Export Controls: State and Commerce Should Improve Guidance and Outreach to Address University-Specific Compliance Issues

Over 1.2 million foreign students studied at U.S. universities in 2018 (see fig.). Although foreign students and scholars contribute to U.S. research, there is a risk that they will “export” sensitive knowledge they gain to their home countries. To mitigate this risk, the U.S. government implements export controls.

GAO was asked to review agency guidance and universities' security practices. This report examines (1) the extent to which State and Commerce have provided guidance and outreach that supports U.S. universities' understanding of export control regulations; (2) challenges U.S. universities face working with other federal agencies, such as DOD; and (3) the extent to which universities' export compliance practices align with State and Commerce guidelines.

GAO reviewed related laws, regulations, and guidance, and interviewed officials from relevant federal agencies and four university associations. GAO also visited nine universities—selected, in part, on the basis of research expenditures and geography—and assessed their compliance practices against agency guidelines.

The Departments of State (State) and Commerce (Commerce) have each provided guidance and outreach to support exporters' understanding of and compliance with their separate export control regulations. Exporters, including universities, are subject to these regulations if they ship export-controlled items overseas or if they share such items, including technology or source code, with foreign persons in the United States. University and association officials raised concerns that State and Commerce guidance and outreach does not adequately address export compliance issues that are more common to universities than to industry, such as fundamental research—i.e., research that is ordinarily published and not subject to export control regulations. Without additional guidance and outreach that addresses such issues, universities may not have the information they need to adequately comply with these regulations and properly safeguard export-controlled items.

Officials from selected universities and university associations identified three export control-related challenges in working with other federal agencies. For example, university and association officials asserted that Department of Defense (DOD) officials misunderstand the term fundamental research, which may limit universities' ability to conduct research for DOD. DOD acknowledged that some officials have inconsistently interpreted the regulations and that it has not yet fully addressed this challenge. Additionally, university and association officials expressed concerns that threat briefings and other guidance that the Federal Bureau of Investigation (FBI) and Department of Homeland Security provide are not helpful because, for example, they do not contain unclassified information that can be shared widely. To address these concerns, the FBI partnered with a university association to produce a series of unclassified “awareness-raising” materials for university audiences, among other efforts.

Seven of the nine universities GAO visited have export compliance policies and practices that generally align with State's and Commerce's export compliance guidelines. For example, most have demonstrated a strong management commitment to export compliance and have robust practices for tracking export-controlled items, recordkeeping, and reporting potential violations. However, GAO identified gaps in some universities' practices in four areas—risk assessments, training, internal audits, and export compliance manuals.

GAO is making four recommendations, including that State and Commerce should improve their export control guidance and outreach, which may help address gaps in university export control compliance practices. GAO also recommends that DOD take steps to ensure its officials consistently interpret export control regulations. State, Commerce, and DOD concurred with the recommendations.

Research conducted at U.S. universities contributes significantly to U.S.  national security and economic interests. Foreign students and scholars  have made substantial contributions to such research efforts and are  involved in developing many of the nation’s leading-edge civilian and  defense-related technologies. However, there is a risk that some foreign  students and scholars will transfer or “export” sensitive information they  gain through their research in the United States back to their home  countries, which may be hostile to U.S. interests. If such transfers include  information about sensitive civilian or defense-related technologies, they  could have significant consequences for U.S. national security. Similarly,  unlawful transfers of such information can have adverse consequences  for U.S. economic interests.

U.S. officials have expressed concern about foreign persons’ access to  and illicit appropriation of sensitive information and technology at U.S.  universities. In a 2019 hearing before Congress, for example, an Acting  Assistant Director for Homeland Security Investigations at the Department  of Homeland Security (DHS) testified that exploitation of academia is one  way in which adversaries are obtaining access to sensitive U.S. research.  He noted that China, Iran, and Russia are actively working to illicitly  acquire and transfer technologies whose export from the United States is  subject to government controls. Similarly, in its 2019 Worldwide Threat  Assessment, the Office of the Director of National Intelligence warned  that numerous foreign intelligence services continue to target national  security information and proprietary technology from U.S. research  institutions. This report also noted that China, a significant source of  foreign students in U.S. universities, seeks to exploit the openness of  American society, especially academia and the scientific community.

The Departments of State (State) and Commerce (Commerce) take the  lead in administering a complex set of export control regulations to  advance U.S. national security and foreign policy objectives. State  controls the export of defense articles and defense services, and  Commerce controls the export of “dual-use” items and less sensitive  military items by issuing export licenses when such exports meet the  requirements outlined in the International Traffic in Arms Regulations  (ITAR) and Export Administration Regulations (EAR), respectively. State  and Commerce may also require export licenses for the release of  controlled information to a foreign person, because such a release is  deemed to be an export to the home country of the foreign person, even if  the person is in the United States.

U.S. export control regulations, however, do not require institutions of  higher learning to obtain an export license for foreign students and  scholars to partake in fundamental research because fundamental  research is not subject to export control regulations. Fundamental  research is defined in the ITAR as basic and applied research in science  and engineering where the resulting information is ordinarily published  and shared broadly within the scientific community, as distinguished from  research the results of which are restricted for proprietary reasons or  specific U.S. government access and dissemination controls. The EAR  defines fundamental research as research in science, engineering, or  mathematics, the results of which ordinarily are published and shared  broadly within the research community, and for which the researchers  have not accepted restrictions for proprietary or national security reasons.

Other federal agencies, including the Federal Bureau of Investigation  (FBI) and DHS, educate exporters about and enforce export control  regulations. In addition, federal agencies, including the Department of  Defense (DOD), provide funding for research and development projects  that may involve items that are subject to export control regulations.

You asked us to review the mechanisms U.S. agencies have developed  to ensure that U.S. universities understand and comply with export control  regulations as well as the security practices of U.S. universities engaged  in sensitive research. This report examines (1) the extent to which State  and Commerce have provided guidance and outreach that supports U.S.  universities’ understanding of and compliance with both agencies’ export  control regulations, (2) export control-related challenges that U.S.  universities face working with or obtaining guidance from other federal  agencies, and (3) the extent to which export compliance policies and  practices developed by U.S. universities align with State’s and  Commerce’s export compliance guidelines.

To identify university perspectives for all three of our objectives, we  interviewed (1) representatives from four university associations— Association of University Export Control Officers, Association of American  Universities, Council on Governmental Relations, and Academic Security  Counter Exploitation Program—and (2) officials at nine U.S. universities.  Together, these university associations represent over 180 research  universities nationwide. We selected a non-generalizable sample of nine  U.S. universities out of a list of 292 research universities that expend, on  average, more than $15 million on research and development annually,  on the basis of a number of factors, including total research and  development expenditures, number of graduate students, research  funding received from certain federal agencies, and geographic  dispersion. While we sought to include a range of university experiences  regarding export control compliance in our sample, the university officials’  views stated in this report do not represent the entirety of the U.S.  academic community.

To determine the extent to which State and Commerce have provided  guidance and outreach that supports U.S. universities’ understanding of  and compliance with both agencies’ export control regulations, we  interviewed relevant State and Commerce officials and reviewed the  guidance and outreach materials these agencies developed related to  export controls. We also interviewed representatives from three of the  four university associations and officials at the nine universities we  visited.

To determine export control-related challenges that U.S. universities face  while working with and obtaining guidance from other federal agencies,  we interviewed representatives from all four university associations and  officials at the nine universities we visited. We also met with officials from  several agencies that provide research funding to universities, including  DOD, the Department of Energy, the National Institutes of Health, and the  National Aeronautics and Space Administration. Additionally, we met with  DOD’s Defense Counterintelligence and Security Agency, DHS, and the  FBI and reviewed reports, handouts, and outreach materials regarding  export control regulations and the threat environment to learn how these  agencies educate U.S. universities. Finally, we met with the White House  Office of Science and Technology Policy to discuss an interagency effort  to address research security and other related issues.

To determine the extent to which export compliance policies and  practices developed by U.S. universities align with State’s and  Commerce’s export compliance guidelines, we first reviewed State’s and  Commerce’s guidelines that pertain to the development of an effective  compliance program to identify common elements and developed a list of  eight elements that the two agencies identified as critical for an effective  compliance program. We then interviewed officials at the nine universities  we visited and assessed the officials’ responses against these eight  elements.

To provide context for all three objectives, we examined federal data  concerning (1) the number of foreign students and scholars studying or  working at U.S. universities, (2) federal agencies’ research and  development funding provided to universities, and (3) U.S. universities’  export license applications. We also examined U.S. university research  and development expenditures data collected by the National Science  Foundation for the 2013 through 2017 period to identify a sample of U.S.  research universities for site visits. We determined that all of these data  sources were sufficiently reliable for providing context for our report.

For more details on our scope and methodology, see appendix I.

We conducted this performance audit from February 2019 to May 2020 in  accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.

The U.S. government implements export controls to manage risks  associated with exporting sensitive items while ensuring that legitimate  trade can still occur, and to advance U.S. national security and foreign  policy objectives. These export controls are governed by a complex set of  laws, regulations, and processes that multiple federal agencies administer  to ensure compliance. State and Commerce each play a significant role  in the implementation of U.S. export controls. State controls the export of  sensitive military items, known as defense articles and defense services,  such as tanks, fighter aircraft, missiles, and military training, which it lists  on the U.S. Munitions List (USML). Commerce controls the export of U.S.-origin items with both commercial and military applications (known  as “dual-use” items), such as computers, sensors and lasers, and  telecommunications equipment, as well as less sensitive military items,  which it lists on the Commerce Control List (CCL).

