Under the U.S. export control system, agencies expect companies to be responsible for determining if the items or information they intend to export are controlled by the government’s export control regulations and for implementing procedures to safeguard their protection and transfer. The corresponding regulations are designed to keep specific military and dual-use items and technologies from being diverted to improper end users. These export control regulations, initially established more than 30- years ago, aim to balance national security, foreign policy, and economic interests. In today’s global economy, U.S. companies’ exchanges of technology and information occur with ease and include the transfer of export-controlled technologies to foreign nationals through routine business practices such as transmission of a data file via an e-mail sent from a laptop computer, cell phone, or a personal digital assistant, using company electronic networks to make intra-company transfers of information to overseas subsidiaries or affiliates, visual inspection of U.S. equipment and facilities during company site e-commerce transactions—sales of software over the Internet to oral exchanges of information when working side-by-side with U.S. citizens. See figure 1 for an illustration of various types of exchanges of export- controlled information in relation to the export of goods. While an export often involves the actual shipment of goods or technology out of the U.S., under Commerce’s and State’s export control regulations, transfers of U.S. export-controlled information to foreign nationals within the U.S. are also considered to be an export to the home country of the foreign national and thus may require an export license. For export control purposes, the term “foreign national” includes any person who is not a U.S. citizen or lawful permanent resident. The U.S. government’s controls on the export of defense-related items are primarily divided between the departments of Commerce and State, with the assistance of the Department of Defense (DOD). Department of Commerce: Commerce, through its Bureau of Industry and Security (BIS), controls the export of dual-use items and information primarily through implementation of the Export Administration Act. Commerce’s Export Administration Regulations (EAR) establish the Commerce Control List, which generally contains detailed controls for dual-use items. BIS has two branches: Export Administration and Export Enforcement. Export Administration is responsible for processing export license applications, outreach, and counseling efforts to help ensure exporters’ compliance with the EAR as well as monitoring certain license conditions to determine exporters’ compliance with their conditions. Export Enforcement investigates alleged dual-use export control violations and coordinates its enforcement activities with other federal agencies, such as the Department of Justice’s Federal Bureau of Investigations (FBI) and the Department of Homeland Security’s Customs and Border Protection (CBP). Department of State: State, through its Directorate of Defense Trade Controls (DDTC), regulates exports of defense items and information under the authority of the Arms Export Control Act. State’s International Traffic in Arms Regulations (ITAR) provides controls over defense articles and services, which are identified in broad categories on the U.S. Munitions List (USML). DDTC works to implement and enforce these laws and regulations using three key offices: Licensing, Compliance, and Policy. The Office of Licensing is responsible for reviewing license applications and addressing correspondence from exporters, such as providing advice on questions to businesses, known as advisory opinions. The Office of Compliance checks for company violations of the export regulations and conducts end-use checks on exports and company visits to achieve this goal. The Policy Office provides training through a third party organization, and outreach to companies on the export regulations. DOD: The Defense Technology Security Administration (DTSA) represents DOD on export control issues and administers development and implementation of technology security policies for the international transfers of defense-related goods, services and technologies, which DOD oversees. DTSA serves an advisory role in State’s and Commerce’s export license review processes and offers technical reviews on licenses for national security concerns. DTSA may also provide guidance regarding commodity jurisdiction requests from State, and DTSA often issues advice regarding advisory opinions submitted to both State and Commerce. The agency is responsible for maintaining contact with industry regarding changes in technologies and licensing initiatives. DTSA plays a significant role in coordinating any proposed changes to the ITAR or EAR, with DTSA’s opinion serving as the final DOD position regarding such matters. Recent congressional hearings and intelligence reports have highlighted threats to U.S. companies’ sensitive information—such as intellectual property, trade secrets, and financial data—from foreign economic and military surveillance and the associated challenges of balancing U.S. security and economic interests. These threats may weaken U.S. military capability and hinder U.S. industry’s competitive position in the world marketplace. According to a recent counterintelligence estimate, factors that have contributed to U.S. economic and technological success have also facilitated foreign entities’ technology acquisition efforts. For example, the openness of the United States has provided foreign entities easy access to sophisticated technologies; new electronic devices have vastly simplified the potential for illegal retrieval, storage, and transportation of massive amounts of information, including trade secrets and proprietary data; and information systems that create, store, process, and transmit sensitive information have become increasingly vulnerable to hacking attempts. The challenges to the government in protecting export-controlled information at companies are interrelated to the challenges we previously reported facing the departments of Commerce, State, and Defense in overseeing the export of controlled technologies in today’s rapidly evolving international security and business environments. For example, in June 2006, we reported Commerce has not systematically evaluated the overall effectiveness and efficiency of its dual-use export control processes to determine whether it is meeting its goal of protecting U.S. national security and economic interests in the wake of the September 2001 terror attacks. In 2005, we reported that State has not made significant changes to its arms export control regulations in response to the terror attacks. U.S. government export control agencies have less oversight on exports of controlled information than they do on exports of controlled goods. Commerce’s and State’s export control requirements and processes—such as export documentation, reporting requirements, and monitoring— provide physical checkpoints on the means and methods companies use to export controlled goods to help them ensure such exports are made under their license terms, but the agencies cannot easily apply these same requirements and processes to exports of controlled information. Consequently, U.S. export control agencies rely on individual companies to develop practices for the protection of export-controlled information. Officials from one third of the companies we interviewed told us they do not have internal control plans to protect their export-controlled information. Government export control processes provide physical checkpoints for the export of goods, but the same checkpoints are not easily applied to electronic and other intangible transfers of export-controlled information. Both Commerce and State oversee exports of goods and information— regardless of their form or method of transfer—through their licensing and compliance programs. Both agencies’ programs require companies to apply for export licenses under their respective regulations and to keep records on such exports for possible agency monitoring and inspection. However, certain export documentation, agency reporting requirements, and agency monitoring processes for exports of controlled goods are not easy or practical to apply to the oversight of exports of information, which limits the agencies’ ability to monitor exports of licensed controlled information. Means of Transportation or Transfer Reported on Export Documentation: When shipping a controlled good overseas, a company is generally required to file a Census Bureau Shippers’ Export Declaration (SED) form with CBP, within the Department of Homeland Security.Companies generally are required to file the SED form for every export made under a specific license, which requires companies to specify the method of transportation for the exported goods, such as vessel or air. However, exports of controlled information transmitted electronically or in an otherwise intangible form are specifically exempted from SED filing. Commerce and State export license applications require exporting companies to report the name of the freight forwarder or other agents to be used for the shipment of goods, which provides the agencies with some oversight on how companies intend to conduct such exports. However, agency export license applications do not require companies to report information on the means of transmission they intend to use to transfer export-controlled information. In the absence of information on the means of transmission used to export-controlled information, Commerce and State lack information that could help provide some level of oversight as they do for physical shipment of goods. Agency Reporting Requirements: Certain agency reporting requirements for goods do not apply to export-controlled information. Companies are generally required to present the SED form before any export. As previously described, the SED Form is not required for electronically transmitted export-controlled information. Further, companies are not otherwise required to notify Commerce when exports of licensed controlled information take place. While in certain circumstances State requires companies to notify it when they transmit licensed export-controlled information, this requirement only applies to the first instance of transfer. Beyond these notifications, Commerce and State cannot be sure that all exports of controlled information under the license are made to the designated end-user and are within the terms of the license approval. Agency Monitoring: Commerce and State monitor exports to help ensure company compliance with license requirements and to assess industry areas where export licenses may be required. However, the two agencies’ efforts focus on export-controlled goods, and not information, due in part to the nature of transfers of export-controlled information, which makes elements of agency monitoring processes inapplicable. For goods, the SED can be used to aid the government in tracking exported goods and determining whether or not they reach the specified end-user. The SED also provides a feedback mechanism, which the lead export-control agencies may use to measure the effectiveness of their activities and processes. A similar feedback mechanism does not exist for export-controlled information transmitted electronically and by other intangible methods.