Foreign Military Sales: Improved Navy Controls Could Prevent	 
Unauthorized Shipments of Classified and Controlled Spare Parts  
to Foreign Countries (25-JUN-04, GAO-04-507).			 
                                                                 
From 1993 through 2002, the Department of Defense (DOD) delivered
over $150 billion in services and defense articles, including	 
classified and controlled items, to foreign countries through	 
foreign military sales programs administered by the military.	 
Foreign countries may request items using blanket orders, which  
are for a specific dollar value and are used to simplify supply  
actions on certain types of items. GAO was asked to review	 
whether the Navy's key internal controls restricted blanket	 
orders for (1) classified spare parts and (2) controlled items	 
sold to foreign countries. Also, GAO was asked to determine if	 
periodic tests were conducted to ensure that the Navy's system is
working as intended.						 
-------------------------Indexing Terms------------------------- 
REPORTNUM:   GAO-04-507 					        
    ACCNO:   A10589						        
  TITLE:     Foreign Military Sales: Improved Navy Controls Could     
Prevent Unauthorized Shipments of Classified and Controlled Spare
Parts to Foreign Countries					 
     DATE:   06/25/2004 
  SUBJECT:   Foreign military sales				 
	     Foreign policies					 
	     Internal controls					 
	     Inventory control systems				 
	     Policy evaluation					 
	     Spare parts					 
	     Systems evaluation 				 
	     Waivers						 
	     Policies and procedures				 

******************************************************************
** This file contains an ASCII representation of the text of a  **
** GAO Product.                                                 **
**                                                              **
** No attempt has been made to display graphic images, although **
** figure captions are reproduced.  Tables are included, but    **
** may not resemble those in the printed version.               **
**                                                              **
** Please see the PDF (Portable Document Format) file, when     **
** available, for a complete electronic file of the printed     **
** document's contents.                                         **
**                                                              **
******************************************************************
GAO-04-507

United States General Accounting Office

              GAO	Report to the Honorable Tom Harkin, U.S. Senate

June 2004

FOREIGN MILITARY SALES

 Improved Navy Controls Could Prevent Unauthorized Shipments of Classified and
                  Controlled Spare Parts to Foreign Countries

                                       a

GAO-04-507

Highlights of GAO-04-507, a report to the Honorable Tom Harkin, U.S.
Senate

From 1993 through 2002, the Department of Defense (DOD) delivered over
$150 billion in services and defense articles, including classified and
controlled items, to foreign countries through foreign military sales
programs administered by the military. Foreign countries may request items
using blanket orders, which are for a specific dollar value and are used
to simplify supply actions on certain types of items. GAO was asked to
review whether the Navy's key internal controls restricted blanket orders
for (1) classified spare parts and (2) controlled items sold to foreign
countries. Also, GAO was asked to determine if periodic tests were
conducted to ensure that the Navy's system is working as intended.

GAO recommends that the Navy resolve the differences between DOD and Navy
policy on foreign countries' use of waivers, establish policies to recover
items shipped to countries not entitled to receive them, and document the
reasons for overriding the Navy's system. Also, GAO recommends that the
Navy strengthen the system's internal controls to ensure that blanket
orders are always reviewed and revalidated, and periodically test these
controls.

DOD concurred with five of GAO's recommendations and partially concurred
with three other recommendations.

www.gao.gov/cgi-bin/getrpt?GAO-04-507.

To view the full product, including the scope and methodology, click on
the link above. For more information, contact William M. Solis at (202)
512-8365 or [email protected].

June 2004

FOREIGN MILITARY SALES

Improved Navy Controls Could Prevent Unauthorized Shipments of Classified and
Controlled Spare Parts to Foreign Countries

The Navy's internal controls over foreign military sales using blanket
orders are not adequate, placing classified and controlled spare parts at
risk of being shipped to foreign countries that may not be eligible to
receive them. The internal control inadequacies are as follows:

o  	The Navy might not have followed DOD policy when it approved 26
blanket orders leading to the release of classified spare parts to foreign
countries. Navy policy states that classified parts can be requested under
blanket orders when countries obtain waivers, but the Defense Security
Cooperation Agency indicated that this Navy policy contradicts DOD policy,
which prohibits the use of waivers. Navy officials have no plans to recoup
these parts because the countries were approved to purchase them, and they
were entitled to receive the parts under a different process. GAO agrees.
However, Navy officials stated, there are no written policies to recover
parts that countries should not have requested and received under blanket
orders.

