The U.S. government’s controls on the export of defense-related items are  primarily divided between the departments of Commerce and State, with  the assistance of the Department of Defense (DOD). Agency Processes Provide Limited Oversight of Export- Controlled Information and Rely on Companies for Its Protection

U.S. government export control agencies have less oversight on exports of  controlled information than they do on exports of controlled goods. Commerce’s and State’s export control requirements and processes—such  as export documentation, reporting requirements, and monitoring— provide physical checkpoints on the means and methods companies use to  export controlled goods to help them ensure such exports are made under  their license terms, but the agencies cannot easily apply these same  requirements and processes to exports of controlled information. Officials from one third of the companies we interviewed told us they do  not have internal control plans to protect their export-controlled  information. Companies Use a Variety of Practices to Protect Export-Controlled Information

Under the U.S. export control system, companies are responsible for  implementing procedures to protect export-controlled information  regardless of how it is exported. Almost two  thirds of the company officials we interviewed told us their companies use  internal control plans, which establish procedures to protect proprietary  and export-controlled information and also set requirements for access to  such material by foreign employees and visitors. Government Lacks Sufficient Knowledge of the Risks Associated with the Protection of Export- Controlled Information to Identify the Minimal Safeguards

The lead government agencies have not fully assessed the risks of  protecting export-controlled information to help identify the minimal level  of protection for such exports. Improved knowledge of the  risks associated with such exports could improve agency outreach and  training efforts, which now offer limited assistance to companies to  mitigate risks when protecting such information. Improved Knowledge of the Risks Associated with the Protection of Export- Controlled Information Could Improve Agency Outreach and Training

Government export control agencies use a variety of means—including  Internet Web sites, advisory opinions, and company training to  communicate information on export controls to industry. To assess steps the government has taken to identify and mitigate risks in  protecting export-controlled information, we analyzed Commerce’s and  State’s use of existing resources, such as licensing data, to identify trends  and vulnerable areas within company transfers of controlled information  and assessed each agency’s export control training and outreach  programs. To further assess our objectives, we interviewed officials from 46 U.S.  companies. Commerce’s and State’s industry outreach, training, and advisory  committee membership lists. Held both Commerce and State export licenses.
Why GAO Did This Study

The U.S. government controls exports of defense-related goods and services by companies and the export of information associated with their design, production, and use, to ensure they meet U.S. interests. Globalization and communication technologies facilitate exports of controlled information providing benefits to U.S. companies and increase interactions between U.S. and foreign companies, making it challenging to protect such exports. GAO assessed (1) how the government's export control processes apply to the protection of export-controlled information, and (2) steps the government has taken to identify and help mitigate the risks in protecting export-controlled information. To do this, GAO analyzed agency regulations and practices and interviewed officials from 46 companies with a wide range of exporting experiences.

What GAO Found

U.S. government export control agencies, primarily the departments of Commerce and State, have less oversight on exports of controlled information than they do on exports of controlled goods. Commerce's and State's export control requirements and processes provide physical checkpoints on the means and methods companies use to export controlled goods to help the agencies ensure such exports are made under their license terms, but the agencies cannot easily apply these same requirements and processes to exports of controlled information. For example, companies are generally required to report their shipments of export controlled goods overseas with Customs and Border Protection for exports made under a license, but such reporting is not applicable to the export of controlled information. Commerce and State expect individual companies to be responsible for implementing practices to protect export-controlled information. One third of the companies GAO interviewed did not have internal control plans to protect export-controlled information, which set requirements for access to such material by foreign employees and visitors. Commerce and State have not fully assessed the risks of companies using a variety of means to protect export-controlled information. The agencies have not used existing resources, such as license data, to help identify the minimal protections for such exports. As companies use a variety of measures for protecting export-controlled information, increased knowledge of the risks associated with protecting such information could improve agency outreach and training efforts, which now offer limited assistance to companies to mitigate those risks. GAO's internal control standards highlight the identification and management of risk as a key element of an organization's management control program. GAO also found that Commerce's and State's communications with companies do not focus on export-controlled information. For example, Commerce's and State's Internet Web sites do not provide specific guidance on how to protect electronic transfers of export-controlled information, a point raised by almost one fourth of the company officials GAO interviewed.