Items subject to State and Commerce jurisdiction are governed by  separate laws and regulations. The Arms Export Control Act of 1976, as  amended, provides the statutory authority to control the export of defense  articles and services, which the President delegated to the Secretary of  State. State’s ITAR implements this authority and identifies the specific  types of items subject to control in the USML. Within State, the  Directorate of Defense Trade Controls (DDTC) is responsible for  implementing controls on the export of these items. The Export Control  Reform Act of 2018 provides the statutory authority for Commerce to  control the export of less sensitive military items not on the USML, dual- use items, and basic commercial items. In general, items subject to the  EAR include commodities, software, and technology. Commerce’s EAR,  which contains the CCL, implements this authority. Commerce’s Bureau  of Industry and Security (BIS) is responsible for administering these  export controls.

DDTC and BIS control the export of items within their respective  jurisdictions by requiring, in certain instances, a license or other  authorization to export an item. Whether a license is required will  generally depend on the intended destination, end-use and end-user, and  the item’s classification. Generally, unless a license exemption or  exception applies, exporters submit a license application to DDTC if their  items are controlled on the USML, or to BIS if their items are controlled on  the CCL. In addition to the shipment of tangible commodities or the  tangible or intangible transfer of software or technology outside of the  United States, export control regulations also consider the transfer or  release of certain U.S. technology or source code to a foreign person in  the United States to be an export. These transfers or releases are  commonly referred to as “deemed exports” and can take the form of  written, oral, or visual disclosure of technology or source code. Under the  ITAR, technical data is controlled for all exports, including deemed  exports. Under the EAR, technology and source code are controlled for  the purpose of deemed exports.

Export Controls in the University Environment

Export-controlled items or source code used in U.S. universities’ research  activities may be subject to export controls. Such activities could include  shipping an export-controlled item—such as certain biological samples or  research equipment—overseas. Additionally, the release of export- controlled items or source code in connection with research activities to a  foreign student or scholar could qualify as a deemed export requiring a  license.

U.S. universities may be exempt from or not subject to export controls if  the information they are planning to release falls into one of three  categories: published information or information in the public domain,  certain academic information, or fundamental research.

Published information or information in the public domain: Under  the ITAR, information that is published and generally available in the  public domain through specific methods is not considered to be  technical data, and is therefore not subject to ITAR export licensing  requirements. Under the EAR, unclassified technology or software  that has been made available to the public without restrictions upon its  further dissemination is considered to be published and is therefore  not subject to the EAR.

Certain academic information: Under the ITAR, information  regarding general scientific, mathematical, or engineering principles  commonly taught in schools is not included in the definition of  technical data and is not subject to ITAR export controls. Similarly,  information that is taught in catalog-listed courses or associated  teaching laboratories of academic institutions is not subject to the  EAR.

Fundamental research: Fundamental research is not subject to the  ITAR or the EAR. The ITAR defines fundamental research as basic  and applied research in science and engineering where the resulting  information is ordinarily published and shared broadly within the  scientific community, as distinguished from research the results of  which are restricted for proprietary reasons or specific U.S.  government access and dissemination controls. The EAR defines  fundamental research as research in science, engineering, or  mathematics, the results of which ordinarily are published and shared  broadly within the research community, and for which the researchers  have not accepted restrictions for proprietary or national security  reasons. Under the EAR, software and technology that arise during or  result from fundamental research that is intended to be published is  also not subject to the EAR. For example, a foreign person may be  able to read research reports or view presentations that result from  fundamental research and are intended to be published without the  university obtaining a license. However, if that research involves  software or technology that is subject to the ITAR or the EAR and is  not intended to be published or produces an item that is subject to the  ITAR or the EAR, the foreign person generally could not participate in  the research without the university securing an export license.

Foreign Threats to Universities and Vulnerabilities in U.S. Export Controls

According to the FBI and DOD, as foreign adversaries use increasingly  sophisticated and creative methodologies to exploit America’s free and  open education environment, the United States faces an ever-greater  challenge to strike a sustainable balance between unrestricted sharing  and sufficient security within the U.S. university research environment.  According to a 2019 FBI white paper, the inclusion of foreign students  and scholars at U.S. universities entails both a substantial benefit and a  notable risk. Specifically, the FBI reported that while many of these  foreign students and scholars contribute to advanced research, the  development of cutting-edge technology in an open research environment  puts academia at risk for exploitation by foreign actors who do not follow  U.S. laws and regulations. Additionally, a DOD report from September  2019 stated that research targeted by foreign talent programs includes  topics relevant to U.S. national defense. According to the FBI, while the  majority of foreign students and scholars do not pose a threat to their host  institution, fellow classmates, or research fields, some foreign actors seek  to illicitly or illegitimately acquire U.S. academic research and information  to advance their home countries’ scientific, economic, and military  development goals. By doing so, they can save their home countries  significant time, money, and resources while achieving generational  advances in technology.

The U.S. government, including GAO, has long identified vulnerabilities in  U.S. agencies’ efforts to protect U.S. research from foreign entities who  might seek to exploit the openness of the U.S. academic environment. In  prior GAO reports, we identified weaknesses in the deemed export  control system that could allow the unauthorized transfer or release of  export-controlled items to foreign persons in the United States.  Moreover, since 2007, we have identified the protection of technologies  critical to U.S. national security interests—including through U.S. export  controls—as a high-risk area. More recently, the Senate Homeland  Security and Governmental Affairs Committee reported that federal  agencies need to do more to mitigate the threat to American universities  by foreign persons seeking to undermine the integrity of the American  research enterprise and endanger our national security.

Foreign Students and Scholars at U.S. Universities

More than 1.2 million foreign students and 21,000 foreign scholars  studied or worked at U.S. universities in 2018. Nearly a third of foreign  students studying in the United States are from China, and a large  proportion of Chinese students major in science, technology, engineering  and mathematics (STEM) fields (see table 1).

In addition, 10 countries accounted for about 70 percent of the more than  21,000 foreign scholars who worked at U.S. universities in 2018 (see  table 2).

The federal government obligated approximately $33 billion for U.S.  universities for research and development in fiscal year 2017. The  National Institutes of Health obligated approximately 54 percent of federal  research and development funding provided to U.S. universities that year.  The Department of Energy, DOD, and the National Aeronautics and  Space Administration also obligated significant funding for universities for  research (see fig. 1).

State and Commerce Have Provided Guidance and Conducted Outreach, but Universities Expressed Concerns about Their Adequacy for Addressing University-Specific Issues

State’s DDTC and Commerce’s BIS have developed export compliance- related guidance and conducted outreach to support all exporters’  understanding of and compliance with the regulations. However,  university and association officials raised concerns that DDTC and BIS  guidance and outreach does not adequately address university-specific  export compliance issues. In addition, DDTC’s export compliance  guidelines do not explicitly promote risk assessments, identified by GAO  as a key element for determining whether an entity’s processes address  current threats.

State and Commerce Have Provided Export Control-Related Guidance and Conducted Outreach to Support Exporters’ Compliance Efforts

State’s DDTC and Commerce’s BIS have developed various forms of  written guidance and conducted outreach to support all exporters’  understanding of export control regulations. The ITAR and the EAR  regulations apply to all exporters, whether universities, private entities,  non-profits, or government entities, and according to DDTC and BIS  officials, the guidance and outreach materials they have developed are  similarly applicable to all potential exporting entities, including  universities.

Both DDTC and BIS provide written guidance intended to (1) increase  awareness of applicable export control regulations, (2) provide specific  instructions or tools for complying with those regulations, and (3)  dispense transaction or entity-specific information or guidance for all  exporters. For example, DDTC’s and BIS’s websites include general  information about their respective export control regulations, including  guidance on when an export license is needed and how such a license  can be procured. DDTC highlights useful resources available on its  website in a letter it sends to entities, including universities, when those  entities register with DDTC as potential exporters of ITAR-controlled  items. BIS’s website includes information about deemed exports, which  one BIS official said is particularly relevant to universities. Both websites  also include sets of frequently asked questions.

DDTC and BIS have also developed guidance that provides specific  instructions or tools for complying with the agencies’ regulations,  including export compliance guidelines (see below for more information  about these guidelines) and decision tools for classifying items subject to  the ITAR and the EAR. For example, DDTC offers exporters an online  tool to help them identify steps to follow in reviewing the USML and in  classifying items subject to the ITAR. Similarly, BIS provides exporters  with (1) online tools to help them classify items subject to the EAR and (2)  guidelines for completing the license application for both deemed exports  and tangible exports, such as chemical and biological items.

Finally, both DDTC and BIS offer several mechanisms for obtaining  transaction- or entity-specific information or guidance. For example,  DDTC and BIS provide advisory opinions when an exporter requests a  formal answer to an export control-related question, and both agencies  operate a hotline to provide informal guidance to potential exporters. In  addition, BIS reviews and provides feedback on export compliance  manuals adopted by exporting entities, including universities, when  requested. Exporters may also request a commodity jurisdiction  classification from DDTC and BIS to determine whether a commodity is  subject to the ITAR or the EAR.

Both agencies also provide training, present at conferences, and conduct  site visits to further educate exporters. For example, DDTC provides in- house seminars on export licensing basics approximately twice a year.  BIS has developed and conducts various types of training related to  export control compliance, including training videos that are publicly  available on its website. BIS also hosts regional seminars and an annual  conference in Washington, D.C., on export controls and export  compliance.

Both DDTC and BIS participate in various conferences. For example,  DDTC and BIS participate in an annual conference affiliated with the  Association of University Export Control Officers, where agency officials  discuss topics such as regulatory updates, license statistics, and export  compliance best practices. In fiscal year 2019, DDTC participated in 52  outreach events, two of which were university-specific. During that year,  BIS conducted or participated in over 80 outreach events, six of which  were university-specific.

DDTC and BIS also conduct site visits to learn more about a given entity’s  export compliance program and provide feedback, among other things.  According to officials, DDTC conducted three university site visits from  2015 through 2019. Similarly, according to officials, BIS conducted two  university site visits from 2013 through 2019. Further, officials at both  agencies stated that they share information at outreach events about  export compliance program strengths and weaknesses they identified  during site visits.

