Export Controls: Agencies Should Assess Vulnerabilities and	 
Improve Guidance for Protecting Export-Controlled Information at 
Universities (05-DEC-06, GAO-07-70).				 
                                                                 
Foreign students and scholars have made substantial contributions
to U.S. research efforts and technology development. However,	 
according to a federal government intelligence assessment,	 
foreign access to sensitive U.S. technology has imposed a	 
significant but unquantifiable cost to the United States. Given  
this risk, GAO was asked to (1) describe the nature of the	 
research at universities and identify steps they take to comply  
with export controls and (2) assess efforts by the Departments of
Commerce and State--the key export control agencies--to determine
the risk of export violations in university research. GAO	 
reviewed Commerce and State export control programs and met with 
officials from 13 universities, selected based on their foreign  
student populations, applications for export licenses, and	 
federal grants and contracts.					 
-------------------------Indexing Terms------------------------- 
REPORTNUM:   GAO-07-70						        
    ACCNO:   A63905						        
  TITLE:     Export Controls: Agencies Should Assess Vulnerabilities  
and Improve Guidance for Protecting Export-Controlled Information
at Universities 						 
     DATE:   12/05/2006 
  SUBJECT:   Classified defense information			 
	     Colleges and universities				 
	     Export regulation					 
	     Exporting						 
	     Federal regulations				 
	     Foreign students					 
	     Foreign trade policies				 
	     Internal controls					 
	     Licenses						 
	     Policy evaluation					 
	     Regulation 					 
	     Research and development				 
	     Risk assessment					 
	     Strategic planning 				 
	     Technology 					 

******************************************************************
** This file contains an ASCII representation of the text of a  **
** GAO Product.                                                 **
**                                                              **
** No attempt has been made to display graphic images, although **
** figure captions are reproduced.  Tables are included, but    **
** may not resemble those in the printed version.               **
**                                                              **
** Please see the PDF (Portable Document Format) file, when     **
** available, for a complete electronic file of the printed     **
** document's contents.                                         **
**                                                              **
******************************************************************
GAO-07-70

   

     * [1]Results in Brief
     * [2]Background
     * [3]Universities Focus on Fundamental Research to Comply with Ex

          * [4]Universities Focus on Conducting Fundamental Research
          * [5]Efforts Undertaken by Universities to Understand and Comply

     * [6]State and Commerce Have Not Assessed the Potential Risk to E

          * [7]Commerce and State Prioritize Processing of License Applicat
          * [8]Commerce and State Have Not Conducted Analysis to Identify w

     * [9]Conclusions
     * [10]Recommendations for Executive Actions
     * [11]Agency Comments and our Evaluation
     * [12]GAO Contact
     * [13]Acknowledgments
     * [14]GAO's Mission
     * [15]Obtaining Copies of GAO Reports and Testimony

          * [16]Order by Mail or Phone

     * [17]To Report Fraud, Waste, and Abuse in Federal Programs
     * [18]Congressional Relations
     * [19]Public Affairs

Report to the Committee on the Judiciary, House of Representatives

United States Government Accountability Office

GAO

December 2006

EXPORT CONTROLS

Agencies Should Assess Vulnerabilities and Improve Guidance for Protecting
Export- Controlled Information at Universities

GAO-07-70

Contents

Letter 1

Results in Brief 3
Background 5
Universities Focus on Fundamental Research to Comply with Export
Regulations 9
State and Commerce Have Not Assessed the Potential Risk to
Export-Controlled Information at Universities 14
Conclusions 20
Recommendations for Executive Actions 20
Agency Comments and our Evaluation 21
Appendix I Scope and Methodology 24
Appendix II Comments from the Department of Commerce 26
Appendix III Comments from the Department of State 28
Appendix IV Staff Contact and Acknowledgments 30

Table

Table 1: Examples of Research Areas Conducted at Universities Visited by
GAO 10

Figure

Figure 1: Basic and Applied U.S.-Based Research Funding Sources for
Universities and Colleges in Fiscal Year 2003 6

Abbreviations

BIS Bureau of Industry and Security
DDTC Directorate of Defense Trade Controls
DOD Department of Defense
EAR Export Administration Regulations
ITAR International Traffic in Arms Regulations
NASA National Aeronautics and Space Administration
SEVIS Student and Exchange Visitor Information System

This is a work of the U.S. government and is not subject to copyright
protection in the United States. It may be reproduced and distributed in
its entirety without further permission from GAO. However, because this
work may contain copyrighted images or other material, permission from the
copyright holder may be necessary if you wish to reproduce this material
separately.

United States Government Accountability Office

Washington, DC 20548

December 5, 2006

The Honorable F. James Sensenbrenner, Jr. Chairman Committee on the
Judiciary House of Representatives

Dear Mr. Chairman:

U.S. national security and economic interests are heavily dependent on
technological innovation and advantage. Many of the nation's leading-edge
technologies, including defense-related technologies, are being discovered
by American and foreign national students and scholars in U.S. university
research and university-affiliated laboratories. As the Department of
Defense (DOD) invests less and less of its funding on in-house research
and development, university-based discoveries are becoming increasingly
vital to national security and other U.S. interests.

To mitigate the risk of technology and knowledge falling into the wrong
hands, the U.S. government--primarily the Departments of State and
Commerce--controls the transfer of defense and "dual use" information.1
However, controlling the transfer of such information presents special
challenges. U.S. export control regulations allow foreign students and
researchers without export licenses to partake in fundamental research,
defined to mean basic and applied research in science and engineering, the
results of which are ordinarily published and shared broadly within the
scientific community.2 U.S. policymakers recognize that foreign students
and researchers have made substantial contributions to U.S. research
efforts, but the potential transfer of knowledge of controlled
defense-related technologies to their home countries could have
significant consequences for U.S. national interests. In a September 2005
testimony before Congress, the National Counterintelligence Executive
stated that while the vast majority of foreign students in the United
States are legitimately studying and advancing academic pursuits, some
seek to acquire sensitive U.S. technologies to advance their own
countries' economic and military interests. Additionally, while not
limited to foreign students, a 2005 federal report noted that the
technology lost as a result of foreign efforts to target sensitive U.S.
technologies has imposed a significant, but difficult to quantify, cost on
the United States.3

1 Dual-use information is that which has both commercial and military
application. 15 C.F.R. Sec. 730.3.

2 National Security Decision Directive 189, issued September 21, 1985, and
still in effect, established national policy for controlling the flow of
science, technology, and engineering information produced in
federally-funded fundamental research at colleges, universities, and
laboratories. The directive defines fundamental research to mean basic and
applied research in science and engineering, the results of which
ordinarily are published and shared broadly within the scientific
community, as distinguished from proprietary research and from industrial
development, design, production, and product utilization, the results of
which ordinarily are restricted for proprietary or national security
reasons.

