Contractor facilities must be cleared prior to  accessing or storing classified information and must implement certain  safeguards to maintain their clearance. DSS headquarters works with contractors to determine  what, if any, protective measures are needed to reduce the risk of foreign  interests gaining unauthorized access to U.S. classified information. DSS Did Not Systematically Collect and Analyze Information to Identify Weaknesses and Institute Corrective Actions

In overseeing contractor facilities and contractors under FOCI, DSS did  not systematically collect and analyze information to assess the  effectiveness of its operations. Without this analysis, DSS was limited in its  ability to detect trends in the protection of classified information across  facilities, to determine sources of security vulnerabilities, and to identify  those facilities with the greatest risk of compromise. In addition, DSS was  unable to determine whether contractors were reporting foreign business  transactions as they occurred or how much time a contractor facility with  unmitigated FOCI had access to classified information. In overseeing contractor facilities, we found DSS evaluated its  performance in terms of process factors, such as the    percentage of security reviews completed,    percentage of security reviews that covered all pertinent areas of  contractors’ security programs,  length of time needed to clear contractor facilities for access to classified  information, and  length of time needed to clear contractor personnel for access to classified  information. Specifically,  DSS headquarters maintained a central repository of data on contractors  under voting trust agreements, proxy agreements, and special security  agreements—protective measures intended to mitigate majority foreign  ownership. Such  analysis would allow DSS to target areas for improved oversight. DSS field staff told us that some contractors reported foreign  business transactions as they occurred, while others reported transactions  months later, if at all. For example,  officials at one contractor stated they reported to DSS that their company  had been acquired by a foreign entity. Many Determinations of Information Compromise either Did Not Occur or Were Done Inappropriately

Industrial security representatives often failed to determine whether  security violations by facilities resulted in the loss, compromise, or  suspected compromise of classified information or made determinations  that were not in accordance with approved criteria. As a result,  the customer’s opportunity to evaluate the extent of damage and take  necessary corrective action was delayed. However, for 39 of the 93 security violations that we reviewed,  industrial security representatives made no determination regarding the  compromise or loss of classified information. In another eight cases at another  facility, the representative made no determination despite employees’  repeated failure to secure a safe room to ensure the protection of  classified information. The Standards and Quality Branch is  the unit within DSS responsible for ensuring that industrial security  representatives properly administer the NISP. Branch officials regularly  test and review field office chiefs and representatives on NISP  requirements, particularly those related to granting clearances and  conducting security reviews. As a result,  DSS did not know the extent to which representatives understood and  were consistently applying Industrial Security Operating Manual  requirements related to violations and, therefore, could not take  appropriate action. While the Industrial Security Operating Manual did not specify a time  requirement for notifying government customers when classified  information had been lost or compromised, DSS was often unable to notify  customers quickly because of difficulties in identifying the affected  customers. For 11  of these 16 violations, DSS did not notify the customer for more than 30  days after the contractor reported that information was lost,  compromised, or suspected of being compromised. DSS relied on the facility to provide this information. DSS Did Not Always Provide Adequate Guidance, Training, and Tools to Field Staff

DSS industrial security representatives faced several challenges in  carrying out their FOCI responsibilities, largely due to complexities in  verifying FOCI cases, limited tools to research FOCI transactions,  insufficient FOCI training, staff turnover, and inconsistencies in  implementing guidance on FOCI cases. Representatives are required to understand the  corporate structure of the legal entity completing the Certificate  Pertaining to Foreign Interests form and to evaluate the types of foreign  control or influence that exist for each entity within a corporate family. In addition, industrial security representatives stated they lacked the  training and knowledge needed to better verify and oversee contractors  under FOCI. In conclusion, we believe that the weaknesses identified in the NISP and  other programs designed to protect technologies critical to U.S. national  security present significant challenges and need to be addressed.
Why GAO Did This Study

The National Industrial Security Program (NISP) aims to ensure contractors appropriately safeguard the government’s classified information. NISP, along with other laws, regulations, policies, and processes, is intended to protect technologies critical to maintaining military technological superiority and other U.S. national security interests.
The Defense Security Service (DSS) within the Department of Defense (DOD) administers NISP on behalf of DOD and other federal agencies. DSS grants clearances to contractor facilities so they can access and, in some cases, store classified information. In 2005, DSS monitored over 11,000 facilities’ security programs to ensure that they meet NISP requirements for protecting classified information.
In 2004 and 2005, GAO issued reports that examined DSS responsibilities related to facilities accessing or storing classified information. The first report assessed DSS oversight of facilities and DSS actions after possible compromises of classified information. The second focused specifically on DSS oversight of contractors under foreign ownership, control, or influence (FOCI). This testimony summarizes the findings of these reports and their relevance to the effective protection of technologies critical to U.S. national security interests— an area GAO designated as a governmentwide high-risk area in 2007.

What GAO Found

DSS did not systematically collect and analyze the information needed to assess its oversight of both contractor facilities and contractors under FOCI. While DSS maintained files on contractor facilities’ security programs and their security violations, it did not use this information to determine, for example, whether certain types of violations are increasing or decreasing and why. As a result, DSS was unable to identify patterns of security violations across all facilities based on factors such as the type of work conducted, the facilities’ government customer, or the facilities’ corporate affiliation. Identifying such patterns would enable DSS to target needed actions to reduce the risk of classified information being compromised. With regard to contractors under FOCI, DSS did not collect and track the extent to which classified information was left in the hands of such contractors before measures were taken to reduce the risk of unauthorized foreign access. GAO found instances in which contractors did not report foreign business transactions to DSS for several months.
DSS’s process for notifying government agencies of possible compromises to their classified information has also been insufficient. When a contractor facility reports a violation and the possible compromise of classified information, DSS is required to determine whether a compromise occurred and to notify the affected government agency so it can assess any damage and take actions to mitigate the effects of the suspected compromise or loss. However, for nearly 75 percent of the 93 violations GAO reviewed, DSS either made no determination regarding compromise or made a determination that was inconsistent with established criteria. In addition, in many cases in which DSS was required to notify the affected agencies of possible information compromises, the notification took more than 30 days; in one case, notification was delayed 5 months.
Despite the complexities involved in overseeing contactor facilities and contractors under FOCI, DSS field staff lacked the guidance, tools, and training necessary to effectively carry out their responsibilities. According to DSS field staff, they lacked research tools and training to fully understand, for example, the significance of corporate structures, legal ownership, and complex financial relationships when foreign entities are involved— knowledge that is needed to effectively oversee contractors under FOCI. Staff turnover and failure to implement guidance consistently also detracted from field staff’s ability to effectively carry out responsibilities.


What GAO Recommends

GAO has made numerous recommendations aimed at improving NISP and DSS’s oversight of classified information that has been entrusted to contractors. Continued weaknesses in this and other areas that require rigorous oversight—such as export control, foreign acquisitions of U.S. companies, and foreign military sales—prompted GAO to designate the protection of critical technologies as high risk.