	Weaknesses in Implementation of NASA Export Control Procedures Create Export Control Vulnerabilities

We found weaknesses in the implementation of NASA’s export control  policy and procedures concerning the CEA function and foreign national  access procedures, which increase the risk of unauthorized access to  export-controlled technology. Variations in CEA Position, Function, and Resources: NASA’s export  control policy provides the CEA the responsibility to ensure compliance of  all Center program activities with U.S. export control laws and regulations  and states that the position should be “senior-level,” but does not define  what “senior-level” means. At some centers where they were several levels  removed from the Center Director, CEAs stated that this placement  makes it difficult to maintain authority and visibility to staff, to  communicate concerns to center management, and to obtain the  resources necessary to carry out their export control responsibilities. However, NASA’s export  control NPR does not discuss the allocation of resources for the export  control function or for the CEA within the center, and, according to NASA  headquarters’ export control officials, each Center Director has the  discretion of how to allocate resources to the export control function. To address the variations in authority,  placement, and resources of the CEAs, we recommended NASA  establish guidance defining the appropriate level and placement for the  CEA function and assess the CEA workload to determine appropriate  resources needed at each Center. Weaknesses in Foreign National Access: Throughout fiscal year 2013  NASA centers and Headquarters approved over 11,000 foreign national  visits for periods ranging from less than 30 days to greater than 6 months. However, we identified instances in which NASA security procedures for  foreign national access were not followed, which were significant given  the potential impact on national security or foreign policy from  unauthorized access to NASA technologies. Specifically, at one center,  export control officials’ statements and our review of documentation  identified instances between March and July of 2013, where foreign  nationals fulfilled the role of sponsors for other foreign nationals by  identifying the access rights to NASA technology for themselves and  other foreign nationals for one NASA program. We identified planned  corrective actions at this and other Centers related to the management of  foreign national access and, in our April report, we recommended that  NASA develop plans with specific time frames to monitor these corrective  actions to ensure their effectiveness. In particular, the  lack of a comprehensive inventory of export-controlled technologies and  not effectively utilizing available oversight tools limit their ability to identify  and address risks. Lack of a Comprehensive Inventory of Export-Controlled  Technologies: NASA headquarters export control officials and CEAs  lack a comprehensive inventory of the types and location of export- controlled technologies at the centers, limiting their ability to identify  internal and external risks to export control compliance. Assessing areas of vulnerability, including  identifying and assessing export-controlled items, could better ensure that  consistent procedures are practiced. Specifically, at this center, the  counterintelligence office collaborated with the CEA to conduct a sensitive  technology survey—designed to identify the most sensitive technologies  at the center—to better manage risks by developing protective measures  for these technologies in the areas of counterintelligence, information  technology security, and export controls. Such approaches, implemented  NASA-wide, could enable the agency to take a more risk-based approach  to oversight by targeting existing resources to identify the most sensitive  technologies and then ensure the location of such technologies are  known and protected. The remaining two centers cited resource constraints,  organizational priorities, and insufficient coordination with center  management as barriers to implementing corrective actions and resolving  recommendations. NASA headquarters’ export  control officials stated that they agree with the issues raised by the CEAs  but acknowledged that they have not fully addressed the CEA concerns  from the most recent program review in March 2013 and have not  developed specific plans to do so. As stated above, NASA concurred with all of our recommendations and  stated that our findings and recommendations complement results from  the recent reviews by the NASA’s Inspector General and the National  Academy of Public Administration. Further, NASA stated in its response  to each of these reviews that it plans to adopt a more comprehensive,  risk-based approach to enhance its export control program. However, it will be  important for NASA to be vigilant in assessing actions taken to help  ensure effective implementation and to avoid a relapse into the former  practices.
Why GAO Did This Study

NASA develops sophisticated technologies and shares them with its international partners and others. U.S. export control regulations require NASA to identify and protect its sensitive technology; NASA delegates implementation of export controls to its 10 research and space centers. Recent allegations of export control violations at two NASA centers have raised questions about NASA's ability to protect its sensitive technologies. GAO was asked to review NASA's export control program.
This report assessed (1) NASA's export control policies and how centers implement them, and (2) the extent to which NASA Headquarters and CEAs apply oversight of center compliance with its export control policies. To do this, GAO reviewed export control laws and regulations, NASA export control policies, and State and Commerce export control compliance guidance. GAO also reviewed NASA information on foreign national visits and technical papers and interviewed officials from NASA and its 10 centers as well as from other agencies.

What GAO Found

Weaknesses in the National Aeronautics and Space Administration (NASA) export control policy and implementation of foreign national access procedures at some centers increase the risk of unauthorized access to export-controlled technologies. NASA policies provide Center Directors wide latitude in implementing export controls at their centers. Federal internal control standards call for clearly defined areas of authority and establishment of appropriate lines of reporting. However, NASA procedures do not clearly define the level of center Export Administrator (CEA) authority and organizational placement, leaving it to the discretion of the Center Director. GAO found that 7 of the 10 CEAs are at least three levels removed from the Center Director. Three of these 7 stated that their placement detracted from their ability to implement export control policies by making it difficult to maintain visibility to staff, communicate concerns to the Center Director, and obtain resources; the other four did not express concerns about their placement. However, in a 2013 meeting of export control officials, the CEAs recommended placing the CEA function at the same organizational level at each center for uniformity, visibility, and authority. GAO identified and the NASA Inspector General also reported instances in which two centers did not comply with NASA policy on foreign national access to NASA technologies. For example, during a 4-month period in 2013, one center allowed foreign nationals on a major program to fulfill the role of sponsors for other foreign nationals, including determining access rights for themselves and others. Each instance risks damage to national security. Due to access concerns, the NASA Administrator restricted foreign national visits in March 2013, and directed each center to assess compliance with foreign national access and develop corrective plans. By June 2013, six centers identified corrective actions, but only two set time frames for completion and only one planned to assess the effectiveness of actions taken. Without plans and time frames to monitor corrective actions, it will be difficult for NASA to ensure that actions are effective.
NASA headquarters export control officials and CEAs lack a comprehensive inventory of the types and location of export-controlled technologies and NASA headquarters officials have not addressed deficiencies raised in oversight tools, limiting their ability to take a risk-based approach to compliance. Export compliance guidance from the regulatory agencies of State and Commerce states the importance of identifying controlled items and continuously assessing risks. NASA headquarters officials acknowledge the benefits of identifying controlled technologies, but stated that current practices, such as foreign national screening, are sufficient to manage risk and that they lack resources to do more. Recently identified deficiencies in foreign national visitor access discussed above suggest otherwise. Three CEAs have early efforts under way to better identify technologies which could help focus compliance on areas of greatest risk. For example, one CEA is working with NASA's Office of Protective Services Counterintelligence Division to identify the most sensitive technologies at the center to help tailor oversight efforts. Such approaches, implemented NASA-wide, could enable the agency to better target existing resources to protect sensitive technologies.

What GAO Recommends

In April 2014, GAO recommended that the NASA Administrator establish guidance to better define the CEA function, establish time frames to implement foreign national access corrective actions and assess results, and establish a more risk-based approach to oversight, among other actions. NASA concurred with all of our recommendations and provided information on actions taken or planned to address them.