On the basis of your interest in continuing to attract foreign students
and researchers to U.S. universities while protecting export-controlled
information, you asked us to look at how academic institutions and the
U.S. government protect against the illegal disclosure of such
information. In response, we (1) described the nature of the research
conducted at universities and identified the steps they have taken to
comply with government export control regulations and (2) assessed the
efforts of the Departments of Commerce and State to determine the risk of
export violations in university research.

To conduct our work, we met with officials from the Departments of
Commerce and State and analyzed their regulations, guidance, and training.
We also met with officials in the Department of Defense--which
participates in the export control regulatory process--and the Department
of Homeland Security--which has responsibility for tracking foreign
students and scholars during their course of study in the United States.
We visited 13 universities that were systematically selected based on
their international student populations, export license applications, and
federal grants and contracts. At the universities, we spoke with officials
in such positions as vice chancellor for research, director of compliance,
and general counsel, among others. While our selection criteria included a
range of university experiences with export controls and foreign students
and scholars, the universities' views stated in this report do not
represent the entirety of the U.S. academic community. We also spoke with
officials from various research institutes and academic associations.
Additional details on the scope and methodology of our review can be found
in appendix I. We conducted our review from March through November 2006 in
accordance with generally accepted government auditing standards.

3 Office of the National Counterintelligence Executive, Annual Report to
Congress on Foreign Economic Collection and Industrial Espionage--2004,
NCIX 2005-10006, (Washington, D.C.: April 2005).

Results in Brief

According to university officials we interviewed, their institutions focus
almost exclusively on fundamental research, which is generally not subject
to export controls. By conducting fundamental research in areas such as
artificial intelligence, nanotechnology, and robotics, universities can
openly share and publish their research findings within a broad community
that includes international students and scholars. To ensure their
research remains in the public domain, most university officials said they
extensively screen and review potential contracts and grants for
fundamental research to ensure there are no publication or other
dissemination restrictions. If export controls apply, university officials
stated they sometimes reject the research contract, involve only students
and scholars who can conduct the research under license exclusions, or
refer such work to associated facilities and laboratories located
off-campus that can better regulate and control foreign national access to
such research. The U.S. export control system relies on universities to
understand and correctly determine when export regulations apply and to
follow the regulations accordingly. To educate themselves on export
control issues, academic officials take training courses offered through
Commerce, State, and university associations; search government and other
Web sites; request guidance from knowledgeable officials at other
universities; and hire outside legal counsel and expertise on export
controls. However, the universities we visited indicated that
government-provided training and guidance on export regulations is limited
in informing their efforts to manage and protect export-controlled
information, and it does not clarify when fundamental research exclusions
should apply.

Although State and Commerce provide some guidance and training to assist
exporters in understanding and complying with export regulations, these
agencies have not fully assessed the potential for transfers of
export-controlled information to foreign nationals in the course of U.S.
university research. State and Commerce target their resources to
processing license applications and provide assistance to exporters
through guidance, training, and other outreach. However, they rarely
coordinate these efforts or strategize their outreach on export controls
to the academic community. Furthermore, officials expressed concerns that
universities may not correctly interpret and apply export regulations--a
concern raised by the rarity of export license applications from U.S.
academic institutions, considering the large foreign student and scholar
populations studying and conducting research in the United States.
However, the agencies have not conducted an overall assessment of
available data on foreign participation in research at U.S. universities
to determine whether such research would require export protections. For
example, U.S. government agencies collect data on foreign student
nationality, school enrollment, and federally-funded research conducted at
universities, which could supplement information that State and Commerce
receive from visa application processes and other leads. Furthermore,
State and Commerce outreach efforts have been largely reactive, and they
have only recently begun to engage with the affected research community in
forums to promote dialogue on issues such as fundamental research and its
relation to export controls.

To improve their oversight of export-controlled information at
universities, we are recommending that the Secretaries of Commerce and
State direct their export control entities to strategically assess
potential vulnerabilities in the conduct and publication of academic
research through analyzing available information on technology development
and foreign student populations at universities. This could help to
determine the extent to which research at universities may be subject to
export controls. Furthermore, we recommend that, on the basis of this
assessment, Commerce and State further coordinate efforts and improve
guidance and outreach to ensure that universities understand when to apply
export controls.

The Department of Commerce generally agreed with our report and indicated
that it has undertaken efforts to increase its outreach to the academic
community and plans to further assess vulnerabilities and more precisely
target outreach and compliance efforts. The Department of State agreed
with our recommendation to improve interagency coordination on training
and guidance for universities and disagreed with our report's finding that
it does not assess the potential vulnerabilities associated with
export-controlled information at academic institutions. However, we
maintain that a trend analysis of available data on foreign students and
scholars and federal contracts for research at academic institutions would
be a valuable investment in providing a proactive plan for targeting
outreach and training for the academic community. While State disagreed
with our recommendation, in its response it noted that it is considering
conducting such an assessment. In addition, the Departments of State and
Homeland Security provided technical comments that were incorporated as
appropriate throughout the report. The Department of Defense had no
comments on this report.

Background

In November 2003, GAO reported that university research is a vital part of
the nation's research and development efforts, primarily funded by the
federal government because of the broad consensus that university research
is a long-term national investment in the future.4 The federal investment
in university research has yielded thousands of inventions each year that
have fostered the development of new technologies, stimulated the creation
of new jobs, and improved the quality of life. These benefits come through
open communication among scientists and the sharing of research results. A
National Academy of Sciences official underscored the importance of this
issue in September 2005 congressional testimony, stating that over 55
percent of the engineering Ph.D. students in the United States are
foreign-born and that their research helps strengthen the United States in
the fastest-moving new technologies, some of which have potential
defense-related application.5

Foreign students and scholars bring needed skills to our increasingly
knowledge-based economy, build bridges to other countries and professional
communities, and make other valuable contributions to our society. These
contributions are particularly important for maintaining our
competitiveness, fostering productivity and innovation, and strengthening
our workforce. While the United States has long been a global leader in
higher education and one of the most desired destinations for foreign
students, international competition for the best and the brightest
students and scholars is growing. Countries such as China have improved
their educational capacities, possibly decreasing the incentives for
students and scholars to study in the United States. The recent slowing of
foreign student enrollment in United States universities and colleges has
raised concerns about the extent to which we will be able to continue
attracting talented foreign students and researchers to our universities
and to our workforce after they graduate while also maintaining our
nation's security.

Recognizing the importance of balancing national security interests with
the need to allow the free exchange of information at U.S. academic
institutions of higher learning, the federal government is a major funding
source for research conducted at U.S. universities and colleges. In fiscal
year 2003, the federal government funded almost two-thirds--approximately
$29.6 billion--of all basic and applied research funding provided to
universities and colleges by external sources (see fig. 1). Other sources
of funding come from industry, nonprofit organizations, as well as state
and local governments.

