Skip to main content

Export Controls: Agencies Should Assess Vulnerabilities and Improve Guidance for Protecting Export-Controlled Information at Companies

GAO-07-69 Published: Dec 05, 2006. Publicly Released: Dec 05, 2006.
Jump To:
Skip to Highlights

Highlights

The U.S. government controls exports of defense-related goods and services by companies and the export of information associated with their design, production, and use, to ensure they meet U.S. interests. Globalization and communication technologies facilitate exports of controlled information providing benefits to U.S. companies and increase interactions between U.S. and foreign companies, making it challenging to protect such exports. GAO assessed (1) how the government's export control processes apply to the protection of export-controlled information, and (2) steps the government has taken to identify and help mitigate the risks in protecting export-controlled information. To do this, GAO analyzed agency regulations and practices and interviewed officials from 46 companies with a wide range of exporting experiences.

Recommendations

Recommendations for Executive Action

Agency Affected Recommendation Status Sort descending
Department of State To improve the Department of State's oversight of export-controlled information at companies, the Secretary of State should direct the Director of the Directorate of Defense Trade Controls to improve its interagency coordination with the Department of Commerce in the following areas (1) provide specific guidance, outreach, and training on how to protect export-controlled information and (2) better target compliance activities on company protection of export-controlled information.
Closed – Implemented
On Sept. 29, 2010, State responded that it has and and will continue to expand guidance on licensing, compliance, and policy matters--stating that the Department has made significant improvements to its website for defense exporters since the GAO study was concluded. State also continues to work with the Society for International Affairs, a non-profit educational organization of the defense industry, Commerce and others on scheduling educational and training events throughout the United States.
Department of Commerce To improve the Department of Commerce's oversight of export-controlled information at companies, the Secretary of Commerce should direct the Administrator of the Bureau of Industry and Security to strategically assess potential vulnerabilities in the protection of export-controlled information using available resources, such as licensing data, and evaluate company practices for protecting such information.
Closed – Implemented
To address this recommendation, Commerce cited the agency's 2007 strategic outreach plan that was serves as a roadmap for assessing vulnerabilities in the protection of export controlled information, as well as establishment of the Deemed Export Advisory Committee (DEAC) to gain additional expert advice on deemed export policy, including potential vulnerabilities. Agency officials also have provided documentation of agency activities that address this recommendation, including the implementation of DEAC recommendations to simplify the deemed export licensing process and to extend Commerce's educational outreach efforts to ensure familiarity by those subject to the deemed export rule. Commerce also completed a Deemed Export Strategic Outreach Plan which aided development of specific criteria for the selection of organizations, including companies, targeted for agency's outreach activities. In addition, Commerce has analyzed compliance data, which agency officials stated has enabled the agency to identify gaps--compliance errors and violations by exporters--in the protection of controlled information as well as to target educational outreach to those companies.
Department of Commerce To improve the Department of Commerce's oversight of export-controlled information at companies, the Secretary of Commerce should direct the Administrator of the Bureau of Industry and Security to improve its interagency coordination with the Department of State in the following areas (1) provide specific guidance, outreach, and training on how to protect export-controlled information and (2) better target compliance activities on company protection of export-controlled information.
Closed – Implemented
Based on Commerce's Deemed Export Strategic Outreach Plan, Commerce officials stated that the agency has increased its outreach and training activities to both universities and industry, including updates to its guidance and teaching tools, increases in the number of seminars, and the introduction of webinars. Officials also noted the agency is implementing recommendations of Deemed Export Advisory Committee (DEAC) to clarify the transfer of export controlled information, particularly within companies. Regarding interagency coordination, Commerce officials indicated that there have been increasing efforts to collaborate on export control enforcement efforts, including Commerce-provided training on export control enforcement for employees of other agencies and the creation of regional task forces, comprised of government law enforcement agencies, that utilize each agency's express expertise to address export control enforcement. Agency officials also noted expanded interagency coordination with the State Department and other agencies in Commerce seminars.
Department of State To improve the Department of State's oversight of export-controlled information at companies, the Secretary of State should direct the Director of the Directorate of Defense Trade Controls to strategically assess potential vulnerabilities in the protection of export-controlled information using available resources, such as licensing data, and evaluate company practices for protecting such information.
Closed – Not Implemented
State, in its agency comments on our draft report and 60-day letter, disagreed with this recommendation and noted that it continuously assesses the defense industry's protection of export-controlled information through actions such as established license requirements and compliance activities.

Full Report

GAO Contacts

Office of Public Affairs

Topics

Data integrityData transmissionDual-use technologiesExport regulationExportingFederal regulationsGovernment informationInformation securityInformation technologyInternal controlsLicensesRegulationRisk assessmentStrategic planningSystem vulnerabilities