Universities Expressed Concerns that Agency Guidance and Outreach Does Not Adequately Address University- Specific Export Compliance Issues

Officials from universities in our sample and university association  officials told us that most DDTC and BIS export control-related guidance  and outreach does not address those issues most relevant to the  university export compliance environment and that additional guidance  and outreach efforts would be useful. For example, according to  association officials and officials at six of the nine universities we visited,  it is sometimes difficult to understand how to implement in the university  environment what they perceive to be industry-focused guidance  developed by DDTC and BIS. Some of these officials further noted that  the export compliance environment for industry typically differs from that  for academia. Specifically, university and association officials noted that  companies are typically focused on developing proprietary technologies,  whereas universities are primarily focused on expanding knowledge through fundamental and collaborative research. In addition, officials from  two universities stated that researchers typically do not see themselves  as exporters, which makes it difficult to explain to them how export control  regulations pertain to university research. For example, one official told us  that it is difficult to explain the concept of a deemed export within an  open, academic setting to university researchers. Officials at two  universities also noted that the term “defense service,” a type of export  subject to the ITAR, is a difficult concept to explain to university  researchers who do not consider their work to be a “service.”

Officials at four universities told us that they rely on university  associations to develop a common understanding or interpretation of the  regulations for the university context. For example, officials from one  university said that university associations are a resource for sharing  information and best practices regarding export compliance in the  university environment. An official from another university stated that  although she reviews the DDTC and BIS websites periodically for  regulatory updates, she relies on university associations to explain how  any updates affect universities.

Some university officials stated that some agency outreach efforts are  useful, but others said that more outreach is needed. Specifically, five  university officials mentioned specific agency training and outreach efforts  as being useful. For example, the officials said they appreciate that BIS  conducts regional seminars for all exporters, which they said are easier to  get to than events in Washington, D.C. One of these officials further noted  that these seminars discuss how to set up an effective compliance  program. However, four university officials stated that additional outreach  efforts by both DDTC and BIS were needed. For example, two of these  officials suggested that agencies consider additional training for  universities, such as webinars or videos providing examples of simple  export scenarios for university audiences, to clarify the intent of the export  control regulations and explain how regulatory requirements pertain to  university research.

In discussing additional guidance needs, university and association  officials told us that a set of all-encompassing, university-specific  guidance is not necessary, but that additional guidance addressing  specific topics that are relevant to universities would be useful. For  example, one university association told us that additional DDTC and BIS  guidance could take the form of frequently asked questions regarding  issues of interest to universities, such as deemed exports and  fundamental research. Similarly, one university export control officer  stated that additional sets of frequently asked questions focused on  issues most relevant to university export compliance, examples of  university export compliance best practices, and examples of export  control violations committed by universities would be particularly helpful.  This export control officer explained that such guidance would help her  and her colleagues (1) explain why the export control regulations are  relevant for university researchers and (2) better explain the need for  additional compliance resources to university management.

University and association officials further stated that it would be helpful if  DDTC and BIS would work with university associations to develop  guidance that would support universities’ efforts to interpret the  regulations consistently. These officials said that a stronger partnership  between the regulatory agencies and universities would support agencies’  understanding of the university environment and result in better guidance  for universities. They noted, for example, that soliciting university input on  existing guidance and suggestions for additional guidance could provide  DDTC and BIS with helpful information about the challenges that  universities face in complying with export control regulations in their  distinct environment.

DDTC officials acknowledged that additional guidance addressing  university-specific issues could be helpful and agreed that it may be  difficult for university export control officers to explain export control  regulations to researchers. They told us that it could be useful for the  department to draft white papers, sets of frequently asked questions, or  tip sheets specifically addressing issues most relevant to universities. For  example, officials suggested that DDTC could develop tips on what may  constitute a defense service in the university context. DDTC officials  explained that they had not drafted such guidance because of resource  constraints and other priorities.

When we asked BIS officials about the potential need for university- specific guidance, one official identified some currently available guidance  that could be most useful to universities. For example, BIS maintains a  set of frequently asked questions and a YouTube webinar concerning  deemed exports, and has guidance related to fundamental research  available on its website. According to BIS, it regularly updates guidance  related to deemed exports and fundamental research, including in  connection with regulatory changes that affected both areas in 2016.

GAO’s Standards for Internal Control in the Federal Government state  that management should communicate with, and obtain information from,  external parties using established reporting lines. Although BIS has  provided written guidance that is relevant to universities and both DDTC  and BIS conduct university-specific outreach, officials at universities we  visited and associations we interviewed raised concerns about the  adequacy of this guidance and outreach for the university research  environment. Without additional guidance and outreach from DDTC and  BIS that addresses issues most relevant to universities, some universities  may utilize guidance, training, or other resources developed by other  entities that may not facilitate compliance with export control regulations  in the way that DDTC and BIS intended. Hence, universities may be at  risk of failing to comply with export control regulations and properly  safeguard export-controlled items from foreign students and scholars who  are not authorized under deemed export licenses to receive such items.  In addition, such university-focused guidance is consistent with the Export  Control Reform Act of 2018, which requires the President to enforce  export controls by providing guidance in a form that facilitates compliance  by academic institutions and other entities.

State’s Written Guidance Does Not Explicitly Promote Risk Assessments

Although State’s DDTC and Commerce’s BIS officials identified their  respective export compliance guidelines, available on the agencies’  websites, as key sources of written guidance for supporting exporters’  compliance with each agency’s export control regulations, DDTC’s  compliance guidelines do not explicitly promote risk assessments. Both  sets of export compliance guidelines include similar elements that the  agencies consider critical for an effective export compliance program. For  example, both sets of guidelines include elements related to management  commitment, recordkeeping, and training. However, DDTC’s guidelines  do not advise entities on how to assess risk, which GAO has identified as  a key element for determining whether an entity’s processes address  current threats.

BIS Guidelines. BIS’s export compliance guidelines identify eight  elements of an effective export compliance program. BIS officials stated  that the agency’s guidelines provide a useful compliance framework for all  exporters, including universities. These guidelines include information  about recordkeeping, conducting internal audits, performing risk  assessments, and training, among other elements. BIS’s guidelines also  provide templates, checklists, specific examples, and other tools  exporters may use to develop an export compliance program or enhance  an existing program. For example, the guidelines include a summary of  potential risks involved in each phase of the exporting process with a list  of tools to mitigate such risks. The guidelines also include an audit  module tool to help exporters review and revise their current compliance  program with a set of checklists for each of the eight elements.

DDTC Guidelines. DDTC’s export compliance guidelines include nine  elements that it has identified as important aspects of an effective export  compliance program. According to DDTC, its guidelines are also  applicable to all exporters, including universities, and the agency  references them in a confirmation letter when entities register as  exporters. The guidelines include information about organizational  structure, corporate commitment and policy, internal monitoring, and  training, among other elements. The guidelines also provide examples of  questions a compliance program should address for some elements.

However, DDTC’s export compliance guidelines lack a risk assessment  element. Risk assessments provide entities with an opportunity to review  their processes to determine whether the processes in place address  current threats. According to DDTC, the agency has not added guidance  related to risk assessments to the export compliance guidelines because  it assumes that exporters conduct a risk assessment for each compliance  element as a matter of course. GAO’s Standards for Internal Control in  the Federal Government state that management should communicate  quality information externally so that external parties can help the entity  achieve its objectives and address related risks. Further, according to  an Office of Management and Budget bulletin, agencies increasingly have  relied on guidance documents to inform the public and to provide  direction to their staffs as the scope and complexity of regulatory  programs have grown. Exporters, including universities, may not  conduct periodic risk assessments if DDTC’s guidance does not  encourage them to do so. As such, they may be unaware of potential  threats and may not take appropriate measures to protect export- controlled items.

Universities Identified Challenges Working with and Obtaining Guidance from Other Agencies

University and association officials we interviewed identified challenges  working with and obtaining guidance from federal agencies that fund  research and monitor threats to the United States, including threats to  research security. Specifically, university and association officials  identified the following three challenges working with and obtaining  guidance from these agencies: (1) federal agencies are developing  different requirements for reporting financial conflicts of interest to  address foreign influence issues, (2) some agencies provide briefings and  other forms of guidance related to export controls and foreign threats that  do not sufficiently address universities’ needs, and (3) DOD officials  inconsistently interpret export control regulations and misunderstand what  constitutes fundamental research. Agencies are taking steps to address  some of these challenges. For example, an interagency working group  established by the White House Office of Science and Technology Policy  and individual federal agencies are undertaking efforts to address  university concerns regarding inconsistent financial conflict of interest  reporting requirements and the lack of relevant, university-specific  resources to address threats identified by some agencies. However, the  actions that DOD plans to take to address agency officials’ inconsistent  interpretation of the regulations and their misunderstanding of the term  fundamental research may not fully address the challenge identified by  university and association officials.

Universities Identified Inconsistent Reporting Requirements as a Challenge

University and association officials expressed concerns that federal  agencies are developing different requirements for reporting financial or  other conflicts of interest, such as foreign funding, but some of these  differences in reporting requirements may be necessary to address  varying agency-specific legal requirements. For example, recent  reporting guidance from the National Institutes of Health reminds  researchers to report all sources of support, including support for  laboratory personnel and the provision of materials that are not freely  available, whereas the most recent guidance from DOD does not  include such clarification for what constitutes “support.” Although each  agency has a separate mission and separate legal authorities, which may  require agencies to have different financial or other conflict of interest  reporting requirements, officials at several universities and associations  discussed the challenges they face in complying with these varied  reporting requirements. Representatives from one university association  explained that these new requirements are especially challenging for  universities because they typically accept funding from multiple agencies.  In addition, officials from one university stated that the variation across  the agencies’ reporting requirements makes it difficult to develop one  process to support researchers’ efforts to comply with them. According to  university and association officials, universities will need to spend more  time and resources to understand and comply with each set of  requirements. Moreover, one association official told us there is more  room for universities to make mistakes when each agency develops  different requirements to deal with the same issue.

