companies. However, we found numerous individuals included on the watchlist and individuals can and do appear on license applications. BIS’s process for screening applications does not ensure that all parties are screened against the watchlist. To screen parties on applications against the watchlist, BIS relies on a computerized process. The computer system recognizes parties that are identified in one of five specified fields and automatically screens the parties identified in those fields against the watchlist. If there are multiple parties, BIS’s regulations direct the applicant to list the additional parties in the “Additional Information” field. However, the computer system does not recognize the parties listed in that field, which means the parties are not automatically screened against the watchlist. While BIS officials told us that they may identify applications involving multiple parties and manually screen them against the watchlist, they do not have a systematic means of identifying applications involving parties listed in the “Additional Information” field. As a result, BIS cannot ensure that all parties on all applications have been screened. Based on our review of licensing data for the past 8 years, we identified at least 1,187 applications involving multiple parties that would not have been automatically screened. BIS officials informed us that they are aware of this limitation, but have not conducted reviews to determine the number of applications affected. According to BIS officials, since most applications are reviewed by other agencies, the risk of not screening all parties is lessened. However, a senior BIS official acknowledged that by not screening all applications against the BIS watchlist, applications involving parties that are the subject of BIS enforcement investigations would not be identified as that information only resides on the BIS watchlist. Defense and State officials, to whom most license applications are referred, stated that they do not maintain watchlists for the screening of dual-use export license applications and expect BIS to have already screened all parties before referring applications to them. BIS officials informed us of their plans to develop a new computerized screening system to ensure that all parties on applications are screened against the watchlist. However, the new system will not be operational for several years. In the years since the September 2001 terror attacks, GAO has issued a number of reports identifying weaknesses in the dual-use export control system. The weaknesses identified in many of the prior reports relate to ensuring that export controls on sensitive items protect U.S. interests and are consistent with U.S. law. Some of our recommendations to correct those weaknesses remain unimplemented (see app. II for more detailed information on these reports and the status of recommendations). Among the weaknesses identified in prior GAO reports is the lack of clarity as to which items are controlled and whether they are controlled by the Commerce Department or the State Department. A lack of clarity as to whether an item is Commerce-controlled or State-controlled increases the risk that defense-related items will be improperly exported and U.S. interests will be harmed as a result. In most cases, State’s controls over arms exports are more restrictive than Commerce’s controls over dual-use items. For example, a State-issued license is generally required for arms exports, whereas many dual-use items do not require licenses for export to most destinations. Further, most arms exports to China are prohibited, while dual-use items may be exported to China. In 2002, we reported that BIS had improperly informed exporters through the commodity classification process that their items were subject to Commerce’s export control requirements, when in fact the items were subject to State’s requirements. BIS made improper determinations because it rarely obtained input from the Departments of State or Defense during the commodity classification process on which department had jurisdiction over the items in question. We recommended that the Commerce Department, together with the Departments of State and Defense, develop agreed-upon criteria for determining which classification requests should be referred to the other departments, which would minimize the risk of improper determinations. However, BIS has not implemented our recommendation and continues to refer only a few commodity classifications to the Departments of State and Defense. In fiscal year 2005, BIS processed 5,370 commodity classification requests and referred only 10 to State and Defense. Additionally, in 2001, we reported that export control jurisdiction between the Departments of State and Commerce had not been clearly established for almost 25 percent of the items the U.S. government has agreed to control as part of its commitments to the multilateral Missile Technology Control Regime. The two departments have yet to take action to clarify which department has jurisdiction over these sensitive missile technology items. As a result, the U.S. government has left the determination of jurisdiction to the exporter, who by default can then determine which national policy interests are to be considered and acted upon when defense-related items are exported. BIS has taken actions to address other weaknesses identified in GAO reports. For example, in response to a 2004 GAO report, BIS expanded its licensing requirements for the export of missile technology items to address missile proliferation by nonstate actors. Similarly, BIS implemented GAO’s recommendation to require exporters to inform end users in writing of any conditions placed on licenses to help ensure that the end users abide by those restrictions. Exports of dual-use items are important to a strong U.S. economy, but in the wrong hands, they could pose a threat to U.S. security and foreign policy interests. However, BIS has not demonstrated whether the dual-use export control system is achieving its goal of protecting national security and economic interests in the post-September 2001 environment. Without systematic evaluations, BIS cannot readily identify weaknesses in the system and implement corrective measures that allow U.S. companies to compete in the global marketplace while minimizing the risk to other U.S. interests. Further, the absence of known parties of concern on the BIS watchlist and limitations in the screening process create vulnerabilities and are illustrative of what can happen when there is not an emphasis on evaluating how well a system is operating and taking corrective action to address known deficiencies. Also, the weaknesses and associated risks identified in prior GAO reports will persist until the remaining recommendations are implemented. Until corrective actions are taken, the United States will continue to rely on BIS’s management of the dual-use export control system with known vulnerabilities and little assurance that U.S. interests are being protected. To ensure that the dual-use export control system is effective as well as efficient in protecting U.S. interests, we recommend that the Secretary of Commerce direct the Under Secretary for Industry and Security to take the following four actions identify and obtain data needed to evaluate the system; review existing measures of efficiency to determine their appropriateness and develop measures that address commodity classifications; develop, in consultation with other agencies that participate in the system, measures of effectiveness that provide an objective basis for assessing whether progress is being made in achieving the goal of protecting U.S. interests; and implement a plan for conducting regular assessments of the dual- use export control system to identify weaknesses in the system and corrective actions. To ensure that BIS has a process that effectively identifies parties of concern during the export license application review process, we recommend that the Secretary of Commerce direct the Under Secretary for Industry and Security to take the following three actions develop criteria for determining which parties should be on the watchlist; implement regular reviews of the watchlist to help ensure its completeness; and establish interim measures for screening all parties until the planned upgrade of the computerized screening system eliminates current technical limitations. To mitigate the risks identified in prior GAO reports related to the dual-use export control system, we recommend that the Secretary of Commerce direct the Under