4 GAO, University Research: Most Federal Agencies Need to Better Protect
against Financial Conflicts of Interest, [20]GAO-04-31 (Washington, D.C.,
Nov. 14, 2003).

5House of Representatives Committee on the Judiciary, Subcommittee on
Immigration, Border Security, and Claims, Hearing on Sources and Methods
of Foreign Nationals Engaged in Economic and Military Espionage, Serial
No. 109-58, (Washington, D.C., Sept. 15, 2005).

Figure 1: Basic and Applied U.S.-Based Research Funding Sources for
Universities and Colleges in Fiscal Year 2003

a"Other" includes universities, colleges, and state and local governments.

According to National Science Foundation data for fiscal year 2003, the
National Institutes of Health of the Department of Health and Human
Services funded approximately 62 percent (about $14.1 billion) of all
federally funded science and technology research conducted by universities
and colleges. Other federal research funding sources identified by
university officials we spoke with include the National Aeronautics and
Space Administration (NASA); the National Science Foundation; various
Department of Defense agencies, including the Navy and the Defense
Advanced Research Projects Agency; and the Departments of Energy, State,
and Transportation. This level of government funding was consistent with
that of several of the universities we visited, where officials stated
that their research is primarily funded by government grants and
contracts, including contracts that are directed toward industry and
subsequently subcontracted, or "flowed through," to universities.

Over the past several decades in which the current export control system
has been in effect, the global economy has changed significantly. DOD
continues to seek innovative technologies to meet the needs of warfighters
and to counter technologies developed by potential U.S. adversaries. To
achieve these ends, DOD has become more willing to rely on the nondefense
industry to supply its needs. DOD increasingly relies on commercial
research, for areas such as information systems and telecommunications,
where the cutting edge of technological advancement lies. Such advances in
communications technology have been made possible to a large extent by
basic research, much of which was initially developed in universities and
often involved foreign students and scholars.

The U.S. export control system relies on the ability of exporters to
recognize when certain goods and services meet the criteria for requiring
an export license. The system is primarily divided between two regulatory
regimes, one managed by the Department of State and another managed by the
Department of Commerce. The regimes require export licensing for
defense-related items and information, including data, except where
exclusions apply. Both regulatory regimes include exclusions applicable in
some circumstances to universities and other academic institutions of
higher learning. The U.S. export control system places the onus on
universities and other exporters to understand and comply with the export
control regulations.

The Department of State Directorate of Defense Trade Controls (DDTC)
manages defense items through the International Traffic in Arms
Regulations (ITAR).6 State issues export licenses based on the U.S.
Munitions List, which identifies defense articles, services, and related
technical data that are controlled for export. Moreover, the regulations
state that unless otherwise expressly exempted or excluded, an export
license is required for the oral, visual, or documentary transmission of
technical data by U.S. persons to foreign persons,7 by such means as
in-person or telephone discussions and written correspondence including
electronic messages, even when they are in the United States. The U.S.
Munitions List contains 21 categories, covering items such as weapons,
chemical and biological agents, missiles, and both commercial and military
satellites.

6 The ITAR (22 C.F.R.SS 120-130) implements the Arms Export Control Act
(22 U.S.C. 2778). The Act authorizes the President to control the export
of defense articles and services and promulgate corresponding regulations,
which has been delegated to the Secretary of State by Executive Order
11958, as amended. The ITAR defines fundamental research to mean basic and
applied research in science and engineering where the resulting
information is ordinarily published and shared broadly within the
scientific community, as distinguished from research, the results of which
are restricted for proprietary reasons or specific U.S. government access
and dissemination control. 22 C.F.R. sec.120.11 (a)(8).

The Department of Commerce's Bureau of Industry and Security (BIS) manages
dual-use items, having both military and commercial applications, through
the Export Administration Regulations (EAR).8 Under these regulations,
exporters are to obtain prior government authorization in the form of a
license from BIS, or determine that a license is not needed, before
exporting dual-use items. Commerce requires an export license for the
release of technology or software source code to a foreign national9
because such a release is deemed to be an export10 to the home country or
countries of the foreign national, even if the person is in the United
States. Commerce regulates the dual-use items specified in the EAR's
Commerce Control List, which are controlled for a variety of reasons,
including restricting exports that could significantly enhance a country's
military potential, preventing exports to countries that sponsor
terrorism, and limiting the proliferation of chemical, biological, and
nuclear weapons and their delivery systems. The Commerce Control List has
10 categories covering items such as electronics, computers,
telecommunications, and avionics.

7 The ITAR defines a foreign person as any natural person who is not a
lawful permanent resident as defined by 8 U.S.C. sec. 1101(a)(20) or who
is not a protected individual as defined by 8 U.S.C. 1324b(a)(3). It also
means any foreign corporation, business association, partnership, trust,
society, or any other entity or group that is not incorporated or
organized to do business in the United States, as well as international
organizations, foreign governments, and any agency or subdivision of
foreign governments (e.g., diplomatic missions).

8 The EAR (15 C.F.R. SS 730-774) implements the Export Administration Act
(50 U.S.C. 2401-2420). Although the Act has lapsed, export regulations
have been extended through executive orders, of which Executive Order
13222 (August 17, 2001) is the most recent. The EAR, like National
Security Decision Directive 189, defines fundamental research to mean
basic and applied research in science and engineering where the resulting
information is ordinarily published and shared broadly within the
scientific community. Such research can be distinguished from proprietary
research and from industrial development, design, production, and product
utilization, the results of which ordinarily are restricted for
proprietary reasons or specific national security reasons. 15 C.F.R.
sec.734.8.

9 The EAR defines a foreign national as a person who is not lawfully
admitted for permanent residence in the United States or a person who is
not a protected individual under the Immigration and Naturalization Act, 8
U.S.C. 1324b(a)(3). 15 C.F.R. sec.734.2 (b)(2)(ii).

Universities Focus on Fundamental Research to Comply with Export Regulations

Most of the universities we visited aim to ensure that their research
remains unrestricted and in the public domain by conducting fundamental
research, which is generally excluded from export controls. To ensure that
most of the research conducted on their campuses does not require an
export license, these universities negotiate to exclude any restrictions
on publishing and disseminating the results of the research they consider
to be fundamental. For research that may be subject to export control
regulations, the universities we visited have taken steps to ensure that
their personnel are informed about and comply with these regulations.

Universities Focus on Conducting Fundamental Research

According to most university officials, their institutions conduct basic
and applied science and engineering research in a wide variety of areas,
producing findings that are conducted, shared, and published openly within
a broad community that includes international students and scholars. Table
1 lists examples of research areas conducted at universities that we
visited.