An interagency working group established by the White House Office of  Science and Technology Policy is undertaking efforts to address  university concerns regarding inconsistent financial conflict of interest  reporting requirements. In May 2019, the Office of Science and  Technology Policy established the Joint Committee on the Research  Environment (JCORE), an interagency effort to address research security  and other related issues. According to officials in the Office of Science  and Technology Policy, JCORE has drafted one set of coordinated  guidance for funding agencies to ensure that funding agencies  consistently require researchers to report the same types of information  regarding potential conflicts of interest. In addition, JCORE has drafted a  set of non-binding guidelines for universities to support their efforts to  comply with conflict of interest reporting requirements. Officials stated that  the draft guidance for funding agencies and the non-binding guidelines for  universities were under review as of January 2020. Officials further stated  that JCORE is developing a set of case studies and other materials that  federal agencies will be able to use to educate researchers and  universities about the types of situations that represent a potential conflict  of interest.

Universities Cited a Lack of University-Specific Resources for Addressing Threats Identified by Some Agencies as a Challenge

Agencies such as the FBI, DHS, BIS’s Office of Export Enforcement, and  DOD’s Defense Counterintelligence and Security Agency provide  briefings and other forms of guidance related to export controls and  foreign threats. For example, officials at these agencies provide briefings  to individual universities or to groups of universities during university  association events, such as the annual Association of University Export  Control Officers conference and the annual Academic Security  Conference hosted by the Texas A&M University System. In addition,  DHS identified the 11 universities with the largest number of foreign  students studying in STEM fields in 2018 to target university outreach  efforts in late 2018 and early 2019. DHS developed a template  presentation for DHS field offices to use during their outreach to these  universities to increase awareness of export control laws. According to  DHS, it plans to expand this effort to target the top 60 universities with  foreign students in STEM fields. The Department of Justice and BIS’s  Office of Export Enforcement have both published reports summarizing  recent major U.S. export enforcement-related criminal and administrative  prosecutions. Some university officials told us that the briefings and  other information that some agencies provide are helpful for improving  their awareness of threats.

However, officials at five of the nine universities we visited and officials  from three university associations said that these briefings and other  information are not as useful as they could be. Some of these officials  cited the following reasons for why they did not find such information to  be useful:

Classified information cannot be shared widely: Some university  officials and an association representative stated that some agencies  often provide classified briefings and materials that they cannot share  widely with the university community. One university official said that it  would be helpful if agencies, where possible, could also provide some  unclassified information with clear examples that could then be shared  with researchers about current threats and what these threats may  look like in a university setting. Without such information, university  officials are restricted in how they can use the threat-related  information they obtain for raising awareness on campus, according to  a university association official. Moreover, another university official  stated that if export control officers cannot share relevant threat  information with the university’s administration because of  classification issues, the university may not get the resources it needs  to improve its compliance programs and properly comply with export  control regulations.

Guidance and threat information does not address the university  environment or utilizes outdated examples: Representatives from  three university associations and one university stated that some  federal agencies do not provide guidance and threat information that  address the university research environment, and two associations  said that any university-specific examples federal agencies provide  during briefings are outdated, which limits the relevancy of guidance  and threat information to the university environment. For example, an  official from one association explained that in 2015 the FBI provided a  threat briefing at an association meeting and requested that university  officials contact the FBI if a researcher had, among other things,  published in an international scientific journal or attended an  international conference, or if any graduate students worked in  university laboratories late at night. This official noted that these FBI  officials did not understand that researchers must undertake such  activities to obtain tenure and that it is common for students to work  late at night. In addition, according to an official from one association,  when university officials ask the FBI to provide recent examples of  foreign students stealing sensitive or export-controlled items from U.S.  universities, the FBI often cites cases that occurred more than 10  years ago. He further stated that federal agencies are raising alarms  that universities are vulnerable to foreign theft of export-controlled  items without any concrete, recent examples.

FBI threat briefings lack actionable guidance: University officials  told us that many FBI threat briefings are not helpful because they do  not provide actionable guidance for addressing identified threats,  which limits universities’ understanding of how to address them. For  example, one university official stated that the FBI briefings do not  provide any detailed information about what attendees should do with  the information they obtain. He further stated that the briefings would  be more beneficial if the FBI provided prescriptive guidance on how to  use the information.

DOD and the FBI are taking steps to partner with academia to address  challenges regarding information sharing. DOD is undertaking several  collaborative efforts with academia in response to Section 1286(d) of the  2019 National Defense Authorization Act, which directed the Secretary of  Defense to establish an initiative to support protection of national security  academic researchers from undue influence and other security threats.  For example, DOD partnered with the National Academy of Engineering  to establish the “Roundtable on Linking Defense Basic Research to  Leading Academia Research and Engineering Communities,” or the  “Deans’ Roundtable.” The Deans’ Roundtable brings DOD leadership  together with deans from U.S. university engineering programs to  facilitate dialogue between DOD and the academic research community  on research protection. The roundtable’s objectives are to better  understand major issues in the defense research community and to form  working groups to help craft potential solutions to challenges identified by  the roundtable. The roundtable is expected to help address issues of  research espionage by foreign governments on university campuses and  inform senior DOD officials about technological developments on  university campuses, among other efforts.

The FBI partnered with the Academic Security and Counter Exploitation  Program, a university-led association focused on research security, to  produce a series of unclassified “awareness-raising” materials for  university audiences. According to FBI officials and a member of the  Academic Security and Counter Exploitation Executive Committee, the  FBI recognized that university officials were frustrated that relevant FBI  documents regarding the foreign threat to U.S. research were classified.  The association’s Executive Committee member further explained that  this created significant restrictions on the way university officials could  use the materials for awareness and training efforts on campus. He  further noted that many of these “awareness-raising” materials were tone- deaf to the needs of academia and did not explain how the threats were  related to university researchers’ work. The Academic Security and  Counter Exploitation Executive Committee worked with the FBI to revise  existing FBI handouts to create a series of academic-focused,  unclassified documents suitable for inclusion in awareness and training  programs on university campuses. For example, they revised a FBI  handout regarding the threat that China poses to corporate America to  instead focus on the threat that China poses to academia.

Universities Identified DOD Officials’ Inconsistent Interpretation of Export Control Regulations as a Challenge, and DOD’s Planned Actions Will Not Fully Address the Issue

Officials from multiple universities and associations stated that DOD  officials inconsistently interpret export control regulations and  misunderstand the term fundamental research and its implications when  providing funding for university research, which some officials said leads  to confusion, results in contract delays, and may limit universities’ ability  to conduct research for DOD. DOD officials acknowledged that some  officials have inconsistently interpreted the regulations. Moreover, DOD  reported to Congress in September 2019 that it is mindful of the fact that  reducing the quantity and competitiveness of early ideas flowing through  the university system to the department by non-judicious use of controls  could have negative consequences.

Officials at four of the nine universities we visited identified DOD officials’  inconsistent interpretation of the regulations and their misunderstanding  of what constitutes fundamental research as a challenge they face in  complying with export control regulations. For example, officials at three  universities asserted that DOD includes contract clauses, such as export  control-related clauses, that are not relevant to or conflict with other  stated terms in the contract, in some cases. Officials at two universities  further stated that there appears to be an internal disagreement between  the program officers and contracting officers about how to interpret some  aspects of export control regulations. One university official said the  university tries to negotiate with DOD when contracts that the university  perceives as only containing fundamental research include export control- related clauses; however, the official said these types of delays slow the  pace of research.

Moreover, university association officials noted that member universities  are reporting that DOD is increasingly including publication restrictions in  research contracts for projects that the universities believe only entail  fundamental research. Research does not qualify as fundamental  research if the researcher accepts any restrictions on the publication of  the information resulting from the research. Officials from one association  stated that DOD is reluctant to remove publication restrictions from award  contracts even when it acknowledges that the work may only involve  fundamental research. As a result, universities that only accept  contracts for fundamental research may decline an awarded contract if  the conditions for the award vary from initial expectations, which may lead  to a loss in research funding for many universities focused on  fundamental research.

In 2008 and 2010, DOD issued memoranda to its personnel providing  clarifying guidance concerning fundamental research and directed that  information about contracted fundamental research be included in general  training modules for research program personnel. For example, these  memoranda state that DOD must not place restrictions on subcontracted  unclassified research that has been scoped, negotiated, and determined  to be fundamental research within the definition of National Security  Decision Directive 189 according to the prime contractor and research  performer and certified by the contracting component, except as provided  in applicable federal statutes, regulations, or executive orders. These  memoranda also state that the effective implementation of the guidance  requires that all DOD personnel involved in the acquisition and monitoring  of fundamental research have a clear and common understanding of the  relevant statutes, regulations, and policies, including the definitions of key  terms. To implement these memoranda, DOD also amended the defense  federal acquisition regulations in 2013 to update the relevant contract  clause for inclusion in DOD contracts.

The Deputy Director for Basic Research at DOD stated that most program  officers and contracting officers are familiar with the export control  regulations and understand the term fundamental research and how to  interpret it in the context of university research, but acknowledged that  some officials have inconsistently interpreted the regulations and  misinterpreted the term fundamental research. Specifically, DOD officials  stated that program officers and contracting officers who frequently work  with universities through basic research grants understand what  constitutes fundamental research; however, program officers and  contracting officers working with applied research contracts may not be  as familiar with it or with engaging with universities.

