In November 2003, GAO reported that university research is a vital part of the nation’s research and development efforts, primarily funded by the federal government because of the broad consensus that university research is a long-term national investment in the future. The federal investment in university research has yielded thousands of inventions each year that have fostered the development of new technologies, stimulated the creation of new jobs, and improved the quality of life. These benefits come through open communication among scientists and the sharing of research results. A National Academy of Sciences official underscored the importance of this issue in September 2005 congressional testimony, stating that over 55 percent of the engineering Ph.D. students in the United States are foreign-born and that their research helps strengthen the United States in the fastest-moving new technologies, some of which have potential defense-related application. Foreign students and scholars bring needed skills to our increasingly knowledge-based economy, build bridges to other countries and professional communities, and make other valuable contributions to our society. These contributions are particularly important for maintaining our competitiveness, fostering productivity and innovation, and strengthening our workforce. While the United States has long been a global leader in higher education and one of the most desired destinations for foreign students, international competition for the best and the brightest students and scholars is growing. Countries such as China have improved their educational capacities, possibly decreasing the incentives for students and scholars to study in the United States. The recent slowing of foreign student enrollment in United States universities and colleges has raised concerns about the extent to which we will be able to continue attracting talented foreign students and researchers to our universities and to our workforce after they graduate while also maintaining our nation’s security. Recognizing the importance of balancing national security interests with the need to allow the free exchange of information at U.S. academic institutions of higher learning, the federal government is a major funding source for research conducted at U.S. universities and colleges. In fiscal year 2003, the federal government funded almost two-thirds— approximately $29.6 billion—of all basic and applied research funding provided to universities and colleges by external sources (see fig. 1). Other sources of funding come from industry, nonprofit organizations, as well as state and local governments. According to National Science Foundation data for fiscal year 2003, the National Institutes of Health of the Department of Health and Human Services funded approximately 62 percent (about $14.1 billion) of all federally funded science and technology research conducted by universities and colleges. Other federal research funding sources identified by university officials we spoke with include the National Aeronautics and Space Administration (NASA); the National Science Foundation; various Department of Defense agencies, including the Navy and the Defense Advanced Research Projects Agency; and the Departments of Energy, State, and Transportation. This level of government funding was consistent with that of several of the universities we visited, where officials stated that their research is primarily funded by government grants and contracts, including contracts that are directed toward industry and subsequently subcontracted, or “flowed through,” to universities. Over the past several decades in which the current export control system has been in effect, the global economy has changed significantly. DOD continues to seek innovative technologies to meet the needs of warfighters and to counter technologies developed by potential U.S. adversaries. To achieve these ends, DOD has become more willing to rely on the nondefense industry to supply its needs. DOD increasingly relies on commercial research, for areas such as information systems and telecommunications, where the cutting edge of technological advancement lies. Such advances in communications technology have been made possible to a large extent by basic research, much of which was initially developed in universities and often involved foreign students and scholars. The U.S. export control system relies on the ability of exporters to recognize when certain goods and services meet the criteria for requiring an export license. The system is primarily divided between two regulatory regimes, one managed by the Department of State and another managed by the Department of Commerce. The regimes require export licensing for defense-related items and information, including data, except where exclusions apply. Both regulatory regimes include exclusions applicable in some circumstances to universities and other academic institutions of higher learning. The U.S. export control system places the onus on universities and other exporters to understand and comply with the export control regulations. The Department of State Directorate of Defense Trade Controls (DDTC) manages defense items through the International Traffic in Arms Regulations (ITAR). State issues export licenses based on the U.S. Munitions List, which identifies defense articles, services, and related technical data that are controlled for export. Moreover, the regulations state that unless otherwise expressly exempted or excluded, an export license is required for the oral, visual, or documentary transmission of technical data by U.S. persons to foreign persons, by such means as in- person or telephone discussions and written correspondence including electronic messages, even when they are in the United States. The U.S. Munitions List contains 21 categories, covering items such as weapons, chemical and biological agents, missiles, and both commercial and military satellites. The Department of Commerce’s Bureau of Industry and Security (BIS) manages dual-use items, having both military and commercial applications, through the Export Administration Regulations (EAR). Under these regulations, exporters are to obtain prior government authorization in the form of a license from BIS, or determine that a license is not needed, before exporting dual-use items. Commerce requires an export license for the release of technology or software source code to a foreign national because such a release is deemed to be an export to the home country or countries of the foreign national, even if the