10 These transfers are commonly referred to as "deemed" exports.
Commerce's export control regulations (15 CFR 734.2(b)(2)(ii))
specifically utilize the term "deemed export" to describe these transfers.
While the ITAR does not use a precise corresponding term, State Department
officials told us the concept of a "deemed" export is covered under the
ITAR's general definition of an export--that is, an export means
"disclosing (including oral or visual disclosure) or transferring
technical data to a foreign person, whether in the United States or
abroad" (see 22 C.F.R. Sec. 120.17), and the ITAR's requirements for the
export of unclassified technical data, which state "a license is required
for the oral, visual or documentary disclosure of technical data by U.S.
persons to foreign persons...regardless of the manner in which the
technical data is transmitted (e.g., in person, by telephone,
correspondence, electronic means, etc.)" (see 22 C.F.R. Sec. 125.2(a) and
(c)). State officials told us they also refer to these transfers as
"deemed exports."

Table 1: Examples of Research Areas Conducted at Universities Visited by
GAO

      o Artificial intelligence                         
      o Atmospheric research                            
      o Biological sciences                             
      o Chemical engineering                            
      o Computational science and computer architecture 
      o Computer security                               
      o Integrated circuit design and fabrication       
      o Internet communications and advanced networking 
      o Nanotechnologies                                
      o Physics                                         
      o Remote sensing of Earth                         
      o Robotics                                        

Source: GAO analysis of universities' Web sites.

Most officials we spoke with stated that their universities specifically
seek out research contracts and grants that do not restrict their ability
to conduct fundamental research by extensively screening and reviewing the
terms of potential contracts and grants. If a contract includes
restrictions on fundamental research, some universities attempt to
negotiate the restrictive language out of the contract. Some university
officials noted that such negotiations have become more frequent because
government and industry contracting officials are increasingly inserting
restrictive language in contracts for research that universities consider
to be fundamental. For example, according to university officials, DOD
agencies sometimes insert standard acquisition regulations language that
prohibits the contractor from releasing information, even unclassified
information, outside of the contractor's organization.11 According to
university officials, a rule proposed by DOD would have restricted
universities from sharing information with other academic institutions and
publishing research or otherwise making such information available in the
public domain.12 DOD revised the rule to minimize the impact on
fundamental research conducted at universities and acknowledged that the
free exchange of ideas is a foundational concept of U.S. research and
educational institutions.13 Several universities we interviewed stated
that if they are unsuccessful in negotiating the restrictive language out
of those research contracts they consider to be fundamental, they
sometimes reject the opportunity to participate in the research.

11Defense Federal Acquisition Regulation 252.204-7000 prohibits the
contractor from releasing any unclassified information to anyone outside
of the contractor's organization unless the contracting officer has given
prior written approval or the information is otherwise in the public
domain before the date of release.

For research subject to export control restrictions, universities may
modify the way the research is conducted to avoid the export license
application process--a process some officials characterized as
time-consuming and complicated. For example, officials at one university
said that instead of applying for an export license for one project, they
opted to use only researchers who are excluded from export license
requirements, such as U.S. citizens or foreign nationals with permanent
residency status. In other cases, university officials stated they move
export-controlled work to off-campus facilities and laboratories
administered by the universities or the entity sponsoring the contract,
where such research can be better segregated and controlled. At the six
university-administered laboratories that we visited, each used access
control systems such as badges and computer passwords. Such restrictions
limiting access to information at laboratories are not as common on the
main campuses we visited, where research information is more openly
available.

Efforts Undertaken by Universities to Understand and Comply with Export Control
Regulations

According to a State official, U.S. export control regulations are
designed for "self-compliance." For the academic community specifically,
State officials said that it is the universities' responsibility to
conduct due diligence to determine whether their research activities are
subject to export laws, and to identify whether an export license is
required for foreign nationals within their purview. University officials
we spoke with have taken actions to become educated on complex export
control regulations--an undertaking that several officials indicated
requires an extensive time commitment because the government does not
provide sufficient guidance. Some universities have also dedicated other
resources to ensure they comply with U.S. export control laws, such as
hiring legal counsel.

12In 2005, DOD issued a proposed regulation that would have required
contract officers to ensure that contracts identify any export-controlled
information and technology and the contractor to not allow access by
foreign nationals or persons to export-controlled information and
technology without obtaining an export license, other authorization, or
exemption. According to university associations, they were concerned that
application of this regulation by contracting officers would not take into
consideration whether export-controlled information is involved when
restricting universities from sharing the results of fundamental research.

13At the time of this report, the revised rule (2004-D010) had not been
finalized.

To understand export control regulations, universities we visited
frequently rely on agency training and guidance. Several university
officials stated that they had attended training seminars sponsored by
Commerce, as well as conferences sponsored by the Society for
International Affairs, a nonprofit defense trade industry association that
sponsors events such as conferences and workshops to educate and instruct
the export community on all aspects of defense and commercial exports and
technology transfers.14 Most university officials indicated that they also
accessed Commerce and State Web sites or their respective telephone help
desks.

However, several university officials indicated that the agency training
and guidance have limited utility for academic institutions. For example,
according to some university officials, training provided by Commerce and
State does not discuss how export regulations apply to universities that
have fundamental research exclusions. One university official
characterized the Commerce-sponsored session that he attended as being
"entry level" training directed at the corporate community. Commerce
officials have acknowledged that about 95 percent of the attendees at
their seminars are repeat attendees, primarily from industry. Some
university officials stated that the training was too narrowly focused on
topics that do not pertain to universities. University officials also
raised concerns with State's and Commerce's Web-based guidance. Some
university officials characterized the Web-based information provided by
Commerce and State as being unclear or only providing a general
introduction to a topic without providing sufficient details to fully
answer questions concerning export controls. For example, a university
official stated that the Commerce and State Web sites do not identify
which forms universities need to submit in seeking export licenses to
involve foreign researchers in certain research. Also, although some
university officials indicated that Commerce and State officials provide
very useful information via the telephone help desks, they stated that
getting immediate help was difficult at times and that return messages
were untimely.

14 The Society for International Affairs is a volunteer, nonprofit,
educational organization jointly formed in 1967 by the federal government
and industry. Its purpose is to serve as a forum for the exchange of
information--through events such as luncheons, conferences, and
workshops--related to export and import licensing issues.

To further their understanding of export control regulations, several
universities have sought out other sources of information, specifically
sources tailored to universities. Several university officials indicated
that they rely on best practices by other universities that have shared
and developed approaches for addressing different export control issues,
including the Massachusetts Institute of Technology, Stanford University,
and the Universities of Oklahoma and Maryland. For example, officials from
one university said that they have relied on other universities for
guidance on applying for export licenses. Universities and academic
associations exchange best practice information through seminars and
workshops sponsored by nongovernmental organizations, such as the
Association of American Universities, the Council on Governmental
Relations, and the National Council of University Research Administrators.

Many of the universities that we visited have also developed written
guidance and training to help educate university personnel on their
responsibility to comply with the export control regulations. For example,
officials from one university we visited have developed a Web-based
decision tree to assist university personnel in determining the
applicability of export controls to their research projects. Officials
from another university stated that their research institution requires
that all staff take training--available on the university's intranet
site--related to the handling of controlled information. Another
university adopted a targeted strategy of export control education for its
researchers, reaching out to the researchers and programs most likely to
be affected by export controls, such as those in engineering.