Furthermore, DOD officials acknowledged that although DOD has  developed export control-related training, it does not require program  officers and contracting officers to take this training. Officials stated that  not all program officers and contracting officers work with universities, so  they do not all need to take training on export control regulations.

To address these and other research-related concerns, DOD’s Office of  Basic Research convened a workshop for basic research program  officers in October 2019 to facilitate the sharing of best practices and  identify any concerns. According to DOD, program officers raised a  concern that they need to constantly ensure that the research being  conducted is properly categorized as basic or fundamental research and  has not transitioned into applied or non-fundamental research in the  course of the contract. DOD’s Office of Basic Research is planning to  develop a checklist based on input from program officers that program  officers can use when determining whether the scope of a research  project meets the definition of fundamental research. Following this  workshop, a DOD official stated that program officers are best suited to  make technical and nuanced fundamental research determinations  because program officers have first-hand knowledge about the scope of  the research project.

These actions, however, may not address the concerns universities  raised, because they do not include any effort to further educate  contracting officers. Contracting officers may add export control clauses  or publication restrictions to a contract award after the program officer  writes the original solicitation. Additionally, contracting officers are the  individuals with regulatory authority for defense contracts to certify that  research is fundamental research. Hence, a checklist for program officers  may not fully address program officers’ and contracting officers’  inconsistent interpretation of the regulations, including determining  whether university research constitutes fundamental research. Without  additional efforts to educate all relevant DOD officials on a clear and  common understanding of the relevant statutes, regulations, and policies,  as identified by the department’s 2010 memorandum, universities may  continue to perceive that DOD officials inconsistently interpret the  regulations and misunderstand whether research constitutes fundamental  research, potentially hindering DOD-funded research at universities.

Universities We Visited Generally Have Developed Export Compliance Policies and Practices Aligned with Agency Guidelines, Though Some Gaps Exist

The nine universities we visited have generally developed export  compliance policies and practices to safeguard export-controlled items  that align with State’s DDTC and Commerce’s BIS export compliance  guidelines, but some of the universities’ compliance efforts have  weaknesses in certain areas (see fig. 2).

We reviewed DDTC’s and BIS’s export compliance guidelines to identify  common elements and developed a list of eight elements that the  agencies classified as critical for an effective compliance program, such  as recordkeeping and training, among others. See table 3 for a  description of the eight elements we identified for this assessment.

We then interviewed officials at nine universities about their universities’  export compliance policies and practices. We selected universities with  annual average expenditures for research and development during the  2013 through 2017 period that ranged from $15 million to over $750  million. In addition, we selected universities on the basis of a number of  factors, including total research and development expenditures, number  of graduate students, research funding received from certain federal  agencies, and geographic dispersion (see app. I for more information  about our selection methodology). Finally, we assessed the university  officials’ responses against the eight elements of an effective export  compliance program to determine the extent to which these universities’  policies and practices align with DDTC’s and BIS’s export compliance  guidelines. See appendix III for a detailed description of our assessment  of each university’s policies and practices against these elements and a  description of the export compliance policies and practices the selected  universities have in place.

In addition, we reviewed the websites of a generalizable sample of 100  U.S. universities to determine the extent to which these universities  provide publicly available information about export control regulations,  training, and other topics pertinent to the campus community. In general,  the universities with larger research and development expenditures  provided more export control-related information on their websites. See  appendix IV for the results of this analysis.

Most of the Universities We Visited Have Export Compliance Policies and Practices That Generally Align with Agency Guidelines, with More Robust Practices in Four Areas

The seven universities with the highest research expenditures among the  nine we visited have export compliance policies and practices that  generally align with the eight elements we identified from DDTC’s and  BIS’s export compliance guidelines, while the two universities with the  lowest expenditures among the nine have more weaknesses in their  compliance programs. Most of the universities we visited have robust  export compliance practices in the following four areas:

Management commitment and organizational structure: All nine of  the universities we visited have developed policies and practices that  fully or partially align with this element. For example, management at  seven of the nine universities we visited issued public statements  supporting the university’s export compliance program. These  statements briefly described export control regulations, discussed the  importance of the universities’ compliance with export control  regulations, and emphasized the universities’ commitment to  compliance efforts.

Export authorization and tracking export-controlled items: All but  one of the nine universities we visited have developed policies and  practices that fully align with this element. For example, officials at all  nine of the universities we visited stated that their universities require  researchers to submit research proposals to an office charged with  reviewing proposals and awards for grants and contracts. When  reviewing research proposals or awards, this office will flag those  proposals and awards that may be subject to export control  regulations for further review, either by the export control officer or  another authorized university entity. In addition, officials at seven of  the universities said they had developed mechanisms to track any  export-controlled items being used or developed by the university.  The universities we visited also employ various security mechanisms  to safeguard export-controlled items. These include physical security  mechanisms, as shown in figure 3, as well as information technology  security mechanisms, such as setting up separate networks for  researchers using export-controlled data in their research.

Recordkeeping: Officials at all nine universities we visited have  developed policies and practices that fully align with this element to  ensure that they maintain appropriate export control-related records.  For example, at least five of the nine universities we visited maintain  their export compliance-related records in an electronic database or  other electronic system. One of the universities utilizes a system that  tracks each research project from start to finish. This system enables  officials to search for all export control-flagged research proposals,  awards, and technology control plans, among other documents. One  of the officials also told us that the system will alert the export control  officer to any technology control plans with an upcoming expiration  date. Two of the remaining four universities maintained some files  electronically and some in hard copy. The other two universities did  not discuss how they maintained their files, but identified who is  responsible for export control-related recordkeeping and the types of  documents they maintain.

Reporting violations: All nine universities we visited have developed  policies and practices that fully align with this element. Specifically,  these universities have developed clear procedures outlining the  actions employees should take in the event that potential  noncompliance is identified. For example, officials at seven  universities told us that they have a compliance hotline that people  can use to report suspected violations.

Some Universities We Visited Have Gaps in Their Export Compliance Policies and Practices, with Most Gaps Falling into Four Areas

Some of the universities we visited have weaknesses in their export  compliance programs, particularly in the following four areas:

Risk assessment: Four of the nine universities we visited do not  currently conduct risk assessments to assess and identify potential  risks in their export compliance programs, which may limit their ability  to identify potential risks or build safeguards in their export  compliance program to address potential risks. Three of these four  universities are in the lowest tier for annual research and development  expenditures.

Training: Two of the nine universities we visited do not provide any  formal training for researchers and other officials involved in  implementing export control regulations. However, an official from one  of the universities said that the university provides access to online  export control-related trainings developed by a for-profit entity. The  export control officer at the other university said that although the  university does not conduct formal training, he conducts frequent  outreach and provides materials to increase university officials’  awareness of export control regulations.

Internal audits: Four of the nine universities we visited either partially  conducted, or did not conduct, internal audits of their export  compliance programs. The three universities that partially conducted  internal audits have an export control officer who periodically reviews  some internal processes but did not have a university audit group  outside of the export control office that had reviewed the export  compliance program. However, officials from two of these universities  stated that their audit office plans to conduct an audit of the export  compliance program soon.

Export compliance manual: Four of the nine universities we visited  have not developed an export compliance manual. According to  DDTC and BIS guidelines, exporters are encouraged to develop a  manual to document export control-related roles and responsibilities  of various offices and officials. The manuals should also describe  export control procedures, development of technology control plans  for export-controlled work, training requirements, and processes for  reporting potential violations, among other topics.

Research conducted by U.S. universities and supported by visiting foreign  students and scholars makes critical contributions to U.S. national  security and economic interests. However, the relative openness of the  university environment also presents a vulnerability that can be exploited  by foreign adversaries. State’s DDTC and Commerce’s BIS administer  systems of export controls to minimize these vulnerabilities while allowing  legitimate business to occur, and the agencies provide guidance and  conduct outreach to facilitate universities’ compliance with these controls.  While DDTC and BIS provide some guidance and conduct outreach to  universities, university officials told us that this guidance does not  adequately address university-specific issues. The universities we visited  primarily rely instead on guidance and training provided by other entities,  which may not always facilitate compliance with the export control  regulations as DDTC and BIS intended. We found that the nine  universities we visited have generally developed export compliance  policies and practices that align with agency guidance, but some of the  universities’ compliance efforts have gaps. Improved guidance and  outreach based on feedback from university stakeholders could further  strengthen universities’ efforts to identify and protect export-controlled  items from unauthorized transfers or releases to foreign students and  scholars. This is especially important in light of continued reports of  foreign entities’ exploitation of university research.

Moreover, DDTC’s export compliance guidelines do not include  information concerning risk assessments, a key element for determining  whether an entity’s processes address current threats. Four of the nine  universities we visited did not conduct risk assessments. Including  information about risk assessments in DDTC’s written guidelines  regarding the elements of an effective export compliance program would  enable DDTC to remind universities and other exporters that conducting  risk assessments is a beneficial practice. If exporters, including  universities, do not conduct periodic risk assessments, they may be  unaware of new threats and, consequently, may not take appropriate  measures to protect export-controlled items.

Furthermore, universities reported challenges working with DOD because  of DOD officials’ inconsistent interpretation of export control regulations,  including how to assess whether a university is engaging in fundamental  research. DOD officials acknowledged this challenge, but DOD has not  taken sufficient action to educate its personnel on the regulations. Without  additional action, DOD may continue contributing to confusion and  contract delays that hinder legitimate research.

