We found weaknesses in the implementation of NASA’s export control policy and procedures concerning the CEA function and foreign national access procedures, which increase the risk of unauthorized access to export-controlled technology. Variations in CEA Position, Function, and Resources: NASA’s export control policy provides the CEA the responsibility to ensure compliance of all Center program activities with U.S. export control laws and regulations and states that the position should be “senior-level,” but does not define what “senior-level” means. NASA headquarters export control officials define senior-level as a person at the GS-15 level or in the senior executive service; however, we found that no CEAs were at the senior executive service level, three were GS-15s, and the CEAs at the remaining seven centers were at the GS-14 and GS-13 levels. In addition, NASA’s export control NPR does not contain a provision on the placement of the export control function and CEA within the center’s organizational structure. At some centers where they were several levels removed from the Center Director, CEAs stated that this placement makes it difficult to maintain authority and visibility to staff, to communicate concerns to center management, and to obtain the resources necessary to carry out their export control responsibilities. Conversely, a CEA at another center stated that his placement as Special Assistant to the Center Director creates a supportive environment to incorporate export controls into the project management processes and to require and provide export control training for the majority of center staff. NASA headquarters’ export control officials, as well as several CEAs, noted that limitations in staff resources and time spent on export control functions makes it difficult to carry out the full range of export control duties, such as improving center export control procedures or providing a more robust export control training program. However, NASA’s export control NPR does not discuss the allocation of resources for the export control function or for the CEA within the center, and, according to NASA headquarters’ export control officials, each Center Director has the discretion of how to allocate resources to the export control function. As a result, we found variation among the centers in the staff resources assigned to the export control function, as shown in figure 1. Moreover, we found indications that the resources assigned to export controls at centers did not always appear to be commensurate with the export control workload. Specifically, 8 of the 10 centers had two or fewer civil servant staff to carry out export control activities for hundreds to thousands of foreign national visits, Scientific and Technical Information (STI) reviews, international agreements, and technical assistance agreements. For example, at one center in 2013, two civilian export control officials working less than full time on export control activities were responsible for reviewing and providing any needed export control access restrictions for over 3,000 foreign national visitors and conducting STI reviews for over 2,000 publications. NASA’s procedural requirements for STI requires that all STI intended for release outside of NASA or presented at internal meetings where foreign persons may be present undergo technical, legal, and export control reviews, among others, to ensure that information is not unintentionally released through publication. See figure 2 for export control workload by center for fiscal year 2013. The CEA at one of the centers stated that the time to complete required review activities leaves little time to improve procedures or provide more robust training. To address the variations in authority, placement, and resources of the CEAs, we recommended NASA establish guidance defining the appropriate level and placement for the CEA function and assess the CEA workload to determine appropriate resources needed at each Center. NASA concurred, indicating plans to update existing guidance and to explore strategies to enhance support for the export control function. Weaknesses in Foreign National Access: Throughout fiscal year 2013 NASA centers and Headquarters approved over 11,000 foreign national visits for periods ranging from less than 30 days to greater than 6 months. NASA’s security procedure requires screening of all foreign national visitors prior to gaining approval for access to any NASA facility. However, we identified instances in which NASA security procedures for foreign national access were not followed, which were significant given the potential impact on national security or foreign policy from unauthorized access to NASA technologies. Specifically, at one center, export control officials’ statements and our review of documentation identified instances between March and July of 2013, where foreign nationals fulfilled the role of sponsors for other foreign nationals by identifying the access rights to NASA technology for themselves and other foreign nationals for one NASA program. This is not in compliance with NASA’s security procedures which provide that only NASA civil servants or JPL employees who are U.S. citizens can act as sponsors for foreign nationals, which is one step in NASA’s process of approving and activating foreign national access. This center is taking action to address this issue and, as of December 2013, it developed a new approval process and criteria for foreign nationals requesting access to center automated databases and made revisions to center policies for information systems and foreign national access. We identified planned corrective actions at this and other Centers related to the management of foreign national access and, in our April report, we recommended that NASA develop plans with specific time frames to monitor these corrective actions to ensure their effectiveness. NASA concurred and indicated that it plans to take action to increase the effectiveness of its existing procedures and implement improvements. We found that NASA headquarters export control officials and some CEAs faced challenges in providing effective oversight. In particular, the lack of a comprehensive inventory of export-controlled technologies and not effectively utilizing available oversight tools limit their ability to identify and address risks. Lack of a Comprehensive Inventory of Export-Controlled Technologies: NASA headquarters export control officials and CEAs lack a comprehensive inventory of the types and location of export- controlled technologies at the centers, limiting their ability to identify internal and external risks to export control compliance. Five CEAs told us that they do not know the types and locations of export-controlled technologies, but rather rely on NASA program and project managers to have knowledge of this information. NASA’s export control NPR provides that NASA Center Program and Project Managers, in collaboration with CEAs, are to identify and assess export-controlled technical data. Additionally, NASA Center Project Managers are required by NASA’s export control NPR to provide appropriate safeguards to ensure export- controlled items and technical data are marked or identified prior to authorized transfer to foreign parties consistent with export control requirements. The CEA and security chief at one center told us that they requested a plan identifying where export-controlled and sensitive technologies are located within a research branch in order to facilitate foreign national visit requests. According to the branch manager, he was unable to provide this information, stating it would be too cumbersome to map out all of that information and try to restrict access to the areas with sensitive technologies. Assessing areas of vulnerability, including identifying and assessing export-controlled items, could better ensure that consistent procedures are practiced. NASA’s lack of a comprehensive inventory of its export-controlled technologies is a longstanding issue that the NASA Inspector General identified as early as 1999. Three centers began recent efforts to identify export-controlled technologies at their centers—one of which involves coordination with the center counterintelligence officer. Specifically, at this center, the counterintelligence office collaborated with the CEA to conduct a sensitive technology survey—designed to identify the most sensitive technologies at the center—to better manage risks by developing protective measures for these technologies in the areas of counterintelligence, information technology security, and export controls. Such approaches, implemented NASA-wide, could enable the agency to take a more risk-based approach to oversight by targeting existing resources to identify the most sensitive technologies and then ensure the location of such technologies are known and protected. To implement a risk-based approach, we recommended NASA build off of existing information sources, such as assessments by NASA’s counterintelligence office, to identify targeted technologies. In its response, NASA highlighted plans to implement a risk-based approach that would include CEAs, program managers, and counterintelligence officials. Underutilization of Oversight Tools: NASA’s oversight tools, including annual audits, export control conferences with CEA, and voluntary disclosures, have identified deficiencies, but NASA headquarters has not addressed them. Specifically, we found that seven centers have unresolved findings, recommendations, or observations spanning a period from 2005 to 2012, in areas including export control awareness, management commitment, resources, training, foreign national visitor processes, and disposal of property. At five centers, responding to audit findings and implementing recommendations required that the CEA coordinate with other offices and programs across the center beyond the CEA’s control. The remaining two centers cited resource constraints, organizational priorities, and insufficient coordination with center management as barriers to implementing corrective actions and resolving recommendations. NASA’s current procedures do not address coordination among offices at a center to address findings from annual audits. Further, NASA headquarters export control officials hold annual export control program reviews with the CEAs to discuss export control changes and CEA concerns and recommendations for the program. At NASA’s 2013 annual review, the CEAs presented NASA headquarters export control officials with a list of comments regarding the export control program, many of which echo the issues raised in our April 2014 report, such as CEA position and resources, foreign national access, and awareness of export-controlled technologies. NASA headquarters’ export control officials stated that they agree with the issues raised by the CEAs but acknowledged that they have not fully addressed the CEA concerns from the most recent program review in March 2013 and have not developed specific plans to do so. In fact, we found that over the last 3 years, NASA headquarters export control officials provided only one policy update or other direction to address export control concerns raised by the CEAs. In our April report, we made two recommendations to address underutilization of the audit and program review tools. To ensure implementation of audit findings, we recommended that NASA direct Center Directors to oversee implementation of the audit findings.