A number of universities we visited have invested in other resources to
ensure they comply with export control regulations. Some hire outside
legal counsel who specialize in export controls. For example, one
university routinely employs outside counsel to mitigate the risk of
committing violations, because of the severity of the penalties for
noncompliance.15 According to officials at another university, thousands
of dollars are spent each year for legal services addressing export
controls. Finally, two universities we visited use a software program to
help determine if a proposed research project grant or contract is subject
to export license requirements. According to officials at these two
universities, the software program helps to facilitate a process that is
very difficult, time-consuming, and costly because of the length and
complexity of U.S. export control regulations.

15 The EAR and ITAR both impose criminal and civil penalties.

State and Commerce Have Not Assessed the Potential Risk to Export-Controlled
Information at Universities

State and Commerce officials indicated that their top priority is
processing the thousands of license applications received annually--the
vast majority of which are from industry--leaving few resources for
guidance and outreach to exporters. However, they expressed concerns that
universities may be misinterpreting their responsibilities under export
regulations and that the potential may exist for foreign nationals to
access sensitive information on U.S. campuses. Despite these concerns,
neither agency has analyzed available information on university research
and foreign student populations to determine the potential risk of the
illegal transfer of controlled information.

Commerce and State Prioritize Processing of License Applications and Target
Their Resources to Industry

According to Commerce officials, BIS receives approximately 1,000 deemed
export license applications per year. Officials confirmed that most of
these applications are received from industry. For example, Commerce
officials stated that of the 865 deemed export licenses processed by
Commerce in fiscal year 2006, 99.7 percent were from industry. These same
officials noted that over the last few years, only two universities have
submitted deemed export license applications. A 2004 Commerce Inspector
General report stated that license application data suggest that many
industries (including chemical and biotechnology industries), academic
institutions, and federal research facilities that may employ or host
foreign nationals are not applying for deemed export licenses.

State and Commerce officials stated that beyond processing export
licenses, few resources remain for providing outreach and guidance to the
export community. While both agencies provide guidance and outreach
through conferences cosponsored with other organizations and
agency-sponsored training, much of their outreach is directed at industry,
and not the academic community. Commerce cosponsors approximately 45
formal seminars annually, along with specialty seminars on deemed exports
ranging from basic to advanced. As its principal training activity, State
provides speakers for export licensing conferences that are organized by
the Society for International Affairs and tailored to the needs of
industry and government participants. An official acknowledged that State
is unable to fill all of the speaking requests that it receives, which
number in the hundreds each year. Instead, State responds to requests
based on the availability of personnel and travel funds. From January 2004
through June 2006, State officials approved their personnel to participate
in approximately 135 outreach activities and events.

Officials at both agencies indicated that their visits to or staffing of
training seminars for the academic community are often in response to
specific invitations from universities. A State official who is
responsible for export outreach reported that since 2003, only one event
has been held that was specifically targeted to the academic community.
While State policy officials have indicated that they would like to
conduct more conferences for universities in the future, the official
responsible for these conferences stated that none are currently scheduled
because of limited resources. For Commerce, one official has noted that
more universities have recently begun attending its training seminars.
However, while Commerce stated it has increased its outreach to
universities in the last few years, GAO analysis of its outreach records
indicated that several events that Commerce categorized as targeted at
universities were provided to government research entities instead.

In addition to conferences and agency-provided training, both State and
Commerce maintain telephone help desks and Web sites for exporters to
obtain guidance on export controls. State employs a three-person response
team to answer telephone inquiries and provide informal advice on export
control issues in response to the thousands of calls received monthly from
industry and academic institutions. Officials have indicated that they
have improved help desk response times. Commerce's and State's Web sites
provide exporters with guidance on when a license is needed and how a
license can be procured. However, information is aimed at a more general
audience, although a Commerce official stated that the agency has posted
more background information on the fundamental research exclusion on its
Web site. State officials noted that they have made their Web site more
user-friendly and taken steps to expand the Web site to provide additional
guidance to exporters.

Although State and Commerce have separate export control jurisdictions,
the 2004 interagency Offices of Inspector General report stated that
Commerce and State could improve their outreach by providing joint
training that explains the differences between the two agencies' licensing
requirements and procedures--a recommendation that, according to the
report, was supported by company and academic officials.16 Furthermore,
previous GAO reports have recommended that Commerce and State should
better coordinate their efforts on analysis and export oversight.17
However, State and Commerce have taken few actions to coordinate their
outreach efforts to universities. Though State engaged in six outreach
events with Commerce between November 2003 and April 2004, a State
official explained that staffing such joint events with Commerce remains
difficult because State must use personnel from its licensing staff to
participate in these events. With a backlog in license applications, the
processing of applications is a priority, and the agency is reluctant to
divert those personnel to outreach efforts.

Commerce and State Have Not Conducted Analysis to Identify whether Any Risk
Exists to Export-Controlled Information at Universities

State and Commerce officials expressed concerns that despite the export
control exclusions for university research, the potential may exist for
foreign nationals to access controlled defense and dual-use technologies
and information on U.S. campuses. However, neither State nor Commerce has
analyzed available data on university research contracts or student fields
of study to identify any potential risk to export-controlled information
at universities. According to federal internal control standards, agencies
need to conduct risk assessments that generally include estimating the
risk's significance and likelihood of occurrence, deciding how to manage
the risk and determining what actions should be taken.18

In the absence of an assessment of export control vulnerabilities at
universities, State officials and a Commerce Inspector General report
stated they were concerned that academic officials may be misinterpreting
export control regulations and guidance. According to State officials,
universities are unaware of the nuances of export control regulations.
Specifically, they said universities have difficulty distinguishing and
tracking export regulations when a specific project develops from basic to
fundamental or applied research. For example, one State official
questioned whether universities devote sufficient resources to export
compliance and apply for export licenses with State and Commerce to the
extent their research activities warrant. This official believes that
academic institutions should designate individuals responsible for
understanding export control regulations and tracking exports, just as
companies do. However, most of the academic institutions we visited had
designated officials who were responsible for export control issues.

16 Offices of Inspectors General, Interagency Review of Foreign National
Access to Export-Controlled Technology in the United States, Report No.
D-2004-062 (Washington, D.C.: Apr. 16, 2004).

17 See GAO, Export Controls: Improvements to Commerce's Dual-Use System
Needed to Ensure Protection of U.S. Interests in the Post-9/11 Environment
, [21]GAO-06-638 (Washington, D.C.: Jun. 26, 2006); GAO, Export Controls:
Department of Commerce Controls over Transfers of Technology to Foreign
Nationals Need Improvement, [22]GAO-02-972 (Washington, D.C.: Sept. 6,
2002); and GAO, Export Controls: Processes for Determining Proper Control
of Defense-Related Items Need Improvement, [23]GAO-02-996 (Washington,
D.C.: Sept. 20, 2002)

18GAO, Standards for Internal Control in the Federal Government,
[24]GAO/AIMD-00-21 .3.1 (Washington, D.C.: November 1999).