person is in the United States. Commerce regulates the dual-use items specified in the EAR’s Commerce Control List, which are controlled for a variety of reasons, including restricting exports that could significantly enhance a country’s military potential, preventing exports to countries that sponsor terrorism, and limiting the proliferation of chemical, biological, and nuclear weapons and their delivery systems. The Commerce Control List has 10 categories covering items such as electronics, computers, telecommunications, and avionics. Most of the universities we visited aim to ensure that their research remains unrestricted and in the public domain by conducting fundamental research, which is generally excluded from export controls. To ensure that most of the research conducted on their campuses does not require an export license, these universities negotiate to exclude any restrictions on publishing and disseminating the results of the research they consider to be fundamental. For research that may be subject to export control regulations, the universities we visited have taken steps to ensure that their personnel are informed about and comply with these regulations. According to most university officials, their institutions conduct basic and applied science and engineering research in a wide variety of areas, producing findings that are conducted, shared, and published openly within a broad community that includes international students and scholars. Table 1 lists examples of research areas conducted at universities that we visited. Most officials we spoke with stated that their universities specifically seek out research contracts and grants that do not restrict their ability to conduct fundamental research by extensively screening and reviewing the terms of potential contracts and grants. If a contract includes restrictions on fundamental research, some universities attempt to negotiate the restrictive language out of the contract. Some university officials noted that such negotiations have become more frequent because government and industry contracting officials are increasingly inserting restrictive language in contracts for research that universities consider to be fundamental. For example, according to university officials, DOD agencies sometimes insert standard acquisition regulations language that prohibits the contractor from releasing information, even unclassified information, outside of the contractor’s organization. According to university officials, a rule proposed by DOD would have restricted universities from sharing information with other academic institutions and publishing research or otherwise making such information available in the public domain. DOD revised the rule to minimize the impact on fundamental research conducted at universities and acknowledged that the free exchange of ideas is a foundational concept of U.S. research and educational institutions. Several universities we interviewed stated that if they are unsuccessful in negotiating the restrictive language out of those research contracts they consider to be fundamental, they sometimes reject the opportunity to participate in the research. For research subject to export control restrictions, universities may modify the way the research is conducted to avoid the export license application process—a process some officials characterized as time- consuming and complicated. For example, officials at one university said that instead of applying for an export license for one project, they opted to use only researchers who are excluded from export license requirements, such as U.S. citizens or foreign nationals with permanent residency status. In other cases, university officials stated they move export-controlled work to off-campus facilities and laboratories administered by the universities or the entity sponsoring the contract, where such research can be better segregated and controlled. At the six university-administered laboratories that we visited, each used access control systems such as badges and computer passwords. Such restrictions limiting access to information at laboratories are not as common on the main campuses we visited, where research information is more openly available. According to a State official, U.S. export control regulations are designed for “self-compliance.” For the academic community specifically, State officials said that it is the universities’ responsibility to conduct due diligence to determine whether their research activities are subject to export laws, and to identify whether an export license is required for foreign nationals within their purview. University officials we spoke with have taken actions to become educated on complex export control regulations—an undertaking that several officials indicated requires an extensive time commitment because the government does not provide sufficient guidance. Some universities have also dedicated other resources to ensure they comply with U.S. export control laws, such as hiring legal counsel. To understand export control regulations, universities we visited frequently rely on agency training and guidance. Several university officials stated that they had attended training seminars sponsored by Commerce, as well as conferences sponsored by the Society for International Affairs, a nonprofit defense trade industry association that sponsors events such as conferences and workshops to educate and instruct the export community on all aspects of defense and commercial exports and technology transfers. Most university officials indicated that they also accessed Commerce and State Web sites or their respective telephone help desks. However, several university officials indicated that the agency training and guidance have limited utility for academic institutions. For example, according to some university officials, training provided by Commerce and State does not discuss how export regulations apply to universities that have fundamental research exclusions. One university official characterized the Commerce-sponsored session that he attended as being “entry level” training directed at the corporate community. Commerce officials have acknowledged that about 95 percent of the attendees at their seminars are repeat attendees, primarily from industry. Some university officials stated that the training was too narrowly focused on topics that do not pertain to universities. University officials also raised concerns with State’s and Commerce’s Web-based guidance. Some university officials characterized the Web-based information provided by