	Background

DOD’s key priority is maintaining military superiority. Knowledge about which technologies  are critical and warrant protection from illegal or unauthorized access is  needed for, among other things: export controls and licensing decisions for dual-use and arms exports,  which fall under the purview of the Departments of Commerce and  State, respectively;  consideration of anti-tamper protection of critical technologies on  defense systems, which is primarily coordinated by anti-tamper  officials and acquisition program offices within the military services;  review of foreign acquisitions of U.S. firms that are involved in the  development or manufacture of defense technologies, which is  coordinated with several federal agencies;  counterproliferation and counterintelligence programs and activities  performed by DOD entities such as DSS to protect against industrial  espionage; and determinations about the public release of technical or scientific  information. Despite DOD’s Actions to Address Weaknesses, MCTL Is Outdated and Updates Have Ceased

		DOD Took Steps to Respond to MCTL Weaknesses

Since our 2006 report, DOD has taken steps aimed at clarifying the  MCTL’s purpose and improving its utility. To address concerns about  the currency of the list, DOD began updating the MCTL to ensure that  each technology section had been updated at least once since our 2006  report. As part of these efforts to revamp the MCTL, DOD issued an instruction,  in 2008, that clarifies MCTL implementation by outlining roles and  responsibilities for informing the list’s content, specifying procedures for  updating and maintaining the list, and designating the purposes for which  certain DOD components are to use the MCTL. Among other things, the  instruction:  specified that it is DOD policy that the MCTL serve as a technical  reference to inform the development and implementation of  technology security policies on international transfers of defense- related goods, services, and technologies; directed DTSA to consult the MCTL when developing DOD export  control proposals, processing export license requests, and making  technology transfer decisions;  specified that DOD components are to use the MCTL in making  decisions about what information can be shared with foreign entities  and provide subject matter expertise in identifying and assessing  technologies for the MCTL;  required the development of a methodology—based on objective  criteria that produce logical and repeatable results—for determining  whether a given technology is militarily critical; and accelerated the frequency of technology section updates from every 4  years to every 2 years to keep pace with technology development. Further, implementation of the operational concept has been limited due  to funding constraints; however, it calls for enhancing the functionality of  the MCTL by:  supporting real-time technology updates from approved contributors  as information becomes available rather than updating a technology  section with all its sub-sections and datasheets in a single effort;  transitioning to a web-based application that will make data available  in various document formats; providing a more robust capability to search across multiple MCTL  technology sections which is beneficial in cases where a given  technology may have relevance to multiple sections; enabling users to track content changes to each section and providing  rationale for changes and access to previous versions; and  linking a given technology to its corresponding reference in export  control lists such as the Commerce Control List and U.S. Munitions  List. The restricted version is still available via the same website, but  program officials have posted a disclaimer noting that the list is no longer  being updated and that content is being provided for information purposes  only and is no longer intended to support technology decisions. DOD has also halted its plans to integrate the compendium of emerging  technologies with the MCTL. These efforts are taking place without input from  users on their requirements because, according to program officials,  users have not been responsive to their efforts to solicit user  requirements for the new automated system. Commerce officials reiterated  longstanding concerns that the MCTL is too broad to be useful in  reviewing individual export license applications. While these programs have  different missions, they refer to the MCTL and have integrated this  technical reference into their processes. In an effort to create a consistent  and standardized method for identifying critical technologies across  multiple programs, the Army and Navy have issued guidance that  designates the MCTL as a reference that can be used to support the  identification of critical technologies as part of the broader spectrum of   For example, the Navy issued guidance  critical program information.identifying the MCTL as an available resource for acquisition programs to  use in determining critical technologies, among other things. Additionally, the list of militarily critical  technologies allows DSS to assess the overlap and connections  between different categories of technologies which, in turn, bolsters its  analysis. DSS had previously relied on the compendium of emerging  technologies for its analysis, but found it to be outdated and too broad  for its purposes. Faced with uncertainty about the  availability of the MCTL, programs are considering alternatives, and in  one case, developing their own technical reference, which may not be in  the best interest of the federal government as such actions redirect  resources from other critical missions and may result in unnecessary  duplication and inconsistent approaches to identify and protect critical  technologies. Recommendations for Executive Action