Despite these concerns, Commerce and State have not fully assessed
university compliance information to identify the potential for export
control vulnerabilities in university research. Commerce and State are
tasked with export control oversight, including administering policy,
processing licenses, and reviewing compliance by exporters. According to
State officials, the department lacks the personnel to conduct extensive
compliance audits. Instead, State relies on voluntary disclosure of
possible export control violations--primarily by companies. When a company
notifies State of a possible export violation, State may visit the company
to discuss the problem and offer advice on weaknesses in the company's
export control program. According to State officials, State does not
target universities for compliance and has not visited a university
because universities make up a small percentage of all exporters.
Officials stated that Commerce's formal compliance review program is
focused on deemed export license holders, the majority of which are from
industry. Commerce does not conduct analyses to determine whether academic
institutions that have not applied for licenses are in compliance with
export control regulations. Instead, Commerce uses leads generated by
intelligence agencies, internal Commerce sources, or the public via a
hotline to investigate possible cases of export control violations.

Furthermore, although Commerce gathers information about certain
universities' research activities on case-by-case basis, neither Commerce
nor State analyzes available federal agency data on university research
subjects to identify trends or determine the potential for such research
to be subject to export control regulations. Given that much of the
research conducted at U.S. universities is federally funded, data from
other government agencies on the subjects of research conducted at
academic institutions could supplement data from Commerce and State. For
example, DOD and NASA fund research at universities, some of which
involves technologies that could become export controlled. General
information on federal contracts available through the Federal Procurement
Data System could also provide information on universities doing high
volumes of research for other federal agencies. However, neither Commerce
nor State makes use of these data sources to analyze trends in university
research. Commerce, instead, relies on Internet searches or publicly
available data on university research when preparing to meet with academic
officials.

Other data could help Commerce and State identify potential risks of
export control violations at academic institutions. Commerce officials
stated that some foreign nationals on U.S. campuses are from countries
that have historically tried to unlawfully obtain information about
American technologies. However, while Commerce uses visa application data
to generate leads for specific cases of deemed export violations, it does
not use other data on foreign students' and scholars' majors or fields of
study to identify potential areas of risk. For example, the Department of
Homeland Security administers the Student and Exchange Visitor Information
System--a database that tracks student nationality, school enrollment, and
changes to major or field of study--but within the past 3 years neither
State nor Commerce has requested these data from Homeland Security for the
purposes of assessing export control risks. While a Commerce official
indicated that the department would like to work with Homeland Security in
the future, there is currently no information sharing between the two
agencies for the purpose of identifying trends in student populations.
Similarly, State does not use its Visas Mantis program--a security review
procedure that aims to identify visa applicants who may pose a threat to
U.S. national security by illegally transferring sensitive technology--to
identify trends of foreign students and scholars and their fields of
study, although it occasionally receives alerts about individuals who
might pose an export control risk.

To improve controls at universities, in 2005 Commerce solicited
information on the impact of a proposed rule change that would have
modified the definition of the use of export-controlled equipment by
foreign nationals, which was recommended by the Commerce Office of
Inspector General.19 Commerce received more than 300 comments in which
many cited the potential impact on university research, including numerous
comments that the modified definition would capture too many routine
operations carried out by students and employees and would thus create a
large and generally unnecessary compliance, financial, and administrative
burden for universities, and an increased licensing burden on Commerce.
Subsequently, Commerce withdrew the advanced notice of proposed rule
change in May 2006.

Recently, U.S. export regulatory, oversight, and law enforcement agencies
have taken some steps to engage the academic community on export issues.
For example, in September 2006, Commerce established the Deemed Export
Advisory Committee to address broad export control issues. Specifically,
the committee's charter is to review and provide recommendations to
Commerce on deemed export policy. Thus, this committee will be responsible
for ensuring that the deemed export licensing policy protects national
security while ensuring that the United States continues to be at the
leading edge of technological innovations. Its membership includes
high-ranking university officials and chief executive officers of
companies. According to Commerce officials, the committee members will
serve for approximately one year. Commerce officials stated that they plan
to address the issue of fundamental research in the committee's work and
to include participation by a number of export control agencies in
committee meetings. Commerce highlighted one such issue in a May 2006
Federal Register notice where it described the difference between the
academic community views that export controls would only apply to the
results of research, and the Commerce view that export controls can also
apply to the conduct of research.

In September 2005, the Federal Bureau of Investigation established a
separate forum to improve its lines of communication with the academic
community. The National Security Higher Education Advisory
Board--consisting of the presidents and chancellors of several prominent
U.S. universities--aims to foster outreach and to promote understanding
between higher education and the Federal Bureau of Investigation. The
board will provide insight on the higher education culture of openness,
academic freedom, and international collaboration and dialogue on issues
such as terrorism, counterintelligence, and homeland security. In
addition, the Department of Homeland Security's Project Shield America
aims to work with exporters of U.S. technologies that could be illegally
exported, in particular, technologies used in weapons of mass destruction.
According to a DHS official, the project's first outreach effort
specifically targeting the U.S. academic community was scheduled to be
held at the beginning of December 2006.

19 U.S. Department of Commerce, Office of Inspector General, Bureau of
Industry and Security, Final Inspection Report No. IPE-16176, Deemed
Export Controls May Not Stop the Transfer of Sensitive Technology to
Foreign Nationals in the U.S. (Washington, D.C., Mar. 31, 2004).

Conclusions

Balancing the desire to attract gifted foreign research scientists to U.S.
universities and the need to ensure that export-controlled research at
universities is not compromised is a considerable challenge. Since
government agencies place the responsibility for complying with export
control regulations on universities and other exporting entities, it is
essential that Commerce and State, the two agencies primarily charged with
administering export regulations, understand whether universities
correctly interpret and apply relevant export control policies and
regulations when deciding whether their research is subject to export
controls. Despite some concerns that universities may not understand their
responsibilities when conducting research, Commerce and State have not
leveraged available government information and assessed potential risks of
illegal transfers of export-controlled information at universities.
Furthermore, although Commerce and State have separate export control
jurisdictions, the lack of coordination between these agencies on
outreach, analysis, and oversight could hamper their ability to determine
whether export-controlled information may be at risk of transfer to
foreign nationals in the course of university research. Without such
knowledge, the government agencies cannot determine whether their guidance
and training for universities is appropriate and sufficient and whether
their resources are strategically targeted to optimize their ability to
regulate and monitor universities' research. Until Commerce and State take
such steps, sensitive information may remain vulnerable to improper
transfer, potentially putting at risk U.S. national security interests.

Recommendations for Executive Actions

To improve the Department of Commerce's oversight of export-controlled
information under its jurisdiction at universities, we recommend that the
Secretary of Commerce direct the Administrator of the Bureau of Industry
and Security to

           o strategically assess potential vulnerabilities in the conduct
           and publication of academic research by becoming more
           knowledgeable about research being conducted on university
           campuses and, in consultation with other agencies, make use of
           available information on technology development and foreign
           student populations at universities to assess the extent to which
           research at universities may be subject to export controls and

           o on the basis of this assessment of university research and
           foreign student populations, improve interagency coordination,
           conduct additional outreach, and improve guidance to ensure that
           universities understand when to apply export controls.

To improve the Department of State's oversight of export-controlled
information under its jurisdiction at universities, we recommend that the
Secretary of State direct the Director of the Directorate of Defense Trade
Controls to

           o strategically assess potential vulnerabilities in the conduct
           and publication of academic research by becoming more
           knowledgeable about research being conducted on university
           campuses and, in consultation with other agencies, make use of
           available information on technology development and foreign
           student populations at universities to assess the extent to which
           research at universities may be subject to export controls and

           o on the basis of this assessment of university research and
           foreign student populations, improve interagency coordination,
           conduct additional outreach, and improve guidance to ensure that
           universities understand when to apply export controls.

Agency Comments and our Evaluation

We provided a draft of this report to the Departments of Commerce,
Defense, Homeland Security, and State for their review and comment.
Commerce and State provided written comments, which are reprinted in
appendixes II and III, respectively.20 Defense did not have any comments
on our draft report. Homeland Security provided technical comments, which
are incorporated as appropriate throughout the report.

The Department of Commerce generally agreed with the report's
recommendations, and stated that the Deemed Export Advisory Committee will
aid in this respect. However, Commerce stated that Student and Exchange
Visitor Information System (SEVIS) data are too general for use in
identifying whether foreign students and scholars are subject to deemed
export license requirements and that the collection of more specific visa
application information is needed to assess vulnerabilities. While we
agree that additional information from the visa application process could
be useful, we found that SEVIS data include information that State and
Commerce could use to perform general trend analysis to determine where
best to focus outreach and compliance efforts at the university level. For
example, an analysis of the majors that foreign students and scholars are
pursuing at universities with large federal research contracts could
provide Commerce and State with a proactive plan for targeting their
outreach and training efforts for the academic community. Furthermore,
while Commerce states that about one-third of its outreach events focus on
the academic community, as our report states, we found that several of the
events that Commerce classified as academic outreach were actually
targeted at government research entities. Finally, Commerce correctly
notes that our report focuses on fundamental research or other research
that may be subject to export controls while excluding other research that
falls outside of the export control universe. We identified the
application of the fundamental research exclusion as a significant issue
between the academic community and Commerce, and as Commerce's letter
notes, some universities could benefit from a better understanding of
deemed export control requirements. Our report indicates that an
assessment of the vulnerabilities will best allow Commerce to focus its
outreach and training efforts toward addressing this issue with the
academic community.

20 Commerce's response letter also included comments on our draft report
on export controlled information, Export Controls: Agencies Should Assess
Vulnerabilities and Improve Guidance for Protecting Export-Controlled
Information at Companies, [25]GAO-07-69 (Washington, D.C.: Dec. 5, 2006).

State agreed with our recommendation to improve interagency coordination
on training and guidance for universities and disagreed with our report's
finding that it does not assess the potential vulnerabilities associated
with export-controlled information at academic institutions. State
responded that it is currently working with the Department of Commerce and
the Department of the Treasury to conduct an export control conference
during 2007 specifically aimed at universities. As we recommended in our
report, such outreach that is specifically targeted to the academic
community, particularly in coordination with other agencies, could improve
universities' understanding of regulations concerning export controlled
information. However, while such outreach may help universities seeking
guidance on deemed export regulations, State would benefit from
strategically assessing vulnerabilities at universities using readily
available data, such as SEVIS, to help the department identify and address
areas of potential risk. While State disagreed with our recommendation, in
its response it noted that it is considering conducting such an
assessment. A trend analysis conducted on SEVIS and federal procurement
data would be a valuable investment in providing a proactive plan for
targeting outreach and training for universities. State also provided
technical comments, which we incorporated throughout the report, as
appropriate.

We are sending copies of this report to appropriate congressional
committees and to the Secretary of Commerce, the Secretary of Defense, the
Secretary of Homeland Security, and the Secretary of State. Copies will be
made available to others upon request. In addition, this report will be
available at no charge on the GAO Web site at http://www.gao.gov .

If you or your staff have any questions about this report, please contact
me on (202) 512-7333. Key contributors to this report are acknowledged in
appendix IV.

Sincerely,

John Hutton, Acting Director
Acquisition and Sourcing Management

Appendix I: Scope and Methodology

To describe the nature of the research conducted at universities and
identify the steps they have taken to comply with government export
control regulations, we interviewed and obtained documentation from
officials at 13 universities in positions such as vice chancellor for
research, director of compliance, and general counsel. We conducted our
review at the following 13 universities: Boston University, Boston,
Massachusetts; California Institute of Technology, Pasadena, California;
Carnegie Mellon University, Pittsburgh, Pennsylvania; Colorado State
University, Fort Collins, Colorado; George Washington University,
Washington, D.C.; Johns Hopkins University, Baltimore, Maryland;
Massachusetts Institute of Technology, Cambridge and Lexington,
Massachusetts; Stanford University, Stanford, California; University of
California at Berkeley; University of California at Los Angeles;
University of Colorado at Boulder; University of Maryland at College Park;
and the University of Southern California, Los Angeles, California. To get
a general overview of the nature of research at universities, we also
spoke by telephone with officials from the Association of American
Universities, Association of University Technology Managers, National
Council of University Research Administrators, and the Southwest Research
Institute. To systematically select the universities that we visited, we
cross-tabulated data on universities with large numbers of international
students or scholars, those that are associated with federally funded
research centers, those that had applied for International Traffic in Arms
Regulations or Export Administration Regulations export licenses, and
those that had high-dollar contracts with either the Department of Defense
or other government entities. While some of the selected academic
institutions fall within the top tiers across the selection criteria,
their views stated in this report do not represent those of the entirety
of the U.S. academic community.

To assess Commerce's and State's efforts to determine the risk of export
violations in university research, we interviewed officials from the
Bureau of Industry and Security of the Department of Commerce and its
related export offices: National Security and Technology Transfer
Controls, Exporter Services, Export Administration, Export Enforcement. We
also interviewed officials in the Department of Commerce's Offices of
General Counsel and Inspector General. At the Department of State, we
interviewed officials and reviewed data from the Bureau of
Political-Military Affairs' Directorate of Defense Trade Controls, the
Bureaus of Consular Affairs and International Security and
Nonproliferation, and the Office of the Inspector General. We obtained and
analyzed regulations, guidance, and training documents from these
departments. We also collected data and other documentation and met with
officials from the Office of Defense Procurement and Acquisition Policy of
the Department of Defense and the Department of Homeland Security's
Immigration Policy Directorate and U.S. Immigration and Customs
Enforcement.