Commerce and State as being unclear or only providing a general introduction to a topic without providing sufficient details to fully answer questions concerning export controls. For example, a university official stated that the Commerce and State Web sites do not identify which forms universities need to submit in seeking export licenses to involve foreign researchers in certain research. Also, although some university officials indicated that Commerce and State officials provide very useful information via the telephone help desks, they stated that getting immediate help was difficult at times and that return messages were untimely. To further their understanding of export control regulations, several universities have sought out other sources of information, specifically sources tailored to universities. Several university officials indicated that they rely on best practices by other universities that have shared and developed approaches for addressing different export control issues, including the Massachusetts Institute of Technology, Stanford University, and the Universities of Oklahoma and Maryland. For example, officials from one university said that they have relied on other universities for guidance on applying for export licenses. Universities and academic associations exchange best practice information through seminars and workshops sponsored by nongovernmental organizations, such as the Association of American Universities, the Council on Governmental Relations, and the National Council of University Research Administrators. Many of the universities that we visited have also developed written guidance and training to help educate university personnel on their responsibility to comply with the export control regulations. For example, officials from one university we visited have developed a Web-based decision tree to assist university personnel in determining the applicability of export controls to their research projects. Officials from another university stated that their research institution requires that all staff take training—available on the university’s intranet site—related to the handling of controlled information. Another university adopted a targeted strategy of export control education for its researchers, reaching out to the researchers and programs most likely to be affected by export controls, such as those in engineering. A number of universities we visited have invested in other resources to ensure they comply with export control regulations. Some hire outside legal counsel who specialize in export controls. For example, one university routinely employs outside counsel to mitigate the risk of committing violations, because of the severity of the penalties for noncompliance. According to officials at another university, thousands of dollars are spent each year for legal services addressing export controls. Finally, two universities we visited use a software program to help determine if a proposed research project grant or contract is subject to export license requirements. According to officials at these two universities, the software program helps to facilitate a process that is very difficult, time-consuming, and costly because of the length and complexity of U.S. export control regulations. State and Commerce officials indicated that their top priority is processing the thousands of license applications received annually—the vast majority of which are from industry—leaving few resources for guidance and outreach to exporters. However, they expressed concerns that universities may be misinterpreting their responsibilities under export regulations and that the potential may exist for foreign nationals to access sensitive information on U.S. campuses. Despite these concerns, neither agency has analyzed available information on university research and foreign student populations to determine the potential risk of the illegal transfer of controlled information. According to Commerce officials, BIS receives approximately 1,000 deemed export license applications per year. Officials confirmed that most of these applications are received from industry. For example, Commerce officials stated that of the 865 deemed export licenses processed by Commerce in fiscal year 2006, 99.7 percent were from industry. These same officials noted that over the last few years, only two universities have submitted deemed export license applications. A 2004 Commerce Inspector General report stated that license application data suggest that many industries (including chemical and biotechnology industries), academic institutions, and federal research facilities that may employ or host foreign nationals are not applying for deemed export licenses. State and Commerce officials stated that beyond processing export licenses, few resources remain for providing outreach and guidance to the export community. While both agencies provide guidance and outreach through conferences cosponsored with other organizations and agency- sponsored training, much of their outreach is directed at industry, and not the academic community. Commerce cosponsors approximately 45 formal seminars annually, along with specialty seminars on deemed exports ranging from basic to advanced. As its principal training activity, State provides speakers for export licensing conferences that are organized by the Society for International Affairs and tailored to the needs of industry and government participants. An official acknowledged that State is unable to fill all of the speaking requests that it receives, which number in the hundreds each year. Instead, State responds to requests based on the availability of personnel and travel funds. From January 2004 through June 2006, State officials approved their personnel to participate in approximately 135 outreach activities and events. Officials at both agencies indicated that their visits to or staffing of training seminars for the academic community are often in response to specific invitations from universities. A State official who is responsible for export outreach reported that since 2003, only one event has been held that was specifically targeted to the academic community. While State policy officials have indicated that they would like to conduct more conferences for universities in the future, the official responsible for these conferences stated that none are currently scheduled because of limited resources. For Commerce, one official has noted that more universities have recently begun attending its training seminars. However, while Commerce stated it has increased