DSS is responsible for providing oversight,  advice, and assistance to more than 11,000 U.S. contractor facilities that  are cleared for access to classified information. DSS headquarters works with contractors to determine  what, if any, protective measures are needed to reduce the risk of foreign  interests gaining unauthorized access to U.S. classified information. DSS  field staff are then responsible for monitoring contractor compliance with  these measures. Protective measures  vary in the degree to which foreign entities are insulated from classified  information and are not intended to deny foreign owners the opportunity  to pursue business relationships with their U.S.-based contractor facilities  working on classified contracts. DSS’s Approach to Overseeing FOCI Contractors Is Insufficient

DSS does not systematically ask for, collect, or analyze foreign business  transactions in a manner that helps it properly oversee contractors  entrusted with U.S. classified information, nor does DSS aggregate and  analyze information to determine the overall effectiveness of its oversight  of FOCI contractors. Furthermore, DSS field  staff said they lack research tools and sufficient training regarding the  subject of foreign transactions and have indicated challenges with regard  to staff turnover. During  our review, we found a few instances in which contractors were not  reporting foreign business transactions when they occurred. However, the contractor  continued operating with unmitigated FOCI for at least 6 months. For example, DSS does not require its representatives to have  financial or legal training. Within this environment, unless  DSS improves the collection and analysis of key information and provides  its field staff with the training and tools they need to perform FOCI  responsibilities, DSS will continue to operate without knowing how  effective its oversight is at reducing the risk of foreign interests gaining  unauthorized access to U.S. classified information. Recommendations for Executive Action

To improve knowledge of the timing of foreign business transactions and  reduce the risk of unauthorized foreign access to classified information,  we recommend that the Secretary of Defense direct the director of DSS to  take the following three actions:    clarify when contractors need to report foreign business transactions    determine how contractors should report and communicate dates of  specific foreign business transactions to DSS, and    collect and analyze when foreign business transactions occurred at  contractor facilities and when protective measures were implemented  to mitigate FOCI. In fact, we found two cases in which  contractors appeared to have operated with unmitigated FOCI before  protective measures were put into place. Regarding our next three recommendations, which aim to enable DSS to  assess the overall effectiveness of its oversight of contractors under FOCI,  DOD argues that it does not need to collect and analyze information on the  universe of contractors under FOCI and trends in foreign business  transactions, or aggregate compliance and counterintelligence  information. Appendix I: Scope and Methodology

To assess the Defense Security Service’s (DSS) process for determining  and overseeing contractors under foreign ownership, control, or influence  (FOCI), we reviewed Department of Defense (DOD) regulations and  guidance on FOCI protective measures included in the National  Industrial Security Program Operating Manual, and the Industrial  Security Operating Manual, as well as DSS policies, procedures, and  guidance for verifying contractors under FOCI and for overseeing them.
Why GAO Did This Study

The Department of Defense (DOD) is responsible for ensuring that U.S. contractors safeguard classified information in their possession. DOD delegates this responsibility to its Defense Security Service (DSS), which oversees more than 11,000 contractor facilities that are cleared to access classified information. Some U.S. contractors have foreign connections that may require measures to be put into place to reduce the risk of foreign interests gaining unauthorized access to classified information. In response to a Senate report accompanying the National Defense Authorization Act for Fiscal Year 2004, GAO assessed the extent to which DSS has assurance that its approach provides sufficient oversight of contractors under foreign ownership, control, or influence (FOCI).

What GAO Found

DSS's oversight of contractors under FOCI depends on contractors self-- reporting foreign business transactions such as foreign acquisitions. As part of its oversight responsibilities, DSS verifies the extent of the foreign relationship, works with the contractor to establish protective measures to insulate foreign interests, and monitors contractor compliance with these measures. In summary, GAO found that DSS cannot ensure that its approach to overseeing contractors under FOCI is sufficient to reduce the risk of foreign interests gaining unauthorized access to U.S. classified information. First, DSS does not systematically ask for, collect, or analyze information on foreign business transactions in a manner that helps it properly oversee contractors entrusted with U.S. classified information. In addition, DSS does not collect and track the extent to which classified information is left in the hands of a contractor under FOCI before measures are taken to reduce the risk of unauthorized foreign access. During our review, we found instances in which contractors did not report foreign business transactions to DSS for several months. We also found a contractor under foreign ownership that appeared to operate for at least 6 months with access to U.S. classified information before a protective measure was implemented to mitigate foreign ownership. Second, DSS does not centrally collect and analyze information to assess its effectiveness and determine what corrective actions are needed to improve oversight of contractors under FOCI. For example, DSS does not know the universe of all contractors operating under protective measures, the degree to which contractors are complying overall with measures, or how its oversight could be strengthened by using information such as counterintelligence data to bolster its measures. Third, DSS field staff face a number of challenges that significantly limit their ability to sufficiently oversee contractors under FOCI. Field staff told us they lack research tools and training to fully understand the significance of corporate structures, legal ownership, and complex financial relationships when foreign entities are involved. Staff turnover and inconsistencies over how guidance is to be implemented also detract from field staff's ability to effectively carry out FOCI responsibilities.