o  	The Navy does not always document the reasons for overriding its
system and releasing classified parts. According to the Standards for
Internal Control in the Federal Government, all transactions and other
significant events need to be clearly documented. GAO identified four
blanket orders for which the Navy's country managers overrode the system,
but the files did not contain documents explaining the reasons for
releasing the parts.

o  	The Navy lacks written policies to process blanket orders from
countries requesting spare parts by manufacturer or vendor part numbers.
GAO identified two blanket orders for which the Navy released four
classified parts. The release occurred because the Navy's country manager
substituted classified parts for parts ordered, which caused the system to
bypass the control-edit function designed to check a country's eligibility
to receive the parts.

o  	The Navy's system lacked control edits over controlled cryptographic
parts and allowed countries to obtain them under blanket orders without
determining the countries' eligibility to receive the parts. GAO
identified five blanket orders for which the Navy's system approved and
released 32 controlled cryptographic circuit card assemblies. According to
DOD and Navy officials, the system has been modified and now reviews
controlled cryptographic codes. Also, Navy officials do not plan to
recover these parts because the countries were approved to purchase the
parts and GAO agrees.

o  	The Navy has not conducted periodic tests to ensure that its system is
accurately reviewing and approving blanket orders in accordance with its
foreign military sales policies. DOD and Navy officials said that the last
systemwide test was conducted in 2000. However, according to the Defense
Security Cooperation Agency, the Navy is not prohibited from periodically
testing the system.

Contents

     Letter                                                                 1 
                                    Results in Brief                        3 
                                       Background                           7 
              Internal Controls over the Navy's Foreign Military Sales Are 
                                      Not Adequate                         11 
                                      Conclusions                          17 
                          Recommendations for Executive Action             18 
                           Agency Comments and Our Evaluation              19 
                                 Scope and Methodology                     21 
Appendix I           Comments from the Department of Defense            

  Figure

Figure 1: The Navy's Requisition Process for Foreign Military Sales of
Spare Parts

Abbreviations

DOD Department of Defense GAO General Accounting Office

This is a work of the U.S. government and is not subject to copyright
protection in the United States. It may be reproduced and distributed in
its entirety without further permission from GAO. However, because this
work may contain copyrighted images or other material, permission from the
copyright holder may be necessary if you wish to reproduce this material
separately.

United States General Accounting Office Washington, DC 20548

June 25, 2004

The Honorable Tom Harkin United States Senate

Dear Senator Harkin:

From 1993 through 2002, the Department of Defense (DOD) delivered over
$150 billion worth of services and defense articles-including classified
and controlled cryptographic spare parts1-to foreign countries through
foreign military sales programs administered by the military services.
Some sales occurred under blanket orders, which are cases that specify a
specific dollar value rather than specific items. They are designed to
simplify supply actions on certain categories of items for which foreign
military sales customers will have a recurring need, such as unclassified
spare parts, repair parts, minor components, training films, and
publications. According to DOD policy, the management of classified and
controlled spare parts is particularly important, given their potential to
be released to foreign countries that may use them against U.S.
interests.2 Also, according to DOD policy, DOD is required to control the
export of technology, goods, and services that contribute to the military
potential of any country or combination of countries that could prove
detrimental to U.S. security interests. Under blanket orders,3 the Navy's
policy is intended to restrict certain categories of items from being
ordered without review such as classified materials.

As requested, this report focuses on whether the Navy has adequate
internal controls in place to prevent foreign countries from
requisitioning and receiving, under blanket orders, classified and
controlled spare parts. Internal control activities include policies,
procedures, and processes that are essential for the proper stewardship of
and accountability for government resources, and for achieving effective
and efficient program

1 Classified parts are restricted for national security reasons;
controlled parts are not classified but contain military
technology/applications or are controlled cryptographic parts, hereafter
referred to as "controlled parts."