its outreach to universities in the last few years, GAO analysis of its outreach records indicated that several events that Commerce categorized as targeted at universities were provided to government research entities instead. In addition to conferences and agency-provided training, both State and Commerce maintain telephone help desks and Web sites for exporters to obtain guidance on export controls. State employs a three-person response team to answer telephone inquiries and provide informal advice on export control issues in response to the thousands of calls received monthly from industry and academic institutions. Officials have indicated that they have improved help desk response times. Commerce’s and State’s Web sites provide exporters with guidance on when a license is needed and how a license can be procured. However, information is aimed at a more general audience, although a Commerce official stated that the agency has posted more background information on the fundamental research exclusion on its Web site. State officials noted that they have made their Web site more user-friendly and taken steps to expand the Web site to provide additional guidance to exporters. Although State and Commerce have separate export control jurisdictions, the 2004 interagency Offices of Inspector General report stated that Commerce and State could improve their outreach by providing joint training that explains the differences between the two agencies’ licensing requirements and procedures—a recommendation that, according to the report, was supported by company and academic officials. Furthermore, previous GAO reports have recommended that Commerce and State should better coordinate their efforts on analysis and export oversight. However, State and Commerce have taken few actions to coordinate their outreach efforts to universities. Though State engaged in six outreach events with Commerce between November 2003 and April 2004, a State official explained that staffing such joint events with Commerce remains difficult because State must use personnel from its licensing staff to participate in these events. With a backlog in license applications, the processing of applications is a priority, and the agency is reluctant to divert those personnel to outreach efforts. State and Commerce officials expressed concerns that despite the export control exclusions for university research, the potential may exist for foreign nationals to access controlled defense and dual-use technologies and information on U.S. campuses. However, neither State nor Commerce has analyzed available data on university research contracts or student fields of study to identify any potential risk to export-controlled information at universities. According to federal internal control standards, agencies need to conduct risk assessments that generally include estimating the risk’s significance and likelihood of occurrence, deciding how to manage the risk and determining what actions should be taken. In the absence of an assessment of export control vulnerabilities at universities, State officials and a Commerce Inspector General report stated they were concerned that academic officials may be misinterpreting export control regulations and guidance. According to State officials, universities are unaware of the nuances of export control regulations. Specifically, they said universities have difficulty distinguishing and tracking export regulations when a specific project develops from basic to fundamental or applied research. For example, one State official questioned whether universities devote sufficient resources to export compliance and apply for export licenses with State and Commerce to the extent their research activities warrant. This official believes that academic institutions should designate individuals responsible for understanding export control regulations and tracking exports, just as companies do. However, most of the academic institutions we visited had designated officials who were responsible for export control issues. Despite these concerns, Commerce and State have not fully assessed university compliance information to identify the potential for export control vulnerabilities in university research. Commerce and State are tasked with export control oversight, including administering policy, processing licenses, and reviewing compliance by exporters. According to State officials, the department lacks the personnel to conduct extensive compliance audits. Instead, State relies on voluntary disclosure of possible export control violations—primarily by companies. When a company notifies State of a possible export violation, State may visit the company to discuss the problem and offer advice on weaknesses in the company’s export control program. According to State officials, State does not target universities for compliance and has not visited a university because universities make up a small percentage of all exporters. Officials stated that Commerce’s formal compliance review program is focused on deemed export license holders, the majority of which are from industry. Commerce does not conduct analyses to determine whether academic institutions that have not applied for licenses are in compliance with export control regulations. Instead, Commerce uses leads generated by intelligence agencies, internal Commerce sources, or the public via a hotline to investigate possible cases of export control violations. Furthermore, although Commerce gathers information about certain universities’ research activities on case-by-case basis, neither Commerce nor State analyzes available federal agency data on university research subjects to identify trends or determine the potential for such research to be subject to export control regulations. Given that much of the research conducted at U.S. universities is federally funded, data from other government agencies on the subjects of research conducted at academic institutions could supplement data from Commerce and State. For example, DOD and NASA fund research at universities, some of which involves technologies that could become export controlled. General information on federal contracts available through the Federal Procurement Data System could also provide information on universities doing high volumes of research for other federal agencies. However, neither Commerce nor State makes use of these data sources to analyze trends in university research. Commerce, instead, relies on Internet searches or publicly available data on university research when preparing to meet with academic officials. Other data could help Commerce and State identify potential risks of export control violations at academic institutions. Commerce officials stated that some foreign nationals on U.S. campuses are from countries that have historically tried to unlawfully obtain information about American technologies. However, while Commerce uses visa application data to generate leads for specific cases of deemed export violations, it does not use other data on foreign students’ and scholars’ majors or fields of study to identify potential areas of risk. For example, the Department of Homeland Security administers the Student and Exchange Visitor Information System—a database that tracks student nationality, school enrollment, and changes to major or field of study—but within the past 3 years neither State nor Commerce has requested these data from Homeland Security for the purposes of assessing export control risks. While a Commerce official indicated that the department would like to work with Homeland Security in the future, there is currently no information sharing between the two agencies for the purpose of identifying trends in student populations. Similarly, State does not use its Visas Mantis program—a security review procedure that aims to identify visa applicants who may pose a threat to U.S. national security by illegally transferring sensitive technology—to identify trends of foreign students and scholars and their fields of study, although it occasionally receives alerts about individuals who might pose an export control risk. To improve controls at universities, in 2005 Commerce solicited information on the impact of a proposed rule change that would have modified the definition of the use of export-controlled equipment by foreign nationals, which was recommended by the Commerce Office of Inspector General. Commerce received more than 300 comments in which many cited the potential impact on university research, including numerous comments that the modified definition would capture too many routine operations carried out by students and employees and would thus create a large and generally unnecessary compliance, financial, and administrative burden for universities, and an increased licensing burden on Commerce. Subsequently, Commerce withdrew the advanced notice of proposed rule change in May 2006. Recently, U.S. export regulatory, oversight, and law enforcement agencies have taken some steps to engage the academic community on export issues. For example, in September 2006, Commerce established the Deemed Export Advisory Committee to address broad export control issues. Specifically, the committee’s charter is to review and provide recommendations to Commerce on deemed export policy. Thus, this committee will be responsible for ensuring that the deemed export licensing policy protects national security while ensuring that the United States continues to be at the leading edge of technological innovations. Its membership includes high-ranking university officials and chief executive officers of companies. According to Commerce officials, the committee members will serve for approximately one year. Commerce officials stated that they plan to address the issue of fundamental research in the committee’s work and to include participation by a number of export control agencies in committee meetings. Commerce highlighted one such issue in a May 2006 Federal Register notice where it described the difference between the academic community views that export controls would only apply to the results of research, and the Commerce view that export controls can also apply to the conduct of research. In September 2005, the Federal Bureau of Investigation established a separate forum to improve its lines of communication with the academic community. The National Security Higher Education Advisory Board— consisting of the presidents and chancellors of several prominent U.S. universities—aims to foster outreach and to promote understanding between higher education and the Federal Bureau of Investigation. The board will provide insight on the higher education culture of openness, academic freedom, and international collaboration and dialogue on issues such as terrorism, counterintelligence, and homeland security. In addition, the Department of Homeland Security's Project Shield America aims to work with exporters of U.S. technologies that could be illegally exported, in particular, technologies used in weapons of mass destruction. According to a DHS official, the project's first outreach effort specifically targeting the U.S. academic community was scheduled to be held at the beginning of December 2006. Balancing the desire to attract gifted foreign research scientists to U.S. universities and the need to ensure that export-controlled research at universities is not compromised is a considerable challenge. Since government agencies place the responsibility for complying with export control regulations on universities and other exporting entities, it is essential that Commerce and State, the two agencies primarily charged with administering export regulations, understand whether universities correctly interpret and apply relevant export control policies and regulations when deciding whether their research is subject to export controls. Despite some concerns that universities may not understand their responsibilities when conducting research, Commerce and State have not leveraged available government information and assessed potential risks of illegal transfers of export-controlled information at universities. Furthermore, although Commerce and State have separate export control jurisdictions, the lack of coordination between these agencies on outreach, analysis, and oversight could hamper their ability to determine whether export-controlled information may be at risk of transfer to foreign nationals in the course of university research. Without such knowledge, the government agencies cannot determine whether their guidance and training for universities is appropriate and sufficient and whether their resources are strategically targeted to optimize their ability to regulate and monitor universities’ research. Until Commerce and State take such steps, sensitive information may remain vulnerable to improper transfer, potentially putting at risk U.S. national security interests. To improve the Department of Commerce’s oversight of export-controlled information under its jurisdiction at universities, we recommend that the Secretary of Commerce direct the Administrator of the Bureau of Industry and Security to strategically assess potential vulnerabilities in the conduct and publication of academic research by becoming more knowledgeable about research being conducted on university campuses and, in consultation with other agencies, make use of available information on technology development and foreign student populations at universities to assess the extent to which research at universities may be subject to export controls and on the basis of this assessment of university research and foreign student populations, improve interagency coordination, conduct additional outreach, and improve guidance to ensure that universities understand when to apply export controls. To improve the Department of State’s oversight of export-controlled information under its jurisdiction at universities, we recommend that the Secretary of State direct the Director of the Directorate of Defense Trade Controls to strategically assess potential vulnerabilities in the conduct and publication of academic research by becoming more knowledgeable about research being conducted on university campuses and, in consultation with other agencies, make use of available information on technology development and foreign student populations at universities to assess the extent to which research at universities may be subject to export controls and on the basis of this assessment of university research and foreign student populations, improve interagency coordination, conduct additional outreach, and improve guidance to ensure that universities understand when to apply export controls. We provided a draft of this report to the Departments of Commerce, Defense, Homeland Security, and State for their review and comment. Commerce and State provided written comments, which are reprinted in appendixes II and III, respectively. Defense did not have any comments on our draft report. Homeland Security provided technical comments, which are incorporated as appropriate throughout the report. The Department of Commerce generally agreed with the report’s recommendations, and stated that the Deemed Export Advisory Committee will aid in this respect. However, Commerce stated that Student and Exchange Visitor Information System (SEVIS) data are too general for use in identifying whether foreign students and scholars are subject to deemed export license requirements and that the collection of more specific visa application information is needed to assess vulnerabilities. While we agree that additional information from the visa application process could be useful, we found that SEVIS data include information that State and Commerce could use to perform general trend analysis to determine where best to focus outreach and compliance efforts at the university level. For example, an analysis of the majors that foreign students and scholars are pursuing at universities with large federal research contracts could provide Commerce and State with a proactive plan for targeting their outreach and training efforts for the academic community. Furthermore, while Commerce states that about one-third of its outreach events focus on the academic community, as our report states, we found that several of the events that Commerce classified as academic outreach were actually targeted at government research entities. Finally, Commerce correctly notes that our report focuses on fundamental research or other research that may be subject to export controls while excluding other research that falls outside of the export control universe. We identified the application of the fundamental research exclusion as a significant issue between the academic community and Commerce, and as Commerce’s letter notes, some universities could benefit from a better understanding of deemed export control requirements. Our report indicates that an assessment of the vulnerabilities will best allow Commerce to focus its outreach and training efforts toward addressing this issue with the academic community. State agreed with our recommendation to improve interagency coordination on training and guidance for universities and disagreed with our report’s finding that it does not assess the potential vulnerabilities associated with export-controlled information at academic institutions. State responded that it is currently working with the Department of Commerce and the Department of the Treasury to conduct an export control conference during 2007 specifically aimed at universities. As we recommended in our report, such outreach that is specifically targeted to the academic community, particularly in coordination with other agencies, could improve universities’ understanding of regulations concerning export controlled information. However, while such outreach may help universities seeking guidance on deemed export regulations, State would benefit from strategically assessing vulnerabilities at universities using readily available data, such as SEVIS, to help the department identify and address areas of potential risk. While State disagreed with our recommendation, in its response it noted that it is considering conducting such an assessment. A trend analysis conducted on SEVIS and federal procurement data would be a valuable investment in providing a proactive plan for targeting outreach and training for universities. State also provided technical comments, which we incorporated throughout the report, as appropriate. We are sending copies of this report to appropriate congressional committees and to the Secretary of Commerce, the Secretary of Defense, the Secretary of Homeland Security, and the Secretary of State. Copies will be made available to others upon request. In addition, this report will be available at no charge on the GAO Web site at http://www.gao.gov. If you or your staff have any questions about this report, please contact me on (202) 512-7333. Key contributors to this report are acknowledged in appendix IV. To describe the nature of the research conducted at universities and identify the steps they have taken to comply with government export control regulations, we interviewed and obtained documentation from officials at 13 universities in positions such as vice chancellor for research, director of compliance, and general counsel. We conducted our review at the following 13 universities: Boston University, Boston, Massachusetts; California Institute of Technology, Pasadena, California; Carnegie Mellon University, Pittsburgh, Pennsylvania; Colorado State University, Fort Collins, Colorado; George Washington University, Washington, D.C.; Johns Hopkins University, Baltimore, Maryland; Massachusetts