We are making four recommendations, including two to State, one to  Commerce, and one to DOD. Specifically:  The Secretary of State should ensure that the Deputy Assistant Secretary  for Defense Trade Controls, in consultation with university  representatives, provides additional or revises existing guidance and  outreach to address university-specific export control issues to further  support universities’ understanding and compliance with the International  Traffic in Arms Regulations. (Recommendation 1)

The Secretary of Commerce should ensure that the Under Secretary for  Industry and Security, in consultation with university representatives,  provides additional or revises existing guidance and outreach to address  university-specific export control issues to further support universities’  understanding and compliance with the Export Administration  Regulations. (Recommendation 2)

The Secretary of State should ensure that the Deputy Assistant Secretary  for Defense Trade Controls revises existing export compliance guidelines  to include information concerning periodic risk assessments to remind  exporters that it is beneficial to periodically identify, analyze, and respond  to new risks as part of an effective International Traffic in Arms  Regulations compliance program. (Recommendation 3)

The Secretary of Defense should ensure that the Under Secretary of  Defense for Research and Engineering takes steps to ensure that its  program officers and contracting officers are interpreting export controls  consistent with regulations and guidance and consistently determining  whether university research constitutes fundamental research.  (Recommendation 4)

We provided a draft of this report to Commerce, DHS, DOD, FBI, State,  and the White House Office of Science and Technology Policy for  comment. In their comments, reproduced in appendixes V and VI, State  and DOD concurred with the recommendations directed to them. State  also provided information about the actions it plans to take to address  recommendations 1 and 3. With respect to recommendation 1, State  noted that it is already expanding its outreach to university  representatives and planning to issue additional guidance to further  support universities’ understanding of the ITAR. With respect to  recommendation 3, State noted that it plans to revise existing export  compliance guidelines to include information concerning periodic risk  assessments. DOD also provided information about actions it plans to  take to address recommendation 4. Specifically, DOD stated that it will  develop new guidance for DOD personnel to clarify the process for  identifying fundamental research, funding contracts containing  fundamental research, and monitoring those contracts to ensure that they  are performed in compliance with export control regulations and  fundamental research policies. DOD also stated that it plans to work with  State and Commerce to ensure that the new guidance is consistent with  the ITAR and the EAR, respectively. Commerce concurred with  recommendation 2, but it did not provide a comment letter in time for  publication in the report.

DHS, FBI, and the White House Office of Science and Technology Policy  informed us that they had no comments. Commerce, DOD, and State  provided technical comments, which we incorporated as appropriate.

We are sending copies of this report to the appropriate congressional  committees; the Secretaries of Commerce, Defense, and State; the  Acting Secretary of Homeland Security; the Attorney General of the  United States; the White House Office of Science and Technology Policy;  and other interested parties. In addition, the report is available at no  charge on the GAO website at http://www.gao.gov.

If you or your staff have any questions about this report, please contact  me at (202) 512-8612 or gianopoulosk@gao.gov. Contact points for our  Offices of Congressional Relations and Public Affairs may be found on  the last page of this report. GAO staff who made key contributions to this  report are listed in appendix VII.

Appendix I: Objectives, Scope, and Methodology

Our report examines (1) the extent to which the Departments of State  (State) and Commerce (Commerce) have provided guidance and  outreach that supports U.S. universities’ understanding of and compliance  with both agencies’ export control regulations, (2) export control-related  challenges that U.S. universities face while working with or obtaining  guidance from other federal agencies, and (3) the extent to which export  compliance policies and practices developed by U.S. universities align  with State’s and Commerce’s export compliance guidelines.

In addition to the methods discussed below, we reviewed government  reports concerning (1) previously identified gaps in the U.S. export control  system and (2) the threat that some foreign persons pose to U.S.  universities to provide context for all three objectives, and reviewed  relevant federal laws and regulations to address all three objectives. We  also attended a conference in March 2019 hosted by Association of  University Export Control Officers member universities to better  understand how universities administer export control regulations and  those aspects of the regulations most relevant to universities. We used  the information we collected during the conference to inform our planning  for our site visits.

To provide context for all three objectives, we examined federal data  concerning (1) the number of foreign students and scholars studying or  working at U.S. universities, (2) federal agencies’ research and  development funding provided to universities, and (3) U.S. universities’  export license applications.

We examined data identifying the country of citizenship for foreign  students and scholars studying or working at U.S. universities from 2013  through 2018. We received the foreign student data from the Department  of Homeland Security (DHS), which pulled data from its Student and  Exchange Visitor Information System. We used these data to identify the  top 10 countries sending foreign students to U.S. universities in 2018.  DHS also provided data identifying foreign scholars working at U.S.  universities based on I-129 filings. The I-129 form is typically filed by a  U.S. employer on behalf of a nonimmigrant worker to come to the United  States to temporarily perform services or labor or to receive training. We  used these data to identify the top 10 countries sending foreign scholars  to U.S. universities in 2018.

We utilized data collected by the National Science Foundation to  determine the amount of research and development funding U.S.  universities received from federal agencies in fiscal year 2017. The  National Science Foundation collects funding information from federal  agencies through its Survey of Federal Funds for Research and  Development. We downloaded the data from the agency’s website and  analyzed the data to determine how much funding selected federal  agencies and the federal government as a whole provided to universities  and university-administered Federally Funded Research and  Development Centers.

Finally, we analyzed State and Commerce data for export license  applications received in calendar years 2014 through 2018 to identify  trends in U.S. university export license applications and determine the  percentage of export license applications from U.S. universities as a  share of all export license applications. For both data sets, we reviewed  each applicant to verify whether it was a U.S. university, because both  agencies provided some data that included license applications submitted  by entities that are not U.S. universities, such as associations or foreign  universities. We then analyzed the data to determine trends in application  results, identify the top 10 destination countries for approved U.S.  university export license applications, and identify the top five categories  of export-controlled items for export license applications submitted by  U.S. universities.

We determined that all of these data sources were sufficiently reliable for  providing context for our report.

Interviews and Reviews of Relevant Documents

To address our first objective, we interviewed relevant State and  Commerce officials from the Directorate of Defense Trade Controls and  Bureau of Industry and Security and reviewed the guidance and outreach  materials these agencies developed related to export controls. We also  analyzed information regarding their outreach efforts for fiscal year 2019  to identify the number of university-specific outreach events. In addition,  we attended (1) the March 2019 Association of University Export Control  Officers conference, at which both State and Commerce officials  presented to university officials, and (2) Commerce’s annual conference  on export controls in Washington, D.C., at which State officials also  presented.

To address our second objective, we interviewed officials from several  agencies that provide research funding to universities, including the  Departments of Defense (DOD) and Energy, the National Institutes of  Health, and the National Aeronautics and Space Administration, to learn  how they work with universities that receive research funding.  Additionally, we met with a number of security agencies, including DOD’s  Defense Counterintelligence and Security Agency, DHS, and the Federal  Bureau of Investigation, and reviewed reports, handouts, and outreach  materials regarding either export control regulations or the threat  environment to learn how these agencies educate U.S. universities.  Finally, we met with the White House Office of Science and Technology  Policy to discuss an interagency effort to address research security and  other related issues.

To identify university perspectives for all three of our objectives, we  interviewed (1) representatives from four university associations and (2)  officials at nine U.S. universities. Specifically, for our first and second  objectives, we interviewed representatives from the Association of  University Export Control Officers, Association of American Universities,  and Council on Governmental Relations. The Association of University  Export Control Officers is a member organization composed of over 270  export control and other compliance officers at U.S. academic institutions  to provide a forum for the exchange of information regarding higher  education and export, import, and trade sanctions policies. The  Association of American Universities represents 65 research universities  and seeks to shape policy for higher education, science, and innovation.  According to a representative, the association’s membership is composed  of university presidents and chancellors. The Council on Governmental  Relations provides information to over 185 member universities regarding  research administration and compliance, financial oversight, and  intellectual property. The association’s membership is mainly composed  of Vice Presidents for Research and Directors of Sponsored Research,  according to a representative. For our second objective, we also  interviewed a representative from the Academic Security and Counter  Exploitation Program, whose executive committee includes  representatives from 11 universities and university systems. This  university-led association is focused on providing a forum within  academia for discussions concerning the protection of intellectual  property, controlled information, key personnel, and critical technologies  at U.S. universities conducting research relevant to national security. For  all three of our objectives, we interviewed officials at nine U.S.  universities. See below for our selection methodology.

To inform all three of our objectives, we conducted site visits to nine U.S.  universities to speak with various university officials. We selected a non- generalizable sample of nine U.S. universities on the basis of a number of  factors, including total research and development expenditures, number  of graduate students, research funding received from certain federal  agencies, and geographic dispersion.

To identify a sample of U.S. research universities, we first examined U.S.  university research and development expenditures data collected by the  National Science Foundation for the 2013 through 2017 period. The  National Science Foundation collects this data from universities through  its annual Higher Education Research and Development Survey and we  downloaded the data from the agency’s website. We then calculated the  average annual research and development expenditures for each  university on this list for this period. We limited our scope of universities to  those with an annual average total research and development  expenditures of over $15 million. This resulted in a total sample size of  292 U.S. universities. To assess the reliability of the data, we reviewed  related documentation on the National Science Foundation’s web page  regarding the Higher Education Research and Development Survey and  dataset. We determined these data to be sufficiently reliable for the  purposes of our report.

We then reviewed a number of other factors for each of these  universities. First, we categorized each of the 292 universities in our  sample as public or private. We then identified the number of full-time  graduate students for each university on the basis of results from the  National Science Foundation’s annual Survey of Graduate Students and  Postdoctorates in Science and Engineering (2016), because federal  officials told us that graduate students were more likely to conduct  research involving items subject to export control regulations than  undergraduate students. We also reviewed universities’ security  clearance level and membership in a number of associations to identify  those universities that may be more aware of research security-related  issues. Finally, we downloaded data from the Federal Procurement Data  System to identify the total amount of federal contracts for research and  development each university in our sample had received from four main  funding agencies—DOD, the Department of Energy, the National  Institutes of Health, and the National Aeronautics and Space  Administration. These four agencies represent four of the five major  funding agencies for university research and development in fiscal year  2017. In addition, they represent the four agencies that we determined,  in consultation with GAO stakeholders and State and Commerce officials,  are most likely to provide funding for research involving items that may be  subject to export control regulations.