Secretary for Industry and Security to report to Congress on the status of GAO recommendations, the reasons why recommendations have not been implemented, and what other actions, if any, are being taken to address the identified weaknesses. We provided a draft of this report to the Departments of Commerce, Defense, and State. In its comments on the draft, the Commerce Department did not respond to any of our recommendations and disagreed with our findings and characterizations of the U.S. dual-use export control system following the September 2001 terror attacks. The Departments of Defense and State had no comments on the draft report. The Energy Department declined the opportunity to review and comment on the draft report. In introducing its overall comments, the Commerce Department raises concerns regarding the report’s scope. Commerce states that we expanded the initial scope of our audit from narrowly looking at BIS’s response to the September 2001 terror attacks to the three issues we address in our report. In fact, the scope of our audit has remained the same. To examine BIS’s dual-use export control system and whether changes to the system were made, we focused on three specific issues related to how well the system is operating in the post-September 2001 environment. Based on our examination of these issues, we concluded that there are vulnerabilities in the dual-use export control system and that BIS can provide few assurances that the system is protecting U.S. interests in the current environment. After considering the Commerce Department’s extensive comments, our report’s findings, conclusions, and resulting recommendations remain unchanged. In commenting on our findings, the Commerce Department states that our report presumes BIS must develop a national security strategy to administer the dual-use export control system. Our report does not presume this as our recommendations address the need for BIS to develop performance measures and conduct systematic evaluations for determining the extent to which the system is meeting its stated goal of protecting both national security and economic interests. The Commerce Department further states that BIS represents the “gold standard” for its rigorous process of defining priorities, implementing plans, and measuring success. To support this statement, Commerce lists several actions that BIS has taken since September 2001 and cites BIS’s “Game Plan” as identifying BIS’s priorities and providing a basis for measuring BIS’s performance. However, BIS has not evaluated what effects these actions have had on U.S. interests. Also, the “Game Plan” provided to us at the end of our review did not contain performance measures for assessing how dual-use export controls affect national security or economic interests. Further, OMB determined in its 2005 Program Assessment Rating Tool that BIS lacked measures related to its fundamental purpose. Absent performance measures and systematic evaluations, it is unclear what the basis was for the various actions taken by BIS, what the impact of these actions has been on national security and economic interests, whether these actions are sufficient to protect U.S. interests in the current environment, or how BIS represents the gold standard. The Commerce Department also comments that our report is misleading and does not provide sufficient context for our findings related to BIS’s watchlist. According to Commerce, the 147 parties we identified as not being on the list should be placed in the context of the approximately 50,000 names that are on BIS’s watchlist, and no licenses were issued to the 147 parties. Commerce’s comment does not address our basic point. It was not our intent to identify every party that should be on BIS’s watchlist. Nor did we seek to determine whether licenses were issued to parties not on the watchlist, in part, because BIS’s regulations permit the approval of license applications involving parties on the watchlist. Instead, the point of our finding and our related recommendations is that BIS does not have mechanisms for ensuring a robust watchlist and screening process. To provide additional context, we adjusted the text to reflect the number of names on the watchlist. The Commerce Department also notes that the watchlist is only one check during the license application review process and that there are multiple layers and agencies involved—a fact we address in our report. According to Commerce, the built-in redundancies in the review process minimize the possibility of a party slipping through the cracks. We agree that having multiple layers of review can create an effective system of checks and balances, but only if each agency is fulfilling its responsibilities at each stage in the review. The other agencies involved in the process clearly expect BIS to have a robust watchlist screening process. BIS’s stated reliance on others to compensate for weaknesses in its watchlist creates gaps in the review process and, therefore, undermines the ability of the system to effectively protect U.S. interests. While the Commerce Department cites some measures BIS has taken recently to refine the watchlist, these measures do not address the weaknesses created by the lack of criteria and reviews of who should be on the watchlist or the technical limitations that result in some parties not being screened against the watchlist. Regarding its implementation of GAO’s prior recommendations, the Commerce Department states that BIS has met most of the recommendations and maintains that none of the outstanding recommendations puts BIS’s mission at risk. We disagree since BIS has not implemented recommendations that address the most basic aspects of the export control system. Specifically, BIS’s failure to implement recommendations that would provide for clear, transparent decisions about export control jurisdiction increases the risk that sensitive defense- related items will be improperly exported and that some exporters will be placed at a competitive disadvantage—undermining BIS’s goal of protecting national security and economic interests. The Commerce Department also provided technical comments, which we incorporated into our report as appropriate. Commerce’s comments are reprinted in appendix III, along with our supplemental responses. To assess BIS’s evaluations of the dual-use export control system’s efficiency and effectiveness after the events of September 2001, we compared BIS’s annual reports, performance plans, and budget submissions with performance management and internal control standards. These standards call for federal agencies to develop results- oriented goals, measure progress toward achieving those goals, and have procedures that provide reasonable assurances about the agency’s effectiveness and efficiency. We also spoke with senior BIS officials to identify evaluations they conducted of the system, particularly those conducted after the 2001 terror attacks, and discussed how those evaluations were conducted. To identify changes made to the system, we interviewed BIS officials and reviewed BIS regulatory notices issued since September 2001. Additionally, we interviewed officials from the CIA and the Departments of Defense, Energy, and State to determine changes to the system based on their participation in the dual-use licensing and regulatory processes. We also examined existing data on the system. Specifically, we analyzed data from BIS’s Export Control Automated Support System on applications and commodity classification requests closed between fiscal years 1998 and 2005. To assess data reliability, we performed electronic testing of relevant data elements, interviewed knowledgeable agency officials, and reviewed system documentation. We determined the data were sufficiently reliable for the purposes of our review. In examining the BIS watchlist, we reviewed BIS’s internal guidance for adding parties to the watchlist and discussed with BIS officials the various sources and reasons they use to add parties to the watchlist. Using the reasons they identified, we compared BIS’s watchlist, dated January 2006, to documents publicly available through U.S. government Web sites to assess the list’s completeness. These documents included BIS’s Denied Persons List, Unverified List, and Major Cases List; the State Department’s Debarred Parties List and Patterns of Global Terrorism report; and the Homeland Security Department’s fact sheet on arms and strategic technologies investigations. We confirmed with BIS officials that the parties we identified were not on the watchlist and discussed reasons