GAO report to the committee on the judiciary, House of Representatives: export controls: agencies should assess vulnerabilities and improve guidance for protecting export-controlled information at universities.

Foreign students and scholars make substantial contributions to U.S. research efforts and technology development. However, according to a federal government intelligence assessment, access to sensitive U.S. technology by those students and faculty members has imposed a significant but unquantifiable cost to the United States. Research administrators must manage these risks through their export control compliance programs. The primary "auditor" for the U.S. government has issued several reports on this effort.

The Government Accountability Office (GAO) is well known for its reports to Congress on almost any topic imaginable. It recently turned its attention to the subject of export controls, with a series of reports to the House Judiciary Committee. One of these reports, GAO-07-70, specifically addressed the issues surrounding export-controlled information at universities.

The Committee asked GAO to review how academic institutions and the U.S. government protect against the illegal disclosure of such information. This request was based, in part, on prior work by GAO and congressional testimony by a National Academy of Sciences official in September 2005 that over 55 percent of the engineering Ph.D. students in the United States are foreign-born. Another reason for the request was the identification of risks of improper disclosure identified in the Office of the National Counterintelligence Executive, Annual Report to Congress on Foreign Economic Collection and Industrial Espionage--2004, NCIX 2005-10006 (Washington, D.C., April 2005).

In its report to the Committee, GAO first described the universities' approach to research (particularly their orientation to fundamental research not subject to export control). GAO then identified the steps the universities have taken to comply with government export control regulations. Finally, the report assessed the efforts of the Departments of Commerce and State to determine the risk of export violations in university research.

In its review, GAO contacted 13 universities based on their international student populations, export license applications, and federal grants and contracts. (1) GAO analysts interviewed officials in such positions as vice chancellor for research, director of compliance, and general counsel.

As the GAO report noted, U.S. export control regulations are designed for "self-compliance." For the academic community specifically, it is the universities' responsibility to conduct due diligence to determine whether their research activities are subject to export laws, and to identify whether an export license is required for foreign nationals within their purview. Several university officials told GAO that becoming educated on complex export control regulations requires an extensive time commitment because the government does not provide sufficient guidance. They indicated that the training and guidance conducted by the two Departments (State and Commerce) have limited utility for academic institutions. Indeed, the GAO was not complimentary of either department's outreach and training, finding that there was not enough of it and that it was not aimed at the academic audience. GAO also found that State and Commerce have taken few actions to coordinate their outreach efforts to universities.

Among the universities GAO identified as sources of "best practices" information on export controls were Massachusetts Institute of Technology, Stanford University, and the Universities of Oklahoma and Maryland.

State Department and Commerce Department officials expressed concerns to GAO that universities may not be properly undertaking their responsibilities under export regulations, and that the potential may exist for foreign nationals to access sensitive information on U.S. campuses. However, despite these concerns, GAO found that neither agency has analyzed available information on university research and foreign student populations to determine the potential risk of the illegal transfer of controlled information.

GAO did find that the universities were taking steps to comply, or adjust to avoid having to comply, with the export regulations. For instance, most universities extensively review the terms of potential contracts and grants to seek those that do not restrict their ability to conduct fundamental research. Some universities attempt to negotiate out contract language that includes restrictions on fundamental research.

GAO found that universities sometimes modify the way the research subject to export control restrictions is conducted to avoid the export license application process. For example, officials at one university told GAO that instead of applying for an export license for one project, they opted to use only researchers who are excluded from export license requirements, such as U.S. citizens or foreign nationals with permanent residency status. Other university officials reported that they move export-controlled work to off-campus facilities and laboratories administered by the universities or the entity sponsoring the contract, where such research can be better segregated and controlled. At the six university-administered laboratories that GAO visited, each used access control systems such as badges and computer passwords.

GAO also found that the Department of State does not target universities for compliance and has not visited a university. Similarly, the Department of Commerce does not conduct analyses to determine whether academic institutions that have not applied for licenses are in compliance with export control regulations. Instead, Commerce uses leads generated by intelligence agencies, internal Commerce sources, or the public via a hotline to investigate possible cases of export control violations.

GAO reported that neither Commerce nor State analyzes available federal agency data on university research subjects to identify trends or determine the potential for such research to be subject to export control regulations. The report also took the export control agencies to task for not using data on foreign students' and scholars' majors or fields of study to identify potential areas of risk.

The report suggested that the Department of Homeland Security's Student and Exchange Visitor Information System (a database that tracks student nationality, school enrollment, and changes to major or field of study) could be used to alert the regulators to potential trouble spots. However, GAO noted that, within the past three years, neither State nor Commerce has requested these data from Homeland Security for the purposes of assessing export control risks. Similarly, GAO found that State does not use its Visas Mantis program (a security review procedure that aims to identify visa applicants who may pose a threat to U.S. national security by illegally transferring sensitive technology) to identify trends of foreign students and scholars and their fields of study.

As is often the case with GAO reports, after finding that the agencies involved in managing the process were not doing a very good job, the proposed corrective actions were not particularly oriented toward any actual change. Instead, the report proposed two points for agencies:

Strategically assess potential vulnerabilities in the conduct and

publication of academic research by becoming more knowledgeable

about research being conducted on university campuses and, in

consultation with other agencies, make use of available information

on technology development and foreign student populations at

universities to assess the extent to which research at universities

may be subject to export controls, and on the basis of this

assessment of university research and foreign student populations,

improve interagency coordination, conduct additional outreach, and

improve guidance to ensure that universities understand when to

apply export controls.

In its response to GAO's suggestions, the Department of State noted that it is working with the Departments of Commerce and Treasury to conduct an export control conference during 2007 specifically aimed at universities. Universities and other research institutions can expect additional reviews of their export control compliance in the coming months and years. GAO has a semi-permanent team looking into the topic, so they and the regulatory agencies will be back. To avoid being caught unprepared, senior management at all academic institutions should assure that they have a compliance system in place, The policies, practices and methodologies of those "best practices" institutions identified by GAO should serve as a starting point and benchmark for others.

(1) Boston University, Boston, Massachusetts; California Institute of Technology, Pasadena, California; Carnegie Mellon University, Pittsburgh, Pennsylvania; Colorado State University, Fort Collins, Colorado; George Washington University, Washington, D.C,; Johns Hopkins University, Baltimore, Maryland; Massachusetts Institute of Technology, Cambridge and Lexington, Massachusetts; Stanford University, Stanford, California; University of California at Berkeley; University of California at Los Angeles; University of Colorado at Boulder; University of Maryland at College Park; and the University of Southern California, Los Angeles, California

J. Michael Slocum

Slocum & Boddie, PC

6225 Brandon Ave., Suite 310

Springfield, VA 22150