We grouped the universities in our sample into six geographic regions  and initially selected 35 universities across these six regions that  represented a cross-section of universities, on the basis of the factors  discussed above. Ultimately, we selected nine universities for site visits  from four of these regions on the basis of university officials’ availability  and scheduling considerations. While we sought to include a range of  university experiences regarding export control compliance in our non- generalizable sample, the university officials’ views stated in this report do  not represent the entirety of the U.S. academic community.

During our site visits, we conducted semi-structured interviews with about  80 university officials involved in export compliance on the main campus  of nine universities, including officials in the following relevant positions:  vice presidents for research, export compliance officers, facility security  officers, and officials charged with reviewing grants and contracts, among  others. During these interviews, we asked officials about the export  control-related policies and practices their university had developed; their  roles in implementing those practices; their perspectives concerning  guidance and threat-related information from federal agencies; and any  challenges they face in complying with export control regulations, among  other topics. We also conducted seven focus groups with 44 faculty in  Science, Technology, Engineering and Mathematics (STEM) fields.  However, we were not able to meet with all of the same types of officials  at each university we visited.

Assessment of University Export Compliance Policies and Practices against State and Commerce Guidelines

To address our third objective, we assessed university officials’  responses concerning export compliance policies and practices against a  set of eight elements of an effective export compliance program. We  reviewed State’s and Commerce’s guidelines to identify a list of eight  common elements that the agencies classified as critical for an effective  compliance program. We then assessed the responses of university  officials from the nine universities we visited against these eight  elements. Within some of the elements, we identified sub-elements for  assessing university policies and practices. For example, within the  element for management commitment and organizational structure, we  identified five sub-elements against which we reviewed university officials’  responses. For each element, we developed a scale for determining  whether each university’s export compliance policies and practices fully  aligned, partially aligned, or did not align with that element. For example,  for the management commitment and organizational structure element,  we defined the extent to which each university’s policies and practices  aligned with this element as (1) “fully aligned” if policies and practices  were in place for at least four out of five sub-elements, (2) “partially  aligned” if they were in place for two or three out of five sub-elements,  and (3) “not aligned” if they were in place for one or zero of five sub- elements.

We conducted this performance audit from February 2019 to May 2020 in  accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.

Appendix II: Analysis of Export License Application Data for U.S. Universities

Although U.S. universities generally promote an open learning  environment that is focused on the free exchange of information through  fundamental research, some U.S. universities conduct research involving  export-controlled items and have applied for export licenses for deemed  exports (releases within the United States to foreign persons) and exports  of tangible items out of the United States. The Departments of State  (State) and Commerce (Commerce) both control the export of items  within their respective jurisdictions by requiring a license or other  authorization prior to the export of an item. Within State, the Directorate  for Defense Trade Controls (DDTC) is responsible for implementing  export controls. Similarly, within Commerce, the Bureau of Industry and  Security (BIS) is responsible for implementing export controls.

State’s DDTC received 597 license applications from U.S. universities in  calendar years 2014 through 2018. DDTC provides one of four decisions  for each license application—approved, approved with provisos, denied,  or returned without action. DDTC approved roughly 79 percent of license  applications it received from U.S. universities during this period.

Commerce’s BIS reviewed 680 license applications from U.S. universities  during this same time period. BIS provides one of three decisions for  each license application—approved, denied, or returned without action.  BIS approved 74 percent of these license applications.

DDTC and BIS denied a small number of license applications submitted  by U.S. universities in calendar years 2014 through 2018. Specifically,  DDTC denied five applications for exports to Mexico, Sri Lanka, and the  United Kingdom, as well as one application involving various destination  countries. BIS denied eight applications for exports to China, Iran, and  Russia during this same period. See figure 4 for more information  regarding the status of U.S. university export license applications  submitted to DDTC and BIS in calendar years 2014 through 2018.

In calendar years 2014 to 2018, approximately 70 percent of the license  applications submitted by U.S. universities that DDTC approved were for  exports (including tangible exports and deemed exports) to 10 destination  countries or multiple countries. This total included applications that  involved various destination countries, which on their own represented 26  percent of total approved applications during this period (see table 4).

Similarly, 57 percent of the license applications submitted by U.S.  universities that BIS approved in calendar years 2014 through 2018 were  for exports (including tangible exports and deemed exports) to 10  countries (see table 5).

The top five U.S. Munitions List (USML) categories for which U.S.  universities applied for export licenses from DDTC accounted for 77  percent of all applications for calendar years 2014 through 2018. These  include license applications for exports controlled under USML categories  related to spacecraft, night vision, and missiles (see table 6).

The top five categories for which U.S. universities applied for export  licenses from BIS accounted for 85 percent of all license applications for  calendar years 2014 through 2018. These include license applications for  exports specified on the Commerce Control List (CCL) under categories  related to chemicals, aerospace, and sensors and lasers, as well as the  export of items designated as EAR99 (see table 7).

Appendix III: Assessment of University Export Compliance Policies and Practices against Agency Guidelines

The Departments of State (State) and Commerce (Commerce) have each  developed a set of export compliance guidelines (guidelines), which  agency officials identified as key sources of written guidance for  supporting exporters’ compliance with the agency’s export control  regulations. Both sets of guidelines include similar elements that the  agencies have identified as being critical for an effective export  compliance program. We reviewed both agencies’ guidelines and  developed one set of eight elements of an effective export compliance  program, which we then used to assess universities’ export control  compliance practices. The eight sections below include descriptions of  each element.

We selected a non-generalizable sample of nine U.S. universities for site  visits on the basis of a number of factors, including total research and  development expenditures, number of graduate students, research  funding received from certain federal agencies, and geographic  dispersion. To learn more about our methodology for selecting  universities for site visits, see appendix I. We visited these nine  universities to learn about the export control policies and practices that  they had developed.

During our site visits, we conducted semi-structured interviews with about  80 university officials involved in export compliance, including officials in  the following relevant positions: vice presidents for research, export  compliance officers, facility security officers, and officials charged with  reviewing grants and contracts, among others. We also conducted focus  groups with 44 faculty in Science, Technology, Engineering and  Mathematics (STEM) fields at seven of the nine universities we visited.  During our university site visits, we asked officials about the export  control-related policies and practices their universities had developed;  their roles in implementing those practices; and the roles and  responsibilities of others involved in implementing the university’s export  compliance policies and practices, among other topics. We did not  independently verify universities’ implementation of the export compliance  policies and practices that university officials described during our site  visits.

We found that the nine universities we visited had generally developed  export compliance policies and practices to safeguard export-controlled  items that aligned with State and Commerce export compliance  guidelines, but that some of the universities’ compliance efforts had  weaknesses in certain areas (see fig. 5).

In the following sections, we provide a (1) description of each element  and (2) summary of the results of our assessment of each university’s  policies and practices against each element.

Element 1—Management Commitment and Organizational Structure

For this element, we assessed universities’ activities within five sub- elements: (1) public management support for the export compliance  program, (2) management’s understanding of export control regulations,  (3) whether the university had designated an export control officer, (4)  sufficiency of resources and authority to conduct export compliance  activities, and (5) whether the university had created a clear  organizational structure identifying individuals responsible for compliance.  See figure 6 for the results of our assessment.

Management commitment and  organizational structure  Entities should have public management  support for their compliance program,  sufficient resources to conduct compliance  activities, and a clear organizational structure  identifying individuals responsible for  compliance.

All nine of the universities we visited have developed policies and  practices that fully or partially align with this element concerning  management commitment and organizational structure. Specifically,  seven universities had practices that fully aligned and two had practices  that partially aligned with this element. Below, we provide additional detail  on universities’ activities within the following five sub-elements:

Provides public management support for export compliance  program. Seven of the nine universities we visited have issued public  statements from university management supporting the export  compliance program. These statements briefly describe export control  regulations, discuss the importance of the universities’ compliance  with export control regulations, and emphasize university  management’s commitment to compliance efforts. In addition,  university researchers who participated in our focus groups said that  their universities had created an environment in which they felt  comfortable reaching out to university staff with compliance-related  questions. For example, participants in one of the focus groups told us  that compliance officials are not trying to find violations, but are  instead focused on building stronger compliance programs and  stronger relationships with faculty.

Understands export control regulations. Export control officers at  all nine of the universities we visited said that university management  understands and is knowledgeable about export control regulations  and the implications of these regulations on the university’s research  and development activities. For example, one export control officer  stated that increasing awareness among the administrators, faculty,  and staff has taken time, but that the administration now has a good  knowledge of export control requirements following the outreach and  training that the export control office provided over the last few years.

Designates an export control officer position. Eight of the nine  universities we visited have export control officers, and of those eight,  five have had an export control officer position for over 10 years. The  only university we visited that did not have an export control officer  position had such a position prior to our visit. Among the universities  we visited, this university had the lowest average research and  development expenditures from 2013 through 2017—less than $30  million.

Provides sufficient resources and authority to conduct export  compliance activities. Officials at eight of the nine universities we  visited stated that their university had sufficient resources and that  relevant officials had adequate authority to conduct export compliance  activities. Officials at one university said that they did not have  adequate authority to conduct compliance activities, but that this  condition might be changing because the export control officers now  report directly to the Vice President of Research, which is giving them  greater access to university management.

Creates a clear organizational structure for export compliance.

Officials at seven of the nine universities we visited identified  individuals who are involved in export control compliance, including  researchers and officials working in procurement, shipping, and  contracting, among other things. Five of these seven universities also  have export compliance manuals that specifically describe various  officials’ export compliance roles and responsibilities.

For this element, we assessed the extent to which the university  conducted risk assessments of its export compliance program. See figure  7 for the results of our assessment.