Recognizing that there are widespread requirements to know what is  militarily critical, we recommend that the Secretary of Defense take the  following two actions:  1.  determine the best approach to meeting users’ needs for a technical  reference, whether it be MCTL, other alternatives being used, or some  combination thereof; and  2.  ensure that resources are coordinated and efficiently devoted to  sustain the approach chosen. If DOD determines that the MCTL is not the optimal solution for aiding  programs’ efforts to identify militarily critical technologies, we also  recommend that the Secretary of Defense seek necessary relief from  DOD’s current responsibility. GAO staff who made key contributions to this report  are listed in appendix IV. Appendix I: Scope and Methodology

To determine the extent to which the Department of Defense (DOD)  addressed identified weaknesses in updating and maintaining the  Militarily Critical Technologies List (MCTL), we obtained program  documents such as the MCTL Concept of Operations which was drafted  in 2010. We  also interviewed officials within DOD and the Departments of Commerce,  State, and Treasury to obtain their perspectives on the MCTL.
Why GAO Did This Study

DOD spends billions of dollars on sophisticated weapon systems and technologies to maintain military superiority. Such technologies are vulnerable to exploitation when exported, stolen, or lost during military missions. To identify critical technologies and help minimize these risks, DOD established the MCTL--a technical reference--as well as a compendium of worldwide emerging technologies. In 2006, GAO reported that the MCTL was out of date and not meeting users' requirements, and subsequently included the list as a key component of GAO's high risk area on protecting critical technologies. This report updates GAO's 2006 work and reviews the extent to which 1) DOD has addressed weaknesses in updating and maintaining the MCTL, and 2) agencies use the MCTL as a resource in identifying critical technologies. GAO reviewed laws, directives, and guidance, as well as documentation of DOD actions since 2006 to address MCTL concerns and interviewed officials from DOD and the Departments of Commerce, State, and the Treasury.

What GAO Found

While the Department of Defense (DOD) took steps to address previously identified weaknesses in updating and maintaining the Militarily Critical Technologies List (MCTL), the list remains outdated and updates have ceased. For example, DOD has solicited users' requirements and feedback on the MCTL, and added a search engine capability to improve navigation of the list and updated each technology section at least once. DOD also determined the list's purpose is to support export control decisions and in October 2008, issued an instruction that (1) recognized the list's usefulness for other DOD programs and activities and (2) outlined the roles, responsibilities, and procedures for updating and maintaining the list. However, in 2011, DOD cut funding for the program from $4 million in prior years to about $1.5 million and ceased MCTL content updates. Subsequently, DOD removed the public version of the list from the Internet, and officials posted a disclaimer for the restricted version noting that the list should only be used for informational purposes as it had not been updated. Similarly, the compendium of emerging technologies is outdated and two sections have not been updated since 1999. Program officials from the Militarily Critical Technologies Program have devised a plan to improve how MCTL content will be updated in the future, including relying on contributions from the user community, but implementation of the plan has been limited due to funding constraints. However, program officials have yet to get input from users to agree to this approach and would still require additional funding to implement it.
The MCTL is not used to inform export decisions--its original purpose. Export control officials from DOD and the Departments of Commerce and State reiterated their longstanding concern that the MCTL is outdated and too broad to meet export control needs. DOD officials who provide input on the criticality of technologies as part of export license determinations and reviews of foreign acquisition of U.S. companies told us that they do not rely on the MCTL to inform their decision making despite DOD guidance to do so. Instead, they consult their own network of experts, which they consider to be a more reliable source to get current technology information. Other DOD programs to protect critical technologies need a technical reference such as the MCTL and have integrated the list to help inform decision making. For example, the MCTL has been fully integrated into DOD's anti-tamper critical technology tool, which is designed to facilitate analysis and decision making to protect the most valuable military assets from tampering when exported or lost in military missions. Also, to inform its analysis of industrial espionage activities such as foreign targeting of U.S. technologies, the Defense Security Service relies on the MCTL to identify overlap and connections between different technology categories. With the suspension of MCTL updates, these programs are seeking alternatives, and in one case, developing their own technical reference which could result in inefficient use of resources. DOD officials working with MCTL users have an opportunity to coordinate efforts and help minimize inconsistent approaches to identify critical technologies and any potential duplication of effort.

What GAO Recommends

GAO recommends that DOD take steps to (1) determine the best approach for meeting users' requirements for a technical reference to consistently identify critical technologies, whether it be the MCTL or an alternative and (2) ensure adequate resources are available to sustain the approach chosen. Further, if DOD determines that the MCTL is not the optimal solution, it should seek necessary relief from its responsibility to develop the list. DOD concurred with GAO's recommendations.