EXPORT CONTROLS: Agencies Should Assess Vulnerabilities and Improve Guidance for Protecting Export- Controlled Information at Universities
Foreign students and scholars make substantial contributions to U.S. research efforts and technology development. However, according to a federal government intelligence assessment, access to sensitive U.S. technology by those students and faculty members has imposed a significant but unquantifiable cost to the United States. Research administrators must manage these risks through their export control compliance programs. The primary "auditor" for the U.S. government has issued several reports on this effort.
The Government Accountability Office (GAO) is well known for its reports to Congress on almost any topic imaginable. It recently turned its attention to the subject of export controls, with a series of reports to the House Judiciary Committee. One of these reports, GAO-07-70, specifically addressed the issues surrounding export-controlled information at universities.
The Committee asked GAO to review how academic institutions and the U.S. government protect against the illegal disclosure of such information. This request was based, in part, on prior work by GAO and congressional testimony by a National Academy of Sciences official in September 2005 that over 55 percent of the engineering Ph.D. students in the United States are foreign-born. Another reason for the request was the identification of risks of improper disclosure identified in the Office of the National Counterintelligence Executive, Annual Report to Congress on Foreign Economic Collection and Industrial Espionage - 2004, NCIX 2005-10006 (Washington, D.C., April 2005).
In its report to the Committee, GAO first described the universities' approach to research (particularly their orientation to fundamental research not subject to export control). GAO then identified the steps the universities have taken to comply with government export control regulations. Finally, the report assessed the efforts of the Departments of Commerce and State to determine the risk of export violations in university research.
In its review, GAO contacted 13 universities based on their international student populations, export license applications, and federal grants and contracts.1 GAO analysts interviewed officials in such positions as vice chancellor for research, director of compliance, and general counsel.
As the GAO report noted, U.S. export control regulations are designed for "self-compliance." For the academic community specifically, it is the universities' responsibility to conduct due diligence to determine whether their research activities are subject to export laws, and to identify whether an export license is required for foreign nationals within their purview. Several university officials told GAO that becoming educated on complex export control regulations requires an extensive time commitment because the government does not provide sufficient guidance. They indicated that the training and guidance conducted by the two Departments (State and Commerce) have limited utility for academic institutions. Indeed, the GAO was not complimentary of either department's outreach and training, finding that there was not enough of it and that it was not aimed at the academic audience. GAO also found that State and Commerce have taken few actions to coordinate their outreach efforts to universities.
Among the universities GAO identified as sources of "best practices" information on export controls were Massachusetts Institute of Technology, Stanford University, and the Universities of Oklahoma and Maryland.
State Department and Commerce Department officials expressed concerns to GAO that universities may not be properly undertaking their responsibilities under export regulations, and that the potential may exist for foreign nationals to access sensitive information on U.S. campuses. However, despite these concerns, GAO found that neither agency has analyzed available information on university research and foreign student populations to determine the potential risk of the illegal transfer of controlled information. …