We conducted our work from March 2006 through November 2006 in accordance
with generally accepted government auditing standards.

Appendix II: Comments from the Department of Commerce

Appendix III: Comments from the Department of State

Appendix IV: Staff Contact and Acknowledgments

GAO Contact

John P. Hutton (202) 512-7773

Acknowledgments

John Neumann, Sharron Candon, Gregory Harmon, Arturo Holguin, Angela
Thomas, and Sandra Moore made key contributions to this report. Other key
contributors include Marie Ahearn and Karen Sloan.

(120508)

GAO's Mission

The Government Accountability Office, the audit, evaluation and
investigative arm of Congress, exists to support Congress in meeting its
constitutional responsibilities and to help improve the performance and
accountability of the federal government for the American people. GAO
examines the use of public funds; evaluates federal programs and policies;
and provides analyses, recommendations, and other assistance to help
Congress make informed oversight, policy, and funding decisions. GAO's
commitment to good government is reflected in its core values of
accountability, integrity, and reliability.

Obtaining Copies of GAO Reports and Testimony

The fastest and easiest way to obtain copies of GAO documents at no cost
is through GAO's Web site ( www.gao.gov ). Each weekday, GAO posts
newly released reports, testimony, and correspondence on its Web site. To
have GAO e-mail you a list of newly posted products every afternoon, go to
www.gao.gov and select "Subscribe to Updates."

Order by Mail or Phone

The first copy of each printed report is free. Additional copies are $2
each. A check or money order should be made out to the Superintendent of
Documents. GAO also accepts VISA and Mastercard. Orders for 100 or more
copies mailed to a single address are discounted 25 percent. Orders should
be sent to:

U.S. Government Accountability Office 441 G Street NW, Room LM Washington,
D.C. 20548

To order by Phone: Voice: (202) 512-6000 TDD: (202) 512-2537 Fax: (202)
512-6061

To Report Fraud, Waste, and Abuse in Federal Programs

Contact:

Web site: www.gao.gov/fraudnet/fraudnet.htm E-mail:
[email protected] Automated answering system: (800) 424-5454 or (202)
512-7470

Congressional Relations

Gloria Jarmon, Managing Director, [email protected] (202) 512-4400 U.S.
Government Accountability Office, 441 G Street NW, Room 7125 Washington,
D.C. 20548

Public Affairs

Paul Anderson, Managing Director, [email protected] (202) 512-4800
U.S. Government Accountability Office, 441 G Street NW, Room 7149
Washington, D.C. 20548

www.gao.gov/cgi-bin/getrpt?GAO-07-70 .

To view the full product, including the scope
and methodology, click on the link above.

For more information, contact John Hutton at (202) 512-7773 or
[email protected].

Highlights of [34]GAO-07-70 , a report to the Chairman, Committee on the
Judiciary, House of Representatives

December 2006

EXPORT CONTROLS

Agencies Should Assess Vulnerabilities and Improve Guidance for Protecting
Export-Controlled Information at Universities

Foreign students and scholars have made substantial contributions to U.S.
research efforts and technology development. However, according to a
federal government intelligence assessment, foreign access to sensitive
U.S. technology has imposed a significant but unquantifiable cost to the
United States.

Given this risk, GAO was asked to (1) describe the nature of the research
at universities and identify steps they take to comply with export
controls and (2) assess efforts by the Departments of Commerce and
State--the key export control agencies--to determine the risk of export
violations in university research. GAO reviewed Commerce and State export
control programs and met with officials from 13 universities, selected
based on their foreign student populations, applications for export
licenses, and federal grants and contracts.

[35]What GAO Recommends

GAO recommends that Commerce and State use available information to assess
potential vulnerabilities and based on this assessment improve outreach,
guidance, and interagency coordination. The agencies generally concurred,
but State disagreed with our recommendation on assessing vulnerabilities.
Broader assessments would increase State's knowledge of risks and help
improve its guidance to universities.

The U.S. export control system requires export licensing for defense items
and items that have both commercial and military applications, except
where exclusions apply, such as those applicable to universities in some
circumstances. The U.S. export control agencies place the onus on
universities to understand and comply with the regulations. According to
university officials we interviewed, their institutions focus almost
exclusively on fundamental research--defined as basic and applied research
in science and engineering, the results of which ordinarily are published
and shared broadly within the scientific community. Such research is
generally not subject to export controls. Universities we visited conduct
research in such areas as nanotechnologies, computer security, and
chemical engineering. To ensure their research remains in the public
domain, university officials said they negotiate contract language to
remove publication or other dissemination restrictions for research they
consider to be fundamental. If export controls apply, university officials
stated they sometimes involve only those students eligible to conduct the
research under a license exclusion, to avoid the lengthy license
application process. In other cases, they refer such work to off-campus
associated facilities that can better regulate and control foreign
national access to the research. Universities we visited indicated that
government-provided training and guidance on export control regulations is
limited in informing their efforts to manage and protect export-controlled
information in the university environment.

State and Commerce officials expressed concerns that universities may not
correctly interpret and apply export regulations, given the large number
of foreign students participating in research at universities and the
relative lack of license applications from universities. Although federal
internal control standards contain guidelines for agencies to conduct risk
assessments, State and Commerce have not conducted an overall assessment
of available trend data on technology development research and foreign
participation in such research at U.S. universities to identify potential
vulnerabilities. For example, U.S. government agencies collect data on
foreign student nationality, school enrollment, and types of research
conducted at universities for federal agencies, which could supplement
information that State and Commerce receive from visa application
processes and other sources. Although State and Commerce provide guidance
through training seminars, agency Web sites, and telephone help desks to
assist exporters in understanding and complying with regulations,
officials stated that their focus is on processing export license
applications--primarily from industry. Recently, Commerce established an
advisory committee composed of industry and university representatives who
are expected to discuss issues such as the nature of university research
and its relation to export controls.

References

Visible links
  20. http://www.gao.gov/cgi-bin/getrpt?GAO-04-31
  21. http://www.gao.gov/cgi-bin/getrpt?GAO-06-638
  22. http://www.gao.gov/cgi-bin/getrpt?GAO-02-972
  23. http://www.gao.gov/cgi-bin/getrpt?GAO-02-996
  24. http://www.gao.gov/cgi-bin/getrpt?GAO/AIMD-00-21.3.1
  25. http://www.gao.gov/cgi-bin/getrpt?GAO-07-69
  34. http://www.gao.gov/cgi-bin/getrpt?GAO-07-70
*** End of document. ***