Institute of Technology, Cambridge and Lexington, Massachusetts; Stanford University, Stanford, California; University of California at Berkeley; University of California at Los Angeles; University of Colorado at Boulder; University of Maryland at College Park; and the University of Southern California, Los Angeles, California. To get a general overview of the nature of research at universities, we also spoke by telephone with officials from the Association of American Universities, Association of University Technology Managers, National Council of University Research Administrators, and the Southwest Research Institute. To systematically select the universities that we visited, we cross-tabulated data on universities with large numbers of international students or scholars, those that are associated with federally funded research centers, those that had applied for International Traffic in Arms Regulations or Export Administration Regulations export licenses, and those that had high-dollar contracts with either the Department of Defense or other government entities. While some of the selected academic institutions fall within the top tiers across the selection criteria, their views stated in this report do not represent those of the entirety of the U.S. academic community. To assess Commerce’s and State’s efforts to determine the risk of export violations in university research, we interviewed officials from the Bureau of Industry and Security of the Department of Commerce and its related export offices: National Security and Technology Transfer Controls, Exporter Services, Export Administration, Export Enforcement. We also interviewed officials in the Department of Commerce’s Offices of General Counsel and Inspector General. At the Department of State, we interviewed officials and reviewed data from the Bureau of Political- Military Affairs’ Directorate of Defense Trade Controls, the Bureaus of Consular Affairs and International Security and Nonproliferation, and the Office of the Inspector General. We obtained and analyzed regulations, guidance, and training documents from these departments. We also collected data and other documentation and met with officials from the Office of Defense Procurement and Acquisition Policy of the Department of Defense and the Department of Homeland Security’s Immigration Policy Directorate and U.S. Immigration and Customs Enforcement. We conducted our work from March 2006 through November 2006 in accordance with generally accepted government auditing standards. John Neumann, Sharron Candon, Gregory Harmon, Arturo Holguin, Angela Thomas, and Sandra Moore made key contributions to this report. Other key contributors include Marie Ahearn and Karen Sloan.

Summary: Foreign students and scholars have made substantial contributions to U.S. research efforts and technology development. However, according to a federal government intelligence assessment, foreign access to sensitive U.S. technology has imposed a significant but unquantifiable cost to the United States. Given this risk, GAO was asked to (1) describe the nature of the research at universities and identify steps they take to comply with export controls and (2) assess efforts by the Departments of Commerce and State--the key export control agencies--to determine the risk of export violations in university research. GAO reviewed Commerce and State export control programs and met with officials from 13 universities, selected based on their foreign student populations, applications for export licenses, and federal grants and contracts. The U.S. export control system requires export licensing for defense items and items that have both commercial and military applications, except where exclusions apply, such as those applicable to universities in some circumstances. The U.S. export control agencies place the onus on universities to understand and comply with the regulations. According to university officials we interviewed, their institutions focus almost exclusively on fundamental research--defined as basic and applied research in science and engineering, the results of which ordinarily are published and shared broadly within the scientific community. Such research is generally not subject to export controls. Universities we visited conduct research in such areas as nanotechnologies, computer security, and chemical engineering. To ensure their research remains in the public domain, university officials said they negotiate contract language to remove publication or other dissemination restrictions for research they consider to be fundamental. If export controls apply, university officials stated they sometimes involve only those students eligible to conduct the research under a license exclusion, to avoid the lengthy license application process. In other cases, they refer such work to off-campus associated facilities that can better regulate and control foreign national access to the research. Universities we visited indicated that government-provided training and guidance on export control regulations is limited in informing their efforts to manage and protect export-controlled information in the university environment. State and Commerce officials expressed concerns that universities may not correctly interpret and apply export regulations, given the large number of foreign students participating in research at universities and the relative lack of license applications from universities. Although federal internal control standards contain guidelines for agencies to conduct risk assessments, State and Commerce have not conducted an overall assessment of available trend data on technology development research and foreign participation in such research at U.S. universities to identify potential vulnerabilities. For example, U.S. government agencies collect data on foreign student nationality, school enrollment, and types of research conducted at universities for federal agencies, which could supplement information that State and Commerce receive from visa application processes and other sources. Although State and Commerce provide guidance through training seminars, agency Web sites, and telephone help desks to assist exporters in understanding and complying with regulations, officials stated that their focus is on processing export license applications--primarily from industry. Recently, Commerce established an advisory committee composed of industry and university representatives who are expected to discuss issues such as the nature of university research and its relation to export controls.