2 Security Assistance Management Manual, DOD 5105.38-M (Oct. 3, 2003).

3 The Navy commonly refers to blanket orders as "direct requisitioning
procedures," "open end requisitioning," or "pull requisitioning."

results.4 Our overall objective was to determine the adequacy of the
Navy's internal controls for foreign military sales under blanket orders.
More specifically, we assessed and tested whether key internal controls
adequately restrict blanket order sales of classified and controlled spare
parts to foreign countries and determined whether periodic tests were
conducted to ensure that the Navy's Management Information System for
International Logistics5 was working as intended.

As agreed with your office, this report is one in a series on DOD's
foreign military sales program administered by the military services. This
particular report focuses on the Navy, which sold classified and
controlled spare parts to foreign countries valued at over $2.5 million
for the period October 1, 1997, through April 30, 2003. In July 2003 we
reported on the adequacy of the Air Force's internal controls over
shipments of classified and controlled spare parts to foreign countries.6
Also, in September 2003 we reported on the adequacy of the Air Force's
internal controls over shipments of spare parts containing military
technology to foreign countries.7 Furthermore, in April 2004 we reported
on the adequacy of the Army's internal controls over shipments of
classified spare parts and items containing military technology to foreign
countries.8

To accomplish our review, we obtained data from the system on classified
and controlled spare parts that were purchased under blanket orders from
October 1, 1997, through April 30, 2003. During this period, a total of 38

4 Internal control activities help ensure that management directives are
carried out. The control activities should be effective and efficient in
accomplishing the agency's control objectives. U.S. General Accounting
Office, Standards for Internal Control in the Federal Government,
GAO/AIMD-00-21.3.1 (Washington, D.C.: November 1999).

5 The Management Information System for International Logistics, hereafter
referred to as "the system," is the Navy's logistics information and
tracking system for foreign military sales. It validates foreign
customers' requisitions and determines whether items requested are
authorized.

6 U.S. General Accounting Office, Foreign Military Sales: Improved Air
Force Controls Could Prevent Unauthorized Shipments of Classified and
Controlled Spare Parts to Foreign Countries, GA0-03-664 (Washington, D.C.:
July 29, 2003).

7 U.S. General Accounting Office, Foreign Military Sales: Air Force Does
Not Use Controls to Prevent Spare Parts Containing Sensitive Military
Technology from Being Released to Foreign Countries, GAO-03-939R
(Washington, D.C.: Sept. 10, 2003).

8 U.S. General Accounting Office, Foreign Military Sales: Improved Army
Controls Could Prevent Unauthorized Shipments of Classified Spare Parts
and Items Containing Military Technology to Foreign Countries, GAO-04-327
(Washington, D.C.: Apr.15, 2004).

  Results in Brief

blanket order requisitions for classified and controlled spare parts were
processed for shipments to foreign countries. We verified the Navy's
system to determine whether it approved and released the selected blanket
order requisitions in accordance with DOD foreign military sales policies.
To conduct this work, we obtained from the Navy all blanket order
shipments to foreign countries for the period mentioned above and matched
the spare parts' stock numbers to a government database9 to identify the
classified and controlled parts that were shipped to foreign countries. We
conducted our review in accordance with generally accepted government
auditing standards. Further details are presented in the Scope and
Methodology section of this report.

The Navy's internal controls over foreign military sales pursuant to
blanket orders are not adequate, placing classified and controlled spare
parts at risk of being shipped to foreign countries that may not be
eligible to receive them. The internal control inadequacies we identified
are as follows:

o  	The Navy might not have followed DOD policy when it approved blanket
order requisitions leading to the release of classified spare parts to
foreign countries. According to Navy policy, classified material can be
requisitioned under blanket orders when foreign countries obtain waivers
from the Navy. We identified 26 of 38 requisitions in our review for which
foreign countries obtained waivers from the Navy to release 108 classified
spare parts such as circuit card assemblies and radar receivers. According
to the Defense Security Cooperation Agency, the Navy policy contradicts
DOD policy, which prohibits the services from using waivers to allow
foreign countries to obtain classified material under blanket orders.
Also, according to the policy, the agency is not required to approve all
blanket order cases and their corresponding notes. Nonetheless, Navy
officials stated that the Defense Security Cooperation Agency approves the
Navy's blanket order agreements, which contain notes authorizing the Navy
to release restricted items on a case-by-case basis. In addition, the Navy
provided examples of blanket order cases that were approved by the Defense
Security Cooperation Agency and contained the notes allowing foreign
countries to obtain classified material under blanket orders. Also, Navy