they were excluded. We also discussed BIS’s process for screening applications with BIS officials and reviewed BIS’s internal guidance. To determine the status of GAO’s prior recommendations to correct weaknesses in the system, we identified reports issued between fiscal years 2001 and 2005 regarding the dual-use export control system and their recommendations. We reviewed BIS’s regulatory notices to determine whether BIS made regulatory changes in response to GAO’s recommendations. We also followed up on the status of recommendations through interviews with Commerce, Defense, and State officials and reviews of supporting documentation they provided. We requested data for fiscal years 2004 and 2005 on actual exports of dual- use items from the Bureau of the Census. As discussed with your staff, we requested the data in October 2005 and did not receive the data in time for inclusion in this report after multiple attempts to obtain the data. The delays from Census prevented us from reporting on actual dual-use exports as planned. As agreed with your office, unless you publicly announce the contents of this report earlier, we plan no further distribution of it until 30 days from the date of this letter. We will then send copies of this report to interested congressional committees as well as the Secretaries of Commerce, Defense, Energy, and State; the Director, Central Intelligence Agency; the Director, Office of Management and Budget; and the Assistant to the President for National Security Affairs. In addition, this report will be made available at no charge on the GAO Web site at http://www.gao.gov. Please contact me at (202) 512-4841 or calvaresibarra@gao.gov if you or your staff have any questions concerning this report. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made major contributions to this report are listed in appendix IV. The number of dual-use export license applications processed by the Department of Commerce’s Bureau of Industry and Security (BIS) has increased over the last several years. These applications were generally for the export of items in the following categories: materials, chemicals, microorganisms, and toxins; nuclear materials, facilities and equipment and miscellaneous items; telecommunications and information security; and other items subject to BIS’s controls but not specified on the Commerce Control List. As shown in figure 2, from fiscal years 1998 through 2005, the number of applications processed increased by over 50 percent. Additionally, BIS has been referring a larger percentage of applications to other agencies for their review. From fiscal year 1998 to 2005, the total percentage of applications referred to other agencies increased from about 85 percent to about 92 percent. As shown in figure 3, the greatest increases were in the percent of applications referred to the Department of Energy and the Central Intelligence Agency (CIA). After the license application review process is completed, BIS can approve an application, return it without action, or reject it. The majority of applications processed since fiscal year 1998 have been approved, as shown in figure 4. Although the number of applications processed by BIS increased over the last several years, the overall median processing times have remained relatively stable and consistent with time frames established by executive order, as shown in figure 5. As shown in table 1, there have been changes over the years in the top countries of destination for approved and rejected license applications. However, applications for dual-use exports to China have consistently represented a significant portion of BIS’s licensing workload. As shown in figure 6, referring applications to other agencies increases the time it takes to process license applications. Between fiscal years 1998 and 2005, referred license applications took about 24 more days to process than those applications that were processed solely by BIS. BIS’s workload related to commodity classifications has also increased in recent years. As shown in figure 7, the number of commodity classifications almost doubled from fiscal year 1998 to 2005. BIS continues to exceed the 14-day time frame established in the Export Administration Regulations for processing commodity classifications, as shown in figure 8. Appendix II: Prior GAO Reports on the Dual- Use Export Control System and the Status of Recommendations (Fiscal Years 2001-2004) Background: Exports of high performance computers exceeding a defined performance threshold require an export license from the Commerce Department. As technological advances in high performance computing occur, it may become necessary to explore other options to maintain the U.S. lead in defense-related technology. As a step in this direction, the National Defense Authorization Act for Fiscal Year 1998 required the Secretary of Defense to assess the cumulative effect of U.S.-granted licenses for exports of computing technologies to countries and entities of concern. It also required information on measures that may be necessary to counter the use of such technologies by entities of concern. in consultation with other relevant agencies, convene a panel of experts to comprehensively assess and report to Congress on ways of addressing the shortcomings of computer export controls. The Commerce Department has implemented our recommendation. Main issues: The current system for controlling exports of high performance computers is ineffective because it focuses on the performance level of individual computers and does not address the linking or “clustering” of many lower performance computers that can collectively perform at higher levels than current export controls allow. However, the act does not require an assessment of the cumulative effect of exports of unlicensed computers, such as those that can be clustered. countermeasures are necessary, if any, to respond to enhancements of the military or proliferation capabilities of countries of concern derived from both licensed and unlicensed high performance computing. The Defense Department has not implemented our recommendation. The current control system is also ineffective because it uses millions of theoretical operations per second as the measure to classify and control high performance computers meant for export. This measure is not a valid means for controlling computing capabilities. Export Controls: State and Commerce Department License Review Times Are Similar (June 1, 2001, GAO-01-528) Background: The U.S. defense industry and some U.S. and allied government officials have expressed concerns about the amount of time required to process export license applications. No recommendations. Not applicable. Main issues: In fiscal year 2000, State’s average review time for license applications was 46 days while Commerce’s average was 50 days. Variables identified as affecting application processing times include the commodity to be exported and the extent of interagency coordination. Both departments approved more than 80 percent of license applications during fiscal year 2000. Export Controls: Regulatory Change Needed to Comply with Missile Technology Licensing Requirements (May 31, 2001, GAO-01-530) Background: Concerned about missile proliferation, the United States and several major trading partners in 1987 created an international voluntary agreement, the Missile Technology Control Regime (MTCR), to control the spread of missiles and their related technologies. Congress passed the National Defense Authorization Act for Fiscal Year 1991 to fulfill the U.S. government’s MTCR commitments. This act amended the Export Administration Act of 1979, which regulates the export of dual-use items, by requiring a license for all exports of controlled dual-use missile technologies to all countries. The National Defense Authorization Act also amended the Arms Export Control Act, which regulates the export of military items, by providing the State Department the discretion to require licenses or provide licensing exemptions for missile technology exports. Our recommendations have not been implemented. However, the Commerce Department has a regulatory change pending that, once implemented, will require licenses for the export of dual-use missile technologies to Canada. Congress to specifically permit MTCR items to be exempted from licensing requirements. Main issues: The State Department’s regulations require licenses for the exports of missile technology items to all countries—including Canada, which is consistent with the National Defense Authorization Act. However, the Commerce Department’s export regulations are not consistent with the act as they do not require licenses for the export of controlled missile equipment and technology to Canada. if Commerce seeks a statutory change, revise the Export Administration Regulations to comply with the current statute until such time as a statutory change occurs. Export Controls: Clarification of Jurisdiction for Missile Technology Items Needed (Oct. 9, 2001, GAO-02-120) Background: The United States has committed to work with other countries through the MTCR to control the export of missile-related items. The regime is a voluntary agreement among member countries to limit missile proliferation and consists of common export policy guidelines and a list of items to be controlled. In 1990, Congress amended existing export control statutes to strengthen missile-related export controls consistent with U.S. commitments to the regime. Under the amended statutes, the Commerce Department is required to place regime items that are dual-use on its list of controlled items. All other regime items are to appear on the State Department’s list of controlled items. jointly review the listing of items included on the MTCR list, determine the appropriate jurisdiction for those items, and revise their respective export control lists to ensure that proposed exports of regime items are subject to the appropriate review process. The Departments of Commerce and State have not implemented our recommendations despite initially agreeing to do so. Main issues: The Departments of Commerce and State have not clearly determined which department has jurisdiction over almost 25 percent of the items that the U.S. government agreed to control as part of its regime commitments. The lack of clarity as to which department has jurisdiction over some regime items may lead an exporter to seek a Commerce license for a militarily sensitive item controlled by the State. Conversely, an exporter could seek a State license for a Commerce- controlled item. Either way, exporters are left to decide which department should review their exports of missile items and, by default, which policy interests are to be considered in the license review process. Export Controls: Issues to Consider in Authorizing a New Export Administration Act (Feb. 28, 2002, GAO-02-468T) Background: The U.S. government’s policy regarding exports of sensitive dual-use technologies seeks to balance economic, national security, and foreign policy interests. The Export Administration Act (EAA) of 1979, as amended, has been extended through executive orders and law. Under the act, the President has the authority to control and require licenses for the export of dual-use items, such as nuclear, chemical, biological, missile, or other technologies that may pose a national security or foreign policy concern. In 2002, there were two different bills before the 107th Congress—H.R. 2581 and S. 149—that would enact a new EAA. No recommendations. Not applicable. Main issues: A new EAA should take into consideration the increased globalization of markets and an increasing number of foreign competitors, rapid advances in technologies and products, a growing dependence by the U.S. military on commercially available dual-use items, and heightened threats from terrorism and the proliferation of weapons of mass destruction. Export Controls: Rapid Advances in China’s Semiconductor Industry Underscore Need for Fundamental U.S. Policy Review (April 19, 2002, GAO-02-620) Background: Semiconductor equipment and materials are critical components in everything from automobiles to weapons systems. The U.S. government controls the export of these dual-use items to sensitive destinations, such as China. Exports of semiconductor equipment and materials require a license from Commerce Department. Other departments, such as Defense and State, assist Commerce in reviewing license applications. The United States is a member of the multilateral Wassenaar Arrangement on Export Controls for Conventional Arms and Dual-Use Goods and Technologies. After initially disagreeing with our recommendations, the Commerce Department has cited our recommendations as the basis for increased resources so it can conduct the recommended analyses. Main issues: Since 1986, China has narrowed the gap between the U.S. and Chinese semiconductor manufacturing technology from approximately 7 years to 2 years or less. China’s success in acquiring manufacturing technology from abroad has improved its semiconductor manufacturing facilities for more capable weapons systems and advanced consumer electronics. The multilateral Wassenaar Arrangement has not affected China’s ability to obtain semiconductor manufacturing equipment because the United States is the only member of this voluntary arrangement that considers China’s acquisition of semiconductor manufacturing equipment a cause for concern. Additionally, U.S. government policies and practices to control the export of semiconductor technology to China are unclear and inconsistent, leading to uncertainty among U.S. industry officials about the rationale for some licensing decisions. Furthermore, U.S. agencies have not done the analyses, such as assessing foreign availability of this technology or the cumulative effects of such exports on U.S. national security interests, necessary to justify U.S. policies and practices. develop new export controls, if appropriate, or alternative means for protecting U.S. security interests; and these efforts to Congress and U.S. industry. Export Controls: More Thorough Analysis Needed to Justify Changes in High Performance Computer Controls (Aug. 2, 2002, GAO-02-892) Background: High performance computers that operate at or above a defined performance threshold, measured in millions of theoretical operations per second, require a Commerce license for export to particular destinations. The President has periodically changed, on the basis of technological advances, the threshold above which licenses are required. The National Defense Authorization Act of 1998 requires that the President report to Congress the justification for changing the control threshold. The report must, at a minimum, (1) address the extent to which high performance computers with capabilities between the established level and the newly proposed level of performance are available from foreign countries, (2) address all potential uses of military significance to which high performance computers between the established level and the newly proposed level could be applied, and (3) assess the impact of such uses on U.S. national security interests. No recommendations. Not applicable. Main issues: In January 2002, the President announced that the control threshold—above which computers exported to such countries as China, India, and Russia— would increase from 85,000 to 190,000 millions of theoretical operations per second. The report to Congress justifying the changes in control thresholds for high performance computers was issued in December 2001 and focused on the availability of such computers. However, the justification did not fully address the requirements of the National Defense Authorization Act of 1998. The December 2001 report did not address several key issues related to the decision to raise the threshold: (1) the unrestricted export of computers with performance capabilities between the old and new thresholds will allow countries of concern to obtain computers they have had difficulty constructing on their own, (2) the U.S. government is unable to monitor the end uses of many of the computers it exports, and (3) the multilateral process used to make earlier changes in high performance computer thresholds. Export Controls: Department of Commerce Controls over Transfers of Technology to Foreign Nationals Need Improvement (Sept. 6, 2002, GAO-02-972) Background: To work with controlled dual-use technologies in the United States, foreign nationals and the firms that employ them must comply with U.S. export control and visa regulations. U.S. firms may be required to obtain what is known as a deemed export license from the Commerce Department before transferring controlled technologies to foreign nationals in the United States. Commerce issues deemed export licenses after consulting with the Defense, Energy, and State Departments. In addition, foreign nationals who are employed by U.S. firms should have an appropriate visa classification, such as an H-1B specialized employment classification. H-1B visas to foreign nationals residing outside of the United States are issued by the State Department, while the Immigration and Naturalization Service approves requests from foreign nationals in the United States to change their immigration status to H-1B. Our recommendations have been implemented. use available Immigration and Naturalization Service data to identify foreign nationals potentially subject to deemed export licensing requirements. establish, with the Defense, Energy, and State Departments, a risk-based program to monitor compliance with deemed export license conditions. If the departments conclude that certain security conditions are impractical to enforce, they should jointly develop conditions or alternatives to ensure that deemed exports do not place U.S. national security interests at risk. Main Issues: In fiscal year 2001, Commerce approved 822 deemed export license applications and rejected 3. Most of the approved deemed export licenses allowed foreign nationals from countries of concern to work with advanced computer, electronic, or telecommunication and information security technologies in the United States. To better direct its efforts to detect possible unlicensed deemed exports, in fiscal year 2001 Commerce screened thousands of applications for H-1B and other types of visas submitted by foreign nationals overseas. From these applications, it developed 160 potential cases for follow-up by enforcement staff in the field. However, Commerce did not screen thousands of H-1B change-of-status applications submitted domestically to the Immigration and Naturalization Service for foreign nationals already in the United States. In addition, Commerce could not readily track the disposition of the 160 cases referred to field offices for follow-up because it lacks a system for doing so. Commerce attaches security conditions to almost all licenses to mitigate the risk of providing foreign nationals with controlled dual-use technologies. However, according to senior Commerce officials, their staff do not regularly visit firms to determine whether these conditions are being implemented because of competing priorities, resource constraints, and inherent difficulties in enforcing several conditions. Export Controls: Processes for Determining Proper Control of Defense-Related Items Need Improvement (Sept. 20, 2002, GAO-02-996) Background: Companies seeking to export defense-related items are responsible for determining whether those items are regulated by the Commerce Department or the State Department and what the applicable export requirements are. If in doubt about whether an item is Commerce or State- controlled or when requesting a change in jurisdiction, an exporter may request a commodity jurisdiction determination from State. State, which consults with Commerce and Defense, is the only department authorized to change export control jurisdiction. If an exporter knows an item is Commerce-controlled but is uncertain of the export requirements, the exporter can request a commodity classification from Commerce. Commerce may refer classification requests to State and Defense to confirm that an item is Commerce-controlled. guidance and develop criteria with concurrence from the State and Defense Departments for referring commodity classification requests to those departments. work with State to develop procedures for referring requests that are returned to companies because the items are controlled by State or because they require a commodity jurisdiction review. With a limited exception, our recommendations have not been implemented. In responding to our report, the State Department indicated it partially agreed with our recommendations, while the Departments of Commerce and Defense agreed to implement our recommendations. Main issues: The Commerce Department has improperly classified some State-controlled items as Commerce- controlled because it rarely obtains input from Defense and State before making commodity classification determinations. As a result, the U.S. government faces an increased risk that defense items will be exported without the proper level of government review and control to protect national interests. Also, Commerce has not adhered to regulatory time frames for processing classification requests. Commerce, Defense and State Departments have added staff to assist with their respective processes. In its implementation of the commodity jurisdiction process, the State Department has not adhered to established time frames, which may discourage companies from requesting jurisdiction determinations. State has also been unable to issue determinations for some items because of interagency disputes occurring outside the process. make jurisdiction recommendations and determinations within established time frames and reallocate them as appropriate. Nonproliferation: Strategy Needed to Strengthen Multilateral Export Control Regimes (Oct. 25, 2002, GAO-03-43) Background: Multilateral export control regimes are a key policy instrument in the overall U.S. strategy to combat the proliferation of weapons of mass destruction. They are consensus-based, voluntary arrangements of supplier countries that produce technologies useful in developing weapons of mass destruction or conventional weapons. The regimes aim to restrict trade in these technologies to prevent proliferation. The four principal regimes are the Australia Group, which controls chemical and biological weapons proliferation; the MTCR; the Nuclear Suppliers Group; and the Wassenaar Arrangement, which controls conventional weapons and dual-use items and technologies. All four regimes expect members to report denials of export licenses for controlled dual-use items, which provides members with more complete information for reviewing questionable export license applications. The United States is a member of all four regimes. The State Department has not implemented our recommendations. representative to the multilateral regimes, establish a strategy to strengthen these regimes. This strategy should include ways for regime members to implement regime changes to their export controls more consistently, and identify organizational changes that could help reform regime activities. Main issues: Weaknesses impede the ability of the multilateral export control regimes to achieve their nonproliferation goals. Regimes often lack even basic information that would allow them to assess whether their actions are having their intended results. The regimes cannot effectively limit or monitor efforts by countries of concern to acquire sensitive technology without more complete and timely reporting of licensing information and without information on when and how members adopt and implement agreed-upon export controls. For example, GAO confirmed that the U.S. government had not reported its denial of 27 export licenses between 1996 and 2002 for items controlled by the Australia Group. Several obstacles limit the options available to the U.S. government in strengthening the effectiveness of multilateral export control regimes. The requirement to achieve consensus in each regime allows even one member to block action in adopting needed reforms. Because the regimes are voluntary in nature, they cannot enforce members’ compliance with regime commitments. For example, Russia exported nuclear fuel to India in a clear violation of its commitments under the Nuclear Suppliers Group, threatening the viability of this regime. The regimes have adapted to changing threats in the past. Their continued ability to do so will determine whether they remain viable in curbing proliferation in the future. ensure that the United States reports all license application denials to regimes. establish criteria to assess the effectiveness of the regimes. Nonproliferation: Improvements Needed to Better Control Technology Exports for Cruise Missiles and Unmanned Aerial Vehicles (Jan. 23, 2004, GAO-04-175) Background: Cruise missiles and unmanned aerial vehicles (UAV) pose a growing threat to U.S. national security interests as accurate, inexpensive delivery systems for conventional, chemical, and biological weapons. Exports of cruise missiles and military UAVs by U.S. companies are licensed by the State Department while government-to- government sales are administered by the Defense Department. Exports of dual-use technologies related to cruise missiles and UAVs are licensed by the Commerce Department. assess and report to the Committee on Government Reform on the adequacy of the Export Administration Regulations’ catch-all provision to address missile proliferation by nonstate actors. This assessment should indicate ways the provision should be modified. The Commerce Department has addressed our recommendation by revising its licensing requirement for missile technology exports. Main issues: U.S. export control officials find it increasingly difficult to limit or track dual-use items with cruise missile or UAV-related capabilities that can be exported without a license. A gap in dual-use export control authority enables U.S. companies to export certain dual-use items to recipients that are not associated with missile projects or countries listed in the regulations, even if the exporter knows the items might be used to develop cruise missiles or UAVs. The gap results from current “catch-all” regulations that restrict the sale of unlisted dual-use items to certain national missile proliferation projects or countries of concern, but not to nonstate actors such as certain terrorist organizations or individuals. Catch-all controls authorize the government to require an export license for items that are not on control lists but are known or suspected of being intended for use in a missile or weapons of mass destruction program. Commerce, Defense and State Departments as a first step, each department complete a comprehensive assessment of cruise missile, UAV, and related dual-use technology transfers to determine whether U.S. exporters and foreign end users are complying with the conditions on the transfers. While the Commerce Department has taken some actions to address our recommendations, the others departments have not done so. The Departments of Commerce, Defense, and State have seldom used their end use monitoring programs to verify compliance with conditions placed on the use of cruise missile, UAV, or related technology exports. For example, Commerce conducted visits to assess the end use of items for about 1 percent of the 2,490 missile-related licenses issued between fiscal years 1998 and 2002. Thus, the U.S. government cannot be confident that recipients are effectively safeguarding equipment in ways that protect U.S. national security and nonproliferation interests. department conduct additional postshipment verification visits on a sample of cruise missile and UAV licenses. Export Controls: Post-Shipment Verification Provides Limited Assurance that Dual-Use Items Are Being Properly Used (Jan. 12, 2004, GAO-04-357) Background: The Commerce Department conducts post- shipment verification (PSV) checks to ensure that dual-use items arrive at their intended destination and are used for the purposes stated in the export license. To conduct PSV checks, Commerce personnel visit foreign companies to verify the use and location of exported items. PSVs serve as one of the primary means of checking whether end users are complying with conditions imposed by the license. Commerce placed conditions on nearly all approved licenses for exports to countries of concern for fiscal years 2000 to 2002. Our recommendations have been implemented. improve technical training for personnel conducting PSV checks to ensure they are able to verify compliance with license conditions. conducting PSV checks assess compliance with license conditions. Main issues: In fiscal years 2000 to 2002, the Commerce Department approved 7,680 licenses for dual-use exports to countries of concern, such as China, India, and Russia. However, we found that during this time Commerce completed PSV checks on only 428 of the dual-use licenses it approved for countries of concern. require that the exporter inform the end user in writing of the license conditions. We identified three key weaknesses in the PSV process that reduce its effectiveness. First, PSVs do not confirm compliance with license conditions because U.S. officials often lack the technical training needed to assess compliance and end users may not be aware of the license conditions by which they are to abide. Second, some countries of concern, most notably China, limit the U.S. government’s access to facilities where dual-use items are shipped, making it difficult to conduct a PSV. Third, PSV results have only a limited impact on future licensing decisions. Companies receiving an unfavorable PSV may receive greater scrutiny in future license applications, but licenses for dual-use exports to these companies can still be approved. In addition, according to Commerce officials, past PSV results play only a minor role in future enforcement actions. 5, §1211, 111 Stat. 1932-34 (1997). 1 nor S. 149 was enacted. 1. The scope of our review has remained unchanged. We examined BIS’s dual-use export control system and whether changes were made to the system by focusing on three specific issues related to how well the system is operating in the post-September 2001 environment. 2. Our report is not premised on a need for BIS to develop a national security strategy, which is outside of BIS’s mission. BIS’s stated goal is the protection of national security and economic interests. In its comments, BIS appears to define “national security interests” in terms of the administration’s National Security Strategy, but BIS has not developed performance measures to evaluate or determine whether the dual-use export control system is supporting and furthering that strategy. Commerce’s comments also do not address what effects the dual-use export control system has had on U.S. economic interests. 3. The eight specific measures cited in our report are not “samples” of steps taken by BIS. Rather, they represent all of the changes identified by BIS officials as a result of their ad hoc review to determine what changes, if any, should be made to the system after the September 2001 terror attacks. 4. Our report accurately depicts what BIS officials told us regarding the ad hoc review they conducted in the aftermath of the 2001 terror attacks. Given that BIS officials did not document their review, we can neither confirm what the review consisted of nor determine the sufficiency of this review and the resulting changes. 5. Our report acknowledges that BIS made adjustments to its enforcement efforts in response to the changing security environment. Also, GAO is currently conducting a separate review of export control enforcement efforts. 6. Our report identifies the specific changes BIS officials stated were the result of their post-September 2001 ad hoc review and acknowledges that BIS has reprioritized its enforcement efforts and taken other actions as a result of various geopolitical changes. However, without performance measures and systematic evaluations, BIS is not in a position to readily identify weaknesses in the dual-use export control system, implement corrective measures, and determine whether those measures are having the intended effects of protecting U.S. national security and economic interests. 7. Commerce’s characterization of BIS’s annual foreign policy report is misleading. BIS’s annual report summarizes export control changes and describes what those changes were intended to achieve. BIS’s report does not contain an assessment of the actual impact foreign policy- based controls have had on U.S. interests. 8. Our report acknowledges that there have been over 100 amendments to the EAR since September 2001. However, based on our review of those amendments, the specific basis for many of these revisions is not clear and given BIS’s lack of evaluations, the impact of these revisions is unknown. Also, it should be noted that many of the regulatory amendments made since September 2001 consisted of administrative changes and technical corrections as opposed to revisions of export requirements for dual-use items. 9. The quotes from senior BIS officials’ speeches do not address whether the dual-use export control system is protecting U.S. interests nor do they provide other evidence that BIS has developed performance measures or conducted systematic evaluations. While these speeches outline BIS’s mission and the role of export controls, the lack of performance measures and systematic evaluations precludes a determination as to whether that mission and role are being successfully fulfilled. It is also unclear how changing the bureau’s name is an example of a successful adaptation to the current environment. Further, the increased scrutiny of license applications was not the result of BIS’s actions as one of the quotes implies. As discussed in our report, increases in the referral of license applications resulted from decisions by other agencies involved in the application review process. 10. Absent any documentation to the contrary, particularly when BIS officials repeatedly acknowledged that BIS had not undertaken systematic evaluations, we stand by our finding that BIS has not systematically evaluated the overall effectiveness and efficiency of the dual-use export control system. Regarding BIS’s ad hoc post-September 2001 review, we could not assess the validity and sufficiency of the review and resulting changes due to the lack of documentation. 11. Commerce’s description of BIS’s Game Plan is misleading and inaccurate. First, BIS’s mission and priorities as summarized in the Game Plan are not consistent with the mission and goals stated in Commerce’s official performance management documents, such as the annual performance plan. The Game Plan may represent BIS’s thoughts for how to align activities and priorities in the future, but it does not depict what has been in place since the September 2001 terror attacks. Second, the Game Plan does not contain measures of effectiveness. When we discussed the Game Plan with BIS officials, they acknowledged that they had not developed measures for evaluating how well the dual-use export control system is protecting national security and economic interests. 12. We agree that the development of measures for determining the effectiveness of the dual-use export system would be difficult. However, BIS’s existing performance measures, which focus on processing times, fall far short of government management standards since they do not provide a basis for determining whether the system is protecting U.S. interests. 13. Our report presents BIS’s position that it was unable to obtain assistance from other agencies to develop performance measures for assessing the dual-use export control system’s effects on national security and economic interests. The two examples of performance measures provided in Commerce’s comments do not relate to BIS’s administration of the export controls system, which was the focus of our review, but rather to BIS’s export enforcement efforts and assistance to other countries. Also, it is not clear how these two measures would provide BIS with a basis for determining the security and economic impact of its controls on dual-use exports. Additionally, Commerce’s statement that BIS is assigning staff to develop a methodology for evaluating the system’s effectiveness indicates that BIS does not yet have a systematic evaluation process in place. 14. Our report discusses that, in the absence of systematic evaluations, BIS officials obtain information from industry to gauge how the dual-use export control system is operating. However, the collection of data from industry does not constitute a measure or evaluation of how the dual-use export control system is affecting U.S. economic interests. Also, BIS officials repeatedly informed us that they do not have measures for determining the impact of dual-use export controls on economic interests. 15. The Office of Management and Budget determined in its 2005 review that BIS lacked measures related to the fundamental purpose of the dual-use export controls system. Given this and our evaluation as well as BIS’s limited measures of efficiency and lack of comprehensive analyses as to which items under its control have actually been exported, BIS is not meeting government performance management standards and, therefore, does not represent the gold standard. 16. We examined the completeness of the watchlist and the thoroughness of BIS’s watchlist screening process and found omissions in the list and weaknesses in the process. Our intent was not to determine whether licenses were approved for parties not on the watchlist. As our report explains, a match between an application and the watchlist does not necessarily mean that the application will be denied but that the application will be more closely scrutinized during the license application review process. 17. Our report places BIS’s watchlist in the context of the larger license application review process. A process built on multiple layers and multiple agencies is only as strong as its weakest link. Other agencies that participate in the license application review process expect BIS to thoroughly screen all parties on all applications against the watchlist before referring applications to them. Given the omissions we identified in the watchlist and the weakness in the screening process, BIS’s watchlist is not serving its intended purpose of helping identify those license applications that warrant additional scrutiny. We identified many of the 147 parties not on the watchlist by using the lists cited in Commerce’s comments. While BIS expects exporters to check these publicly available lists, we found that BIS failed to include all of the publicly-listed parties on its watchlist. It is reasonable that BIS would focus its licensing and enforcement efforts on the “truly bad actors.” However, given that the watchlist is supposed to help BIS identify parties of export control concern, BIS’s ability to focus on “bad actors” is undermined by the omissions we identified in the watchlist. 18. The 147 parties we identified should not be regarded as an exhaustive list of every party of export control concern that should be on BIS’s watchlist. Our intent was not to identify all parties but rather to evaluate the process that BIS uses to determine which parties should be on the list. Therefore, the 147 parties represent examples that illustrate weaknesses in BIS’s management of the watchlist. However, to provide additional context, we revised the text to include the number of names on the BIS watchlist. 19. The measures listed in Commerce’s comments do not address the underlying weaknesses we identified or our corrective recommendations. 20. Our report accurately reflects that several, but not all, of GAO’s prior recommendations regarding the dual-use export control system have been implemented. BIS’s disagreement with the conclusions of GAO’s report on China’s semiconductor industry does not change the fact that BIS continues to cite that report and its recommendations as justification for requested increases in resources. However, BIS has not implemented the report’s recommendations. The continued failure to address GAO’s recommendations regarding the commodity classification process and export control jurisdiction places BIS’s mission of protecting national security and economic interests at risk. Improper decisions regarding jurisdiction and the lack of clear jurisdiction create the risk that defense-related items will be exported without the proper level of government review and control to protect national interests. These weaknesses can also result in companies seeking to export similar items under the different controls of the Departments of State and Commerce, which places some companies at a competitive disadvantage. 21. As discussed in our report’s scope and methodology, we reviewed BIS’s documents, such as its performance plans, that contain BIS’s official performance measures. None of these documents contains performance measures related to the processing of commodity classifications. During meetings with BIS officials, they did not identify additional measures for evaluating the system’s effectiveness. Also, Commerce’s comment is misleading, as our report does not cite BIS statistics on commodity classifications. Our report contains GAO’s analyses of BIS’s data on commodity classification processing times and shows that BIS has exceeded regulatory processing time frames. 22. We are not revising the graphic because it depicts what can occur in the license application review process under different circumstances. 23. Text revised to further clarify the CIA’s role in the license application review process. 24. The examples provided by Commerce are limited to BIS’s analyses of licensing data. However, BIS has not comprehensively analyzed data on actual exports, particularly on unlicensed exports that represent the majority of exports subject to BIS’s control. 25. Our report states that Executive Order 12981 provides time frames for the entire license application review process. However, none of BIS’s performance measures addresses the timeliness of the entire process. Also, BIS has not reported overall timeframes consistently in its annual reports. 26. Our draft report cited changes in BIS’s licensing policy for dual-use exports to Iraq as an illustrative example; however, we have revised our report to include the other countries listed in Commerce’s comments. 27. Despite Commerce’s comment regarding its sources, some of the 147 parties we identified as not being on the watchlist appear on publicly available documents from the State Department’s Directorate of Defense Trade Controls and the Homeland Security Department’s Immigration and Customs Enforcement. 28. We are not revising the text based on Commerce’s comment because our report accurately reflects how the Treasury Department characterizes the list it maintains on individuals and companies. 29. Despite Commerce’s comment that it adds individuals to its watchlist, we identified many individuals who were not on the list but should have been. 30. Our report explains that BIS has a regulatory change pending that once implemented will address this recommendation from 2001. 31. Commerce’s actions regarding production equipment for missile technology items do not resolve the lack of clear jurisdiction between State and Commerce as to which department controls the export of almost 25 percent of the missile technology items the U.S. government agreed to control as part of its commitments to the Missile Technology Control Regime. As a result, GAO’s recommendations regarding this matter remain unimplemented. 32. See comment 20. 33. The memorandum contained in Commerce’s comments does not address GAO’s recommendations that BIS develop criteria, with the concurrence of the State and Defense Departments, for the referral of commodity classification requests and develop procedures for referring other commodity classification requests to the State Department. As a result, GAO’s recommendations regarding this matter remain unimplemented. 34. We revised the report text to more clearly reflect BIS’s actions. In addition to the contact named above, Anne-Marie Lasowski, Assistant Director; Johana R. Ayers; Lily Chin; Arthur James, Jr.; Megan Masengale; Margaret B. McDavid; Bradley Terry; Karen Thornton; and Joseph Zamoyta made key contributions to this report. Defense Trade: Arms Export Control Vulnerabilities and Inefficiencies in the Post-9/11 Security Environment. GAO-05-468R. Washington, D.C.: April 7, 2005. Defense Trade: Arms Export Control System in the Post- 9/11Environment. GAO-05-234. Washington, D.C.: February 16, 2005. Nonproliferation: Improvements Needed to Better Control Technology Exports for Cruise Missiles and Unmanned Aerial Vehicles. GAO-04-175. Washington, D.C.: January 23, 2004. Export Controls: Post-Shipment Verification Provides Limited Assurance That Dual-Use Items Are Being Properly Used. GAO-04-357. Washington, D.C.: January 12, 2004. Nonproliferation: Strategy Needed to Strengthen Multilateral Export Control Regimes. GAO-03-43. Washington, D.C.: October 25, 2002. Export Controls: Processes for Determining Proper Control of Defense- Related Items Need Improvement. GAO-02-996. Washington, D.C.: September 20, 2002. Export Controls: Department of Commerce Controls over Transfers of Technology to Foreign Nationals Need Improvement. GAO-02-972. Washington, D.C.: September 6, 2002. Export Controls: More Thorough Analysis Needed to Justify Changes in High Performance Computer Controls. GAO-02-892. Washington, D.C.: August 2, 2002. Export Controls: Rapid Advances in China’s Semiconductor Industry Underscore Need for Fundamental U.S. Policy Review. GAO-02-620. Washington, D.C.: April 19, 2002. Export Controls: Issues to Consider in Authorizing a New Export Administration Act. GAO-02-468T. Washington, D.C.: February 28, 2002. Export Controls: Clarification of Jurisdiction for Missile Technology Items Needed. GAO-02-120. Washington, D.C.: October 9, 2001. Export Controls: State and Commerce Department License Review Times Are Similar. GAO-01-528. Washington, D.C.: June 1, 2001. Export Controls: Regulatory Change Needed to Comply with Missile Technology Licensing Requirements. GAO-01-530. Washington, D.C.: May 31, 2001. Export Controls: Inadequate Justification for Relaxation of Computer Controls Demonstrates Need for Comprehensive Study. GAO-01-534T. Washington, D.C.: March 15, 2001. Export Controls: System for Controlling Exports of High Performance Computing Is Ineffective. GAO-01-10. Washington, D.C.: December 18, 2000. Export Controls: Statutory Reporting Requirements for Computers Not Fully Addressed. NSIAD-00-45. Washington, D.C.: November 5, 1999. Export Controls: Better Interagency Coordination Needed on Satellite Exports. NSIAD-99-182. Washington, D.C.: September 17, 1999. Export Controls: Change in Licensing Jurisdiction for Commercial Communications Satellites. T-NSIAD-98-222. Washington, D.C.: September 17, 1998 Export Controls: National Security Issues and Foreign Availability for High Performance Computer Exports. NSIAD-98-200. Washington, D.C.: September 16, 1998. Export Controls: Issues Related to Commercial Communications Satellites. T-NSIAD-98-208. Washington, D.C.: June 10, 1998. China: Military Imports From the United States and the European Union Since the 1989 Embargoes. NSIAD-98-176. Washington, D.C.: June 16, 1998. Export Controls: Change in Export Licensing Jurisdiction for Two Sensitive Dual-Use Items. NSIAD-97-24. Washington, D.C.: January 14, 1997. Export Controls: Sensitive Machine Tool Exports to China. NSIAD-97-4. Washington, D.C.: November 19, 1996. Export Controls: Sale of Telecommunications Equipment to China. NSIAD-97-5. Washington, D.C.: November 13, 1996.

Summary: In regulating exports of dual-use items, which have both commercial and military applications, the Department of Commerce's Bureau of Industry and Security (BIS) seeks to allow U.S. companies to compete globally while minimizing the risk of items falling into the wrong hands. In so doing, BIS faces the challenge of weighing U.S. national security and economic interests, which at times can be divergent or even competing. In light of the September 2001 terror attacks, GAO was asked to examine BIS's dual-use export control system. In response, GAO is reporting on BIS's (1) evaluations of and changes to the system, (2) screening of export license applications against its watchlist, and (3) actions to correct weaknesses previously identified by GAO. Lack of systematic evaluations. Although BIS made some regulatory and operational changes to the dual-use export control system, it has not systematically evaluated the system to determine whether it is meeting its stated goal of protecting U.S. national security and economic interests. Specifically, BIS has not comprehensively analyzed available data to determine what dual-use items have actually been exported. Further, contrary to government management standards, BIS has not established performance measures that would provide an objective basis for assessing how well the system is protecting U.S. interests. Instead, BIS relies on limited measures of efficiency that focus only on narrow aspects of the license application review process to assess the system's performance. BIS officials use intelligence reports and meetings with industry to gauge how the system is operating. Absent systematic evaluations, BIS conducted an ad hoc review of the system to determine if changes were needed after the events of September 2001. BIS officials determined that no fundamental changes were needed but opted to make some adjustments primarily related to controls on chemical and biological agents. GAO was unable to assess the sufficiency of the review and resulting changes because BIS officials did not document their review. Omissions in BIS's watchlist. GAO found omissions in the watchlist BIS uses to screen export license applications. This screening, which is part of the license application review process, is intended to identify ineligible parties or parties warranting more scrutiny. The omissions undermine the list's utility, which increases the risk of dual-use exports falling into the wrong hands. GAO identified 147 parties that had violated U.S. export control requirements, had been determined by BIS to be suspicious end users, or had been reported by the State Department as committing acts of terror, but these parties were not on the watchlist of approximately 50,000 names. Reasons for the omissions include a lack of specific criteria as to who should be on the watchlist and BIS's failure to regularly review the list. In addition, a technical limitation in BIS's computerized screening system results in some parties on license applications not being automatically screened against the watchlist. Some prior GAO recommendations left unaddressed. BIS has implemented several but not all of GAO's recommendations for ensuring that export controls on sensitive items protect U.S. interests. Among weaknesses identified in prior GAO reports is the lack of clarity on whether certain items are under BIS's control, which increases the risk of defense-related items being improperly exported. BIS has yet to take corrective action on this matter.