University Policies and Practices Related to Element 2—Risk Assessment

Five of the nine universities we visited have developed policies and  practices that fully align with this element concerning risk assessments,  while the other four have not developed such policies and practices.  Below, we provide additional detail on universities’ risk assessment  activities.

Of the five universities that told us they conduct risk assessments, three  stated that the export control officers periodically or annually conduct  internal risk assessments of their export compliance efforts, while the  other two described university groups that conduct periodic or annual,  university-wide risk assessments that include an assessment of the  export compliance program. For example, one university’s export control  officer said that her office periodically reviews the university’s export  compliance policies and practices to determine whether any gaps exist  within the program. She also recently started reviewing her university’s  export compliance policies and practices against those of other  universities to determine whether other universities had developed any  export compliance practices that would be appropriate for her university  to emulate. She found, for example, that other universities had  implemented a centralized loaner laptop program for researchers  traveling abroad to minimize the risk of the theft of sensitive data from  personal laptops, and said she hopes to implement such a program at her  university. Officials at a university that periodically conducts university- wide risk assessments said they had conducted two such risk  assessments since 2015 and were conducting a third assessment during  our visit. During one assessment, reviewers recommended that the  university increase export control training and staffing, which the export  control office is working to address. Another university that conducts  annual risk assessments has a research oversight committee that is  made up of many subcommittees, including one for export controls. Each  subcommittee conducts an annual risk assessment for its compliance  area and reports any recommendations for optimizing compliance  program effectiveness to the vice president for research.

Element 3—Export Authorization and Tracking Export-Controlled Items

For this element, we assessed universities’ activities within seven sub- elements: whether the university (1) had processes in place to identify  research involving export-controlled items, (2) had processes in place to  monitor research to determine whether a license might be required at a  later time, (3) tracked any export-controlled items being used or  developed, (4) had developed any policies or practices for safeguarding  export-controlled items, (5) used technology control plans to document  and safeguard export-controlled items, (6) screened and monitored  foreign visitors, and (7) screened all foreign parties associated with  research projects prior to any export activities. See figure 8 for the results  of our assessment.

Export authorization and tracking export- controlled items  Entities should develop processes to (1)  ensure the organization makes correct export  decisions, including identifying when U.S.  government authorization is required prior to  exporting; (2) track and protect any export- controlled items being used or developed by  the organization; and (3) screen all parties  associated with an export transaction against  the U.S. proscribed/restricted parties lists prior  to exporting.

All but one of the nine universities we visited have developed policies and  practices that fully align with this element concerning export authorization  and tracking export-controlled items. Below, we provide additional detail  on universities’ activities within the seven sub-elements, which fall under  three process categories: making export decisions, tracking and  safeguarding export-controlled items, and screening foreign parties.

Under this category, we assessed universities’ activities in the following  two areas:  Identifies research involving export-controlled items: Officials at  all nine of the universities we visited stated that they had, to varying  degrees, developed policies and practices for identifying research  projects that might involve items that are subject to export control  regulations.

Policies and practices for identifying research involving  export-controlled items. All nine of the universities we visited  require the lead researcher on a project to submit research  proposals to an office charged with reviewing proposals and  awards for grants and contracts, which we refer to as the Office of  Grants and Contracts. The office also reviews the terms and  conditions for awards—contracts, grants, or cooperative  agreements—to ensure there is nothing in the paperwork that  necessitates additional negotiation or that raises a concern related  to export controls. When reviewing research proposals or awards,  the Office of Grants and Contracts will flag those proposals and  awards that may involve items subject to export control  regulations for further review, either by the export control officer or  another authorized university entity.

Tools developed to support officials’ identification of  research involving export-controlled items. The universities we  visited have developed a variety of tools to support officials’ export  control reviews of proposals and awards. For example, seven of  the nine universities we visited require the lead researcher on a  project to complete a questionnaire that includes export control- related questions when submitting research proposals for review.  This questionnaire identifies research proposals that may be  subject to export control regulations earlier in the process. In  addition, at least four of the universities’ export control officers  have developed flowcharts or checklists to help the Office of  Grants and Contracts understand when to flag research proposals  or awards for further review by the export control officer. In  addition, seven of the nine universities we visited require that  researchers obtain university approval to conduct research  involving export-controlled items. For example, one university’s  export control officer said that flagged proposals are sent to an  export control review committee for review and approval. The  committee reviews the risk associated with each of these research  projects and determines whether the university is willing to accept  the export control-related risks for that project. Another university  requires the lead researcher to obtain approval from the  university’s board before accepting an award for research  involving export-controlled items.

Monitors research to determine whether a license is required  after the project starts. Officials at five of the nine universities  described practices they had developed to monitor research projects  in order to determine whether an export license is required after a  research project is underway. For example, one university’s export  control officer said her department monitors all research teams that  intend to develop hardware or technology during their research  because the resulting hardware or technology could be subject to  export control regulations. These projects are flagged in the electronic  system used to track research projects and the export control officer  checks in with the lead researcher periodically to determine the status  of the research. An official at another university explained that the  university conducts periodic audits of timecards to see if any foreign  persons have started charging time to ongoing projects involving  export-controlled items. In contrast, one official at another university  stated that the university relies on the lead researcher to alert the  compliance office of any changes to the research team or research  objectives, which may then require a license before continuing  research. This official suggested that the lead researchers are better  positioned than the export control officer to identify changes to the  research that might necessitate obtaining an export license.

Tracking and Safeguarding Export-Controlled Items  Seven of the nine universities we visited used a variety of mechanisms to  track and safeguard export-controlled items, including manual locks,  electronic access systems, and other physical security systems, as well  as separate computer networks to protect data subject to export control  regulations. Under this category, we assessed universities’ activities in  the following three areas:

Tracks export-controlled items used at the university. Officials at  seven of the nine universities we visited said they had developed  mechanisms to track any export-controlled items being used or  developed by the university. These mechanisms range from  maintaining paper files to using electronic systems to track such  information. For example, some of the universities maintain physical  copies of documents they use to identify and track export-controlled  items on campus. Other universities have developed electronic  databases to track this information. One university maintains all  records related to research projects in one electronic system,  including technology control plans. Electronic databases and systems  allow the export control officer to quickly identify the on-campus  location of export-controlled items and who is working with these  items.

Safeguards export-controlled items. Eight of the nine universities  we visited employ various security mechanisms to protect export- controlled items, including physical and information technology  security mechanisms. For example, officials at seven of the nine  universities we visited said their university protects export-controlled  items by limiting access to spaces where these items are housed with  locks or access cards, depending on the space. Three of these  universities also require researchers to store export-controlled items  in a locked box or storage space, in a locked room, when it is not in  use. Some universities also use signs to indicate which spaces are  restricted; however, officials at one university said that they do not use  signage to indicate restricted spaces because it would draw more  attention to the space. Some university officials also described  information technology security mechanisms in place to protect data  that may be subject to export control regulations. For example,  officials at two universities noted the use of isolated or separate  networks for researchers working with such data to limit access to this  data.

Uses technology control plans to document and safeguard  export-controlled items. Officials at all nine of the universities we  visited stated that researchers used export-controlled items on  campus, and officials at eight of these universities said that their  universities had developed and implemented technology control plans  to safeguard such items. According to Commerce’s export compliance  guidelines, organizations that possess or work with export-controlled  items and either employ foreign persons or have frequent meetings  with foreign persons should create a technology control plan. These  plans should include a physical security plan, an information security  plan, and training programs, among other components. According to  the university officials we interviewed, the export control officer  typically works with the lead researcher to develop the technology  control plan. Six of the nine universities we visited require the lead  researchers to sign the technology control plan to acknowledge that  they understand their responsibilities for protecting the export- controlled items identified in the plan, and at least four of these  universities require all the members of the research team to sign it as  well. In addition, some of the universities we visited conduct annual  audits of the technology control plans to ensure proper  implementation. For example, an official at one of these universities  explained that the university’s annual audit of the technology control  plans verifies that security practices outlined in the plan are being  followed by the research team and that only those researchers who  signed the technology control plan have access to the export- controlled items. An official at another university said he reviews the  human resources account information for projects involving export- controlled items annually to verify that only those individuals who have  signed the technology control plan are working on those projects.

Under this category, we assessed universities’ activities in the following  two areas:

Screens and monitors foreign visitors. All but one of the nine  universities we visited screen and monitor foreign visitors to some  extent. Specifically, four of these universities conduct restricted party  screenings on all foreign visitors prior to their visit to verify that  potential visitors are not on any U.S. government list of restricted or  proscribed parties. The other four universities conduct restricted  party screenings on some foreign visitors. Three of these four  universities said that they do not have a formal process for reviewing  foreign visitors and that the effort to invite and review visitors is  decentralized. Some of the universities we visited also described how  they monitor foreign visitors on campus. For example, officials at two  universities said that the foreign visitors’ sponsor is responsible for  monitoring their access. The export control officer at a third university  told us that he briefs foreign persons visiting restricted spaces on the  rules of their visit, including restrictions on camera usage.

Screens foreign parties associated with research projects. All  nine of the universities we visited use restricted party screening  software, which searches several lists that U.S. agencies continually  update to screen for restricted or denied parties. Universities and  other exporters may be prohibited or restricted from doing business  with any individuals or entities identified on one of these lists. Eight of  the nine universities we visited screen all foreign individuals and  entities associated with a research project using such software.  Entities associated with a research project may include foreign  researchers on the research team, foreign sponsors, or foreign  collaborators, among others. Officials at the ninth university stated  that they conduct ad hoc screening for research collaborations with  foreign entities. Additionally, one of the universities has compiled a list  of all the foreign entities the university works with and conducts  weekly restricted party screenings of the foreign entities on this list.  Although we focused our assessment on universities’ export  compliance policies and practices in place to limit unauthorized  deemed exports to foreign persