DOD considers maintaining military superiority a key priority and has established an agencywide policy to treat defense-related technology as a valuable, limited national security resource that should be invested in and protected to pursue national security objectives. Many DOD organizations and other federal agencies have a need to know what is militarily critical to assist in planning program activities related to technology and to help inform decision making. Within DOD specifically, knowledge about militarily critical technologies is needed for such activities as consideration of anti-tamper protection of critical technologies on defense systems, counterproliferation programs and activities, and research and development planning. Similarly, other federal agencies depend on DOD to identify militarily critical technologies. For example, the Departments of Commerce and State rely in part on DOD’s input on what is militarily critical to inform export control decisions. The Federal Bureau of Investigation also needs to be aware of DOD-identified critical technologies to determine which technologies need protection from being acquired or exploited by foreign intelligence collection efforts. In response to the Export Administration Act of 1979, which governs the exports of items with both military and civilian applications, DOD established the Militarily Critical Technologies Program in 1980 to periodically identify and assess technologies that are critical to retaining dominance for the warfighter. The Militarily Critical Technologies Program produces a restricted and a public version of both the MCTL and the DSTL. DOD has contracted with the Institute for Defense Analyses, a federally funded research and development center, since the inception of the program to furnish scientific and technical support in developing and maintaining the lists. The MCTL covers technologies that are of concern in the near term, while the DSTL covers those in the longer term. (See fig. 1 for comparison of the lists.) Program oversight is provided by DOD’s Office of International Technology Security. Over the past 5 years, DOD has provided approximately $2 million annually to support the Militarily Critical Technologies Program. The lists are divided into 20 technology sections (see fig. 2), and each section is developed and updated by a technology working group led by a chair and cochair and composed of experts. Each working group identifies militarily critical technologies and the parameters at which they are critical, based on definitions of what is militarily critical established by the Export Administration Act. Each working group is responsible for one MCTL and one DSTL section covering the same topic, such as aeronautics technology. The Institute for Defense Analyses has established broad guidance for the chairperson of the technology working groups to use regarding the update process. This guidance in part indicates that working groups should consist of experts from government, industry, and academia and that they should reach consensus on what is critical. In updating the MCTL and DSTL, the technology working groups face several challenges, including identifying and engaging experts in the process and interpreting the definition of militarily critical. These challenges increase the importance of DOD’s validation process—a critical check to ensuring the lists are complete and accurate. However, this process is not adequate to provide this assurance. At the same time, the lists are significantly out of date. As a result, the lists are of questionable value. Working group chairs face two key challenges in identifying and selecting experts to participate in the technology working groups that update the MCTL and DSTL. First, participation in the working groups is voluntary, and according to several chairs we spoke with, engaging the experts— including those employed by DOD—can be challenging since some selected experts participate only informally or are unable to participate at all because of competing work priorities. Second, according to DOD and Institute for Defense Analyses officials, it is challenging to determine the parameter at which a particular technology becomes militarily critical and is therefore subject to interpretation by the working group. One chair defines “militarily critical” for the working group, while others rely on the individual interpretations and judgments of the working group members. These inherent challenges in the process place greater importance on the need to validate the lists. To ensure the lists are complete and accurate, DOD components review and validate the working groups’ updates— a process DOD program officials consider a critical check of the working groups’ efforts. Figure 3 lists the DOD reviewers. However, we found a number of weaknesses in this critical check. First, reviewers are unclear about how to validate proposed updates or what factors to consider when reviewing proposed updates. For example, one reviewer indicated that the purpose of the MCTL is to inform decisions on technologies that may need to be export controlled, but was unsure whether the review should validate that the technologies in proposed updates need to be controlled or whether to ensure that parameters of technologies listed are accurate. Reviewers stated that they are not informed as to what is added, deleted, or otherwise changed from one update to the next. Without instruction or information on the updates, validation of the changes to the lists may be little more than a reviewer’s guess. Two reviewers were unsure how to interpret “militarily critical” when reviewing the proposed updates and therefore did not know how to comment. In addition, no guidance is provided to reviewers on factors to consider during the validation process. Second, the reviewers may not have the technical knowledge to validate the updates. Eight reviewers stated they or their organizations lack the necessary expertise to determine whether the lists were complete or accurate. Program officials stated they do not currently have a process to determine whether they have the proper reviewers or if these reviewers are adequately validating proposed updates. Finally, program officials assume concurrence with the lists if reviewers have not provided feedback within 30 days. According to program officials, the process is working well because reviewers seldom provide feedback or comments on proposed MCTL or DSTL updates. However, one-quarter of the reviewers did not review the lists. Specifically, five reviewers told us that they receive MCTL and DSTL updates but do not comment on them. In addition, according to our analysis of the last five updates to the MCTL and DSTL, eight reviewers have provided comments to at least one update. A Militarily Critical Technologies Program goal is to completely update the MCTL and DSTL at least every 4 years by updating about 5 sections of each list every year. According to program officials, this goal was set to keep the lists as current as possible within budget limitations. However, this goal has not been met. The Institute for Defense Analyses produced only one update of the MCTL in fiscal year 2004 and four updates in fiscal year 2005 (see table 1). Furthermore, 9 of 20 MCTL sections have not been updated since 1996—the last time the MCTL was completely updated. The DSTL is also out of date. The institute did not update any sections in fiscal year 2004 and produced only one update in fiscal year 2005. Over the past 5 years, only half of the DSTL sections have been updated (see table 2). Program officials explained that delays were in part the result of internal disruptions to the program due to frequent changes in senior leadership, but were unable to provide information on how they monitor or measure whether goals for updating the lists are being met. Regardless, program officials stated they are satisfied with how the process for updating the lists is working and noted that the lists are available on the Web site for public comment. In 2005, program officials held forums to obtain feedback from list users and participants in the technology working groups about the process for updating the lists. In response to user feedback expressing concern about the process, program officials developed an action plan that in part called for an independent assessment of the MCTL and DSTL process for updating the lists, which was not completed. Instead, a program official began an internal review, concluding that problems stemmed from funding constraints and a lack of senior DOD leadership to support the program. While the MCTL was created to help determine items that need to be controlled, the list has generally not been used to inform export control and DOD policy decisions. Several DOD components have developed their own efforts to catalog critical technologies to meet their needs. The DSTL is also seldom used and may be eclipsed by more extensive DOD efforts. A number of DOD components, including the armed services, as well as the Department of Commerce, do not rely on the MCTL to inform export control or DOD policy decisions. While the MCTL is expected to inform review of export license applications or export control decisions, the Defense Technology Security Administration—which represents DOD on export control decisions—does not use the MCTL for export licensing decisions or to inform DOD’s input to U.S. government export control proposals that are considered by the multilateral export control regime known as the Wassenaar Arrangement. Instead, the Defense Technology Security Administration relies on other sources of information, including technology-specific information from subject matter experts associated with the Institute for Defense Analyses, who may also participate in MCTL updates. According to Defense Technology Security Administration officials, the MCTL is too broad, out of date, and difficult to navigate to be an effective tool for informing export licensing decisions or export control proposals. Officials from the key export control regulatory agencies agreed that the MCTL lacks the specificity and currency needed for export control decisions. These have been long-standing issues. In 1982, we reported that the Departments of Commerce and State and private industry were concerned that the MCTL was not specific enough to be useful as a practical daily guide for export control decisions. Presently, Commerce officials expressed additional concerns that because of delays in updating sections of the MCTL, the list contains items that they have already determined need not be controlled or limited. Further, the chair for the Militarily Critical Technologies Program’s electronics technical working group acknowledged that microprocessors are included as militarily critical on the MCTL at parameters no longer controlled on Commerce’s control list. Because of the lack of specificity and lack of currency, Commerce officials told us that they do not use the MCTL to inform items to control. Instead, they rely on the judgment of the Defense Technology Security Administration. The military services also seldom use the MCTL when reviewing export license applications. In 1996, the Air Force issued guidance instructing personnel not to use the MCTL to inform export control and other decisions. This guidance, which is still in effect today, specifically prohibits the Air Force’s export control specialists, intelligence analysts, investigators, system security engineers, operations security officers, and public affairs officers from using the MCTL to inform export decisions or to determine the importance of military-related technologies. The guidance further states that because the MCTL is out of date, its utility is substantially limited and it may only serve as a desk reference or dictionary to obtain a description of a particular dual-use technology. While Navy officials responsible for export control decisions stated that the MCTL occasionally serves as the starting point to inform decisions, they rely on their own export licensing databases for export control policy. In addition, a senior Navy official stated that even though extensive time and effort go into the development and maintenance of the MCTL, the list does not provide significant value. Navy officials also noted that the MCTL is out of date and raised concerns regarding its accuracy. The Army Director of Policy for Security Cooperation, Resources, and Exports similarly stated the MCTL is inappropriate for being used to inform export control decisions because the lists are too component- and material- focused and do not list specific systems. As with export control decisions, we found that the MCTL is seldom used to inform various DOD policy decisions, including those related to identifying and protecting critical technology on weapon systems, counterintelligence efforts related to critical technologies, and programs reporting on the protection of the defense industrial base. For example, DOD officials stated that they do not directly use the MCTL to inform decisions related to determining whether to use anti-tamper protections. Yet the MCTL is intended to be a primary resource in DOD’s process for identifying critical technologies in defense systems that may require anti- tamper protections to discourage or delay reverse engineering. While officials stated that the MCTL is a starting point to select critical technologies for protection, the MCTL’s limitations—including the fact that it is out of date and does not incorporate previously identified critical technologies or anti-tamper decisions—led the anti-tamper executive agent to develop a more comprehensive tool for identifying and tracking critical technologies that may need anti-tamper protection. The MCTL is intended to be used as a reference for counterintelligence initiatives throughout the DOD intelligence community. Counterintelligence program officials need to know what technologies are critical and which ones are being targeted through foreign intelligence collection activities. Some counterintelligence entities, including the Defense Intelligence Agency and Army Counterintelligence, indicated that the MCTL informs decisions about technologies that should be examined to ensure that each military service protects them in a consistent manner, but have found limitations in using the list. For example, officials from Army Counterintelligence stated that the MCTL is not current enough to inform decisions needed to help the military services consistently track and protect their current technologies. Due to the difficulties in using the MCTL, the Army has developed a program to identify technologies that are critical to individual Army acquisition programs. Defense Intelligence Agency officials stated that the taxonomy of the MCTL technology categories is useful. However, officials have found that some MCTL sections must be augmented with more current critical technology information to help inform decisions. Outside of DOD counterintelligence activities, Militarily Critical Technologies Program officials stated that they are entering into an agreement with the Federal Bureau of Investigation to provide support to the bureau’s critical national assets program. The MCTL is also intended to inform decisions made by the Committee on Foreign Investment in the United States, an interagency committee responsible for reviewing foreign acquisitions of U.S.-based companies to determine whether the proposed acquisition could pose a threat to national security. DOD, which is a member of the committee, provides input through its Office of the Deputy Under Secretary of Defense for Industrial Policy on decisions related to proposed transactions that may involve technologies critical to DOD interests. According to a DOD official, the MCTL is not used to inform these decisions. Instead, DOD relies on input from technical experts in the Directorate for Defense Research and Engineering, who may use the MCTL as one of their many sources of information. In addition, DOD Industrial Policy officials have created a Defense Industrial Base Capabilities Study Series, which in part identifies critical technologies and companies that produce them to help inform DOD input to Committee on Foreign Investment in the United States decisions as well as other DOD policy decisions. The Defense Industrial Base Capabilities Study Series was completed in June 2005 and lists over 1,400 critical technologies. The study series notes that it includes examples of critical technologies that the MCTL should consider incorporating. However, Militarily Critical Technologies Program officials said that the series uses a different definition of critical technology and has not coordinated the MCTL and the series’ lists of critical technologies. Many DOD officials we spoke with were either not aware of the DSTL or seldom used it. For example, officials from the Office of Naval Research and the Naval Research Labs were unaware of the DSTL. Officials from the Army’s Office of the Deputy Assistant Secretary for Research and Technology/Chief Scientist, who were aware of the existence of the DSTL, stated that the DSTL is not useful for informing science and technology decisions because it is overly broad, its taxonomy does not align with Army Research and Technology taxonomy, and its assessments are rarely in consonance with Army Research and Technology subject matter experts. Furthermore, the Army’s Deputy Assistant Secretary for Research and Technology/Chief Scientist maintains sufficient in-house expertise for all required program planning activities and does not require the DSTL to complete mission requirements. In addition, Defense Advanced Research Projects Agency officials indicated that the DSTL has limited applicability to the agency’s research efforts. The DSTL is intended to forecast worldwide technology capabilities that could threaten U.S. technological superiority or surprise warfighters in theater as well as to assist DOD science and technology planning. However, the Defense Technology Security Administration has developed a “Top Ten Technologies” list that identifies emerging technologies. According to Defense Technology Security Administration officials, the Top Ten list is designed to help DOD identify paradigm-shifting technologies on or approaching the horizon to provide a basis for defense proposals on how these technologies should be controlled and to inform decisions on how these technologies might benefit the military. In addition, officials who represent the military services and DOD research and development components have established more extensive efforts to aid science planning and track developing and future technologies. For example, both the Army and the Navy maintain offices and technology centers worldwide to monitor and assess research efforts of foreign governments and industries to both inform science and technology planning and identify rapidly evolving or breakthrough technologies. Army officials explained that the Army’s science and technology research activities, with a fiscal year 2005 annual budget of approximately $1.7 billion, have more expertise to comprehensibly track all areas of developing global technology than the Militarily Critical Technologies Program, which has an average annual budget of $2 million. At the same time, the Directorate for Defense Research and Engineering has developed a Global Technology Knowledge Base, which incorporates the DSTL along with other information provided by the military services. Like the DSTL, the Global Technology Knowledge Base is intended to serve as a broad-based evaluation of foreign technology and an assessment of foreign technology development efforts to assist in the planning of DOD’s science and technology efforts and offers insight into potential collaboration opportunities with foreign entities or utilization of foreign technologies. Although the knowledge base incorporates DSTL information, a Directorate for Defense Research and Engineering official responsible for the knowledge base told us that the DSTL’s value to the database is limited because of currency and reliability issues. DOD has widespread requirements to know what critical technologies are needed to ensure a technological edge for the warfighter. These requirements demand that DOD leadership develop a solid framework for identifying the technologies that will guide critical decisions on what to control and protect. Relying on militarily critical technology lists that are of questionable value is risky—especially in an environment of rapid technological change and redefined national security threats. Without clear and current information on what items are militarily critical, many DOD components have developed their own mechanisms for identifying and tracking critical technologies. While these separate efforts may satisfy parochial concerns, they do not ensure an effective approach for identifying and coordinating information on critical technologies needed to inform decisions on how to protect U.S. security interests. Given the need of numerous programs to know what is militarily critical, we recommend that the Secretary of Defense direct the Director for Defense Research and Engineering to determine users’ requirements and on the basis of those requirements, reassess and clearly define the MCTL’s purpose. If the purpose deviates from its original intent to inform export control decisions, DOD should seek necessary legislative relief. To ensure that users’ requirements are met, we recommend that the Secretary of Defense direct the Director for Defense Research and Engineering, in conjunction with the Under Secretary of Defense for Acquisition, Technology, and Logistics, to examine existing efforts within the department to catalog critical technologies and determine best practices for identifying technologies; using these best practices, develop an approach that best meets user requirements in a timely manner; on the basis of the new approach, identify duplicative efforts, if any; ensure the efficient use of resources; and determine what level of funding is appropriate; develop an implementation plan for the approach, including timelines for execution and implementing guidance or directives; and establish an oversight mechanism to ensure that user needs are met. Given the more expansive existing efforts in DOD to track global science and technology efforts, we also recommend that the Secretary of Defense direct the Director for Defense Research and Engineering to determine the utility of continuing to maintain the DSTL. We provided a draft of this report to DOD and Commerce. DOD concurred with our recommendations. However, it does not plan to take any action beyond what it had already completed or planned to do. DOD asserts that the International Technology Security’s 2005 action plan, developed prior to our review, addresses most of our seven recommendations. DOD also maintains that the MCTL is the only list that assesses technologies from an export control viewpoint. DOD’s comments do not recognize that identifying militarily critical technologies serves multiple interests and that many DOD organizations and other federal agencies have a need to know what is militarily critical. Our findings show that shortcomings in the program have led to products that are not adequately validated as well as too broad and out of date to satisfy users’ needs. DOD’s action plan, which in part discussed steps to meet users’ requirements, was limited. For example, DOD, in the development of the plan, did not include Defense Technology Security Administration or the Department of Commerce—-two key agencies that program products are intended to inform for export control decisions. Further, DOD does not see the possibilities of how examining efforts in the department to catalogue critical technologies and determine best practices could benefit the program. By leveraging knowledge and potential best practices from other efforts, DOD would have an opportunity to take a strategic approach to identify and coordinate information on critical technologies that satisfy users’ needs. Therefore, DOD will need to take additional steps to implement our recommendations. DOD’s letter is reprinted in appendix I. We incorporated DOD technical comments as appropriate. Commerce did not provide formal comments but submitted one technical comment, which we addressed. To assess how the lists are updated, we met with officials from the Militarily Critical Technologies Program and the Institute for Defense Analyses and reviewed relevant program documents, task orders, guidance, directives, and applicable statutory provisions. Using program guidance and documents, we evaluated how the last five updates to the MCTL and DSTL were conducted. Specifically, we reviewed program information on the number and types of experts used to conduct the updates. We interviewed technology working group chairs responsible for 10 MCTL and DSTL sections to determine how experts are engaged in the process for identifying critical technologies as well as how the definition of “militarily critical” is applied to specific technology areas. We identified 20 DOD components responsible for validating updates prior to issuance. We interviewed officials from 19 of the 20 components and determined how they reviewed and validated the updates. We also compared MCTL and DSTL updates over the past 10 years with program-stated goals for updating the lists. To determine how the lists are used, we first identified the uses of the MCTL and DSTL through interviews with program officials and review of program documents and applicable statutory provisions. We discussed uses of the lists with officials from the Office of Industrial Policy, Defense Technology Security Administration, military services, Executive Agent for Anti-tamper, Defense Intelligence Agency, Defense Security Service, Missile Defense Agency, Defense Security Cooperation Agency, Defense Threat Reduction Agency, Joint Chiefs of Staff, Joint Forces Command, Special Operations Command, Strategic Command, and Transportation Command, Defense Directorate for Research and Engineering’s Office of International Programs and Science and Technology, Defense Logistics Agency, Pentagon Force Protection Agency, Defense Contract Management Agency, Office of Special Operations and Low Intensity Conflict, Defense Advanced Research Projects Agency, as well as officials from the Departments of Commerce and Homeland Security. In addition, through interviews with some of these organizations and review of documents they provided, we identified other mechanisms DOD has used to identify critical technologies and determined how these efforts are coordinated with the MCTL and DSTL update process. We are sending copies of this report to interested congressional committees, as well as the Secretaries of Defense, Commerce, and Homeland Security; the Director, Office of Management and Budget; and the Assistant to the President for National Security Affairs. In addition, this report will be made available at no charge on the GAO Web site at http://www.gao.gov. Please contact me at (202) 512-4841 or calvaresibarra@gao.gov if you or your staff have any questions concerning this report. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made major contributions to this report are listed in appendix II. In addition to the contact named above, Anne-Marie Lasowski, Assistant Director; Noah Bleicher; Andrew Edelson; W. William Russell IV; Karen Sloan; Hai Tran; and Joseph Zamoyta made key contributions to this report. Defense Trade: Enhancements to the Implementation of Exon-Florio Could Strengthen the Law's Effectiveness. GAO-05-686. Washington D.C.: September 28, 2005. Industrial Security: DOD Cannot Ensure Its Oversight of Contractors under Foreign Influence Is Sufficient. GAO-05-681. Washington D.C.: July 15, 2005. Defense Trade: Arms Export Control Vulnerabilities and Inefficiencies in the Post-9/11 Security Environment. GAO-05-468R. Washington, D.C.: April 7, 2005. Defense Trade: Arms Export Control System in the Post- 9/11Environment. GAO-05-234. Washington, D.C.: February 16, 2005. Defense Acquisitions: DOD Needs to Better Support Program Managers’ Implementation of Anti-Tamper Protection. GAO-04-302. Washington, D.C.: March 31, 2004. Nonproliferation: Strategy Needed to Strengthen Multilateral Export Control Regimes. GAO-03-43. Washington, D.C.: October 25, 2002. Export Controls: Processes for Determining Proper Control of Defense- Related Items Need Improvement. GAO-02-996. Washington, D.C.: September 20, 2002. Defense Trade: Mitigating National Security Concerns under Exon-Florio Could Be Improved. GAO-02-736. Washington, D.C.: September 12, 2002. Export Controls: Department of Commerce Controls over Transfers of Technology to Foreign Nationals Need Improvement. GAO-02-972. Washington, D.C.: September 6, 2002. Export Controls: More Thorough Analysis Needed to Justify Changes in High Performance Computer Controls. GAO-02-892. Washington, D.C.: August 2, 2002. Export Controls: Issues to Consider in Authorizing a New Export Administration Act. GAO-02-468T. Washington, D.C.: February 28, 2002. Export Controls: Clarification of Jurisdiction for Missile Technology Items Needed. GAO-02-120. Washington, D.C.: October 9, 2001.

Summary: Major acquisitions in the Department of Defense's (DOD) force transformation rely on maintaining technological superiority to ensure U.S. military dominance. Failure to identify and protect critical technologies makes U.S. military assets vulnerable to cloning, neutralization, or other action that degrades current and anticipated capabilities. To help minimize these risks, DOD's Militarily Critical Technologies Program developed and periodically updates two lists of technologies--the Militarily Critical Technologies List (MCTL) and the Developing Science and Technologies List (DSTL). While the lists are primarily intended to inform U.S. export control decisions, they can also inform counterintelligence activities, research plans, and technology protection programs, making MCTL and DSTL fundamental resources for security decisions. To ensure these lists are informative, GAO assessed the Militarily Critical Technologies Program's process for updating the MCTL and DSTL and determined how the lists are used to inform export control and DOD policy decisions. The Militarily Critical Technologies Program's process for updating the MCTL and DSTL has generated lists that are of questionable value. To update the lists, working groups of experts from government, industry, and academia identify militarily critical technologies. However, participation in the working groups is voluntary, and some experts choose not to participate or do not participate fully. Validation of the updates--a critical check to ensure the lists are complete and accurate--also provides little assurance that the lists are of value. More than one-third of the reviewers acknowledged they do not have the technical expertise necessary to validate the updates, and one-quarter did not review the lists. The lists are also out of date. Although a stated program goal calls for all 20 sections of the lists to be completely updated at least every 4 years, about half of the sections on the MCTL--including technologies related to weapons, communications, and biological warfare--have not been updated for 10 years. The DSTL is also out of date; almost half of the sections have not been updated in the past 5 years. With the limited value of the MCTL and DSTL, agencies tend to rely on other information sources to inform export control and DOD policy decisions. According to DOD and Department of Commerce export control officials, the MCTL is too broad, difficult to use, and out of date to inform export control proposals or export licensing decisions. Concerned about the MCTL's accuracy and reliability, the Air Force instructed its personnel not to use the MCTL. The DSTL is also seldom used--in part because some DOD components were not aware of the list. For those components that were aware of the DSTL, some found it only marginally useful because it too is out of date. Several DOD components have developed their own efforts to track global technologies. For example, the Army established international technology centers dedicated to identifying international cooperative opportunities as well as to maintain knowledge of foreign research efforts to avoid technological surprises for the warfighter.