9 We used the government database called "FEDLOG," which contains
logistics information on items in the supply system and provides the
identification of spare part numbers and their security classifications.

officials indicated that they have no plans to recover these classified
parts because the countries were approved to purchase the parts under
different procedures. We agree with the Navy officials' decision. In
addition, according to Navy officials, there are no written policies or
procedures that address the return of materials that foreign countries
should not have requisitioned and received under blanket orders. Without
written policies or procedures, the Navy cannot be assured that
appropriate steps will be taken to recover materials shipped to foreign
countries that are not eligible to receive them.

o  	The Navy did not always document its reasons for overriding the system
to release classified spare parts to foreign countries as required.
According to the Standards for Internal Control in the Federal Government,
10 all transactions and other significant events need to be clearly
documented. The standard states that such documentation should be properly
managed and maintained and should be readily available for examination. We
identified 4 of the 38 requisitions where the Navy's country managers11
overrode the system and shipped classified antennas, radar receivers, and
circuit card assemblies, but the case files did not contain any
documentation for the transactions explaining the reasons for the release
of the classified parts. According to Navy records, the Navy country
managers manually entered four blanket order requisitions into the system.
According to records from the Naval Inventory Control Point, Navy
International Programs Directorate,12 the Navy's country managers
incorrectly submitted these blanket order requisitions as "pushed
requisitions," 13 which caused the requisitions to bypass the control-edit
function the system. Also, the Navy International Programs Directorate
officials did not locate any documentation in the case files to indicate
if a waiver had been obtained for these requisitions.

10 U.S. General Accounting Office, Standards for Internal Control in the
Federal Government, GAO/AIMD-00-21.3.1 (Washington, D.C.: November 1999).

11 We use the term "Navy country manager" to mean an official who performs
such functions as supply and financial technical work in support of the
foreign military sales program.

12 Hereafter referred to as "Navy International Programs Directorate."

13 Requisitions prepared by the U.S. supply system for the customer are
called "push" requisitions because the U.S. supply system sends material
to the customer (i.e., as part of the initial set of spare parts that
accompany a weapon system).

o  	The Navy lacks written policies and procedures to guide the processing
of blanket order requisitions from foreign countries requesting spare
parts by manufacturer or vendor part numbers. Consequently, and in
violation of DOD and Navy policy, the Navy International Programs
Directorate allowed the release of classified spare parts under blanket
orders to foreign countries that requested parts by using manufacturer or
vendor part numbers. We identified 2 of the 38 requisitions in our review
for which the Navy released four classified spare parts under blanket
orders. When a foreign country submits a blanket order requisition for
parts by manufacturer or vendor part numbers, the Navy's system, which
does not recognize part numbers, will stop processing the requisition and
identify it for manual review. If a corresponding government-classified
spare part (national stock number)14 is identified, the Navy's country
manager will submit a transaction into the system in order to change the
part number to a national stock number, and allow the system to continue
processing the requisition. The requisition for the newly substituted
spare part then bypasses the system's control-edit function, designed to
determine the foreign country's eligibility to receive the part.

o  	The Navy's system lacked control edits over controlled cryptographic15
spare parts, and allowed foreign countries to obtain these controlled
parts under blanket orders without determining whether the countries were
eligible to receive them. Navy policy requires that physical security
measures be used to protect controlled cryptographic spare parts.
According to DOD policy, parts containing controlled cryptographic and
telecommunication parts are considered unclassified but must be
controlled, and the loss of these parts could adversely affect U.S.
national security. DOD materials that contain controlled cryptographic
parts and secure telecommunications equipment are used to deny
unauthorized persons information derived from telecommunications of the
U.S. government related to national security. In our review, we identified
5 out of 38 blanket order requisitions for which the Navy's system
erroneously approved and released 32 controlled circuit card assemblies'
cryptographic spare parts to foreign countries. According to DOD and Navy
officials, the system was not programmed to review controlled
cryptographic item

14 A corresponding government spare part (national stock number)
identifies a specific item of supply.

15 Cryptography equipment provides security to telecommunication by
converting information to a form unintelligible to an unauthorized
interception.

codes; consequently, the system automatically approved these requisitions
and allowed the release of these parts to foreign countries. On the basis
of our review, which identified the Navy system's lack of internal
controls over controlled spare parts, the Navy has modified the Management
Information System for International Logistics to review foreign
countries' requisitions for controlled cryptographic parts and identify
them for manual review to determine whether the foreign countries
requisitioning the parts are eligible to receive them. According to Navy
officials, they do not plan to recover these particular controlled
cryptographic parts because the foreign countries requisitioning the parts
were entitled to receive them.

o  	The Navy has not conducted periodic tests, as required by federal
internal control standards to ensure that its system is accurately
reviewing and approving blanket order requisitions for compliance with
restrictions and operating in accordance with the Navy's foreign military
sales policies. GAO's and the Office of Management and Budget's internal
control standards require that a system such as the Navy's be periodically
tested to ensure that it is working as intended and that the ability to
accurately review and approve requisitions is not compromised. According
to DOD and Navy officials, the last major systemwide testing was conducted
in 2000, but this test did not determine whether the system was accurately
reviewing and approving blanket order requisitions. According to Defense
Security Assistance Development Center officials, who are responsible for
managing the Navy's foreign military sales automated system, periodic
tests of the Navy's system have not been conducted recently because, in
October 1998, the Defense Security Cooperation Agency directed that no
additional funds be used to expand the current system. However, Defense
Security Cooperation Agency officials stated that this directive does not
preclude the Navy from periodically testing the system and reviewing the
procedures to assess compliance.

Since the Navy's system has already been modified to review controlled
cryptographic spare parts requisitioned under blanket orders prior to
shipping them to foreign countries, we are not making a recommendation in
this area. We are recommending, however, that the Secretary of Defense
instruct the Secretary of the Navy to resolve the conflict between the DOD
and Navy policies on the use of waivers; require that the Navy's country
managers manually submit into the Navy's system correct blanket order
requisitions; and establish policies and procedures to follow when
documenting system overrides and processing blanket orders using
manufacturer or vendor part numbers. Also, we are recommending that

Background

the Navy establish policies to recover spare parts shipped to foreign
countries not entitled to receive them.

We are also recommending that the Secretary of Defense instruct the Under
Secretary of Defense for Policy to modify the Navy's Management
Information System for International Logistics so that it validates
blanket order requisitions on the basis of stock numbers' security
classifications when items are requested by manufacturer or vendor part
numbers and to periodically test the Navy's system to ensure that it is
accurately reviewing and approving blanket order requisitions.

In written comments on a draft of this report, DOD concurred with five of
our recommendations and partially concurred with three of our
recommendations. DOD's comments and our evaluation of them are discussed
on page 19.

The sale or transfer of U.S. defense items to friendly nations and allies
is an integral component of both U.S. national security and foreign
policy. The U.S. government authorizes the sale or transfer of military
equipment, including spare parts, to foreign countries either through
government-togovernment agreements or through direct sales from U.S.
manufacturers. The Arms Export Control Act16 and the Foreign Assistance
Act of 1961,17 as amended, authorize the DOD foreign military sales
program.

The Department of State sets overall policy concerning which countries are
eligible to participate in the DOD foreign military sales program. DOD
identifies military technology that requires control when its transfer to
potential adversaries could significantly enhance a foreign country's
military or war-making capability. Various agencies such as the Department
of State and DOD are responsible for controlling, in part, the transfer or
release of military technology to foreign countries.

The Defense Security Cooperation Agency, under the direction of the Under
Secretary of Defense for Policy, has overall responsibility for
administering the foreign military sales program, and the military
services generally execute the sales agreements with the individual
countries. A foreign country representative initiates a request by sending
a letter to

16 Pub. L. No. 90-629. 17 Pub. L. No. 87-195.

DOD asking for such information as the price and availability of goods and
services, training, technical assistance, and follow-on support. Once the
foreign customer decides to proceed with the purchase, DOD prepares a
Letter of Offer and Acceptance stating the terms of the sale for the items
and services to be provided. After this letter has been accepted, the
foreign customer is generally required to pay, in advance, the amounts
necessary to cover the costs associated with the services or items to be
purchased from DOD and then is allowed to request spare parts through
DOD's supply system.

For the Department of the Navy, foreign military sales policy and
oversight are the responsibility of the Navy International Programs
Office, under the direction of the Deputy Assistant Secretary of the Navy
for Research Development, and Acquisition. The Navy International Programs
Office is primarily responsible for directing, guiding, and implementing
the U.S. Navy's foreign military sales program. The Naval Inventory
Control Point, International Programs Directorate is responsible for
recording, managing, and reporting the material and service order
transactions associated with the Department of the Navy Security
Assistance Program.

The Navy International Programs Office's responsibilities begin with the
initial negotiation of a foreign military sale and end with the transfer
of items and completion of all financial aspects of the sales agreement.
Also, the Navy International Programs Office uses an automated system
called the "Management Information System for International Logistics" to
support the U.S. Navy's management of the foreign military sales program.
The Navy originally developed the system in 1978, and in October 1997, the
Defense Security Cooperation Agency transferred the Navy's system to the
Defense Security Assistance Development Center. The Navy retained
responsibility for defining system-user requirements, designing new
processes, and directing programming modifications to the system's
applications. However, the overall responsibility for providing system
information technology maintenance support, such as writing and testing
the programs and coordinating infrastructure support, was transferred to
the Defense Security Assistance Development Center.

Foreign military sales requisitions for Navy spare parts and other items
are initially processed through the automated system. For blanket orders,
the system uses the security classification code,18 the cognizance code,19
the Federal Supply Group, federal supply class, and the National Stock
Number20 to restrict the spare parts available to foreign military sales
customers. Once the system validates a requisition, the requisition is
sent to a supply center to be filled and shipped. The Navy's requisition
process for foreign military sales of classified and controlled spare
parts is shown in figure 1.

18 It is called the "controlled inventory item code," and it indicates the
security classification and security risk or controls for storage and
transportation of DOD assets.

19 A cognizance code is a two-character alphanumeric code providing supply
management information, identifying the type of items referred to, and
identifying the item manager who has control over it.

20 The Federal Supply Group identifies, by title, the commodity area
covered by classes within a group and their physical or performance
characteristics. The Federal Supply Group makes up 2 of the 13 digits
combined to create the National Stock Number, which identifies a specific
item of supply.

Figure 1: The Navy's Requisition Process for Foreign Military Sales of
Spare Parts

Note: This flowchart provides only a brief overview of the complex
processes in the Navy's foreign military sales process.

    Internal Controls over
    the Navy's Foreign
    Military Sales Are
    Not Adequate

The Navy's internal controls over foreign military sales pursuant to
blanket orders are not adequate, placing classified and controlled spare
parts at risk of being inappropriately shipped to foreign countries. We
found that the Navy (1) might not have followed DOD policy when it
approved requisitions under blanket orders leading to the release of
classified spare parts to foreign countries and that a written policy does
not exist to recover parts shipped to foreign countries that may not be
eligible to receive them, (2) lacks adequate documentation for overriding
the system to release classified spare parts, (3) lacks written procedures
to guide the processing of blanket order requisitions from foreign
countries that request parts by manufacturer or vendor part numbers, (4)
lacked system control edits to review blanket order requisitions for
controlled cryptographic spare parts, and (5) has not conducted periodic
tests to ensure that its system is performing as intended. As a result of
these inadequate internal controls, classified and controlled spare parts
could be shipped to foreign countries that may not be entitled to receive
them under blanket orders.

      Navy Might Not Have Followed DOD Policy When It Approved Requisitions
      Leading to the Release of Classified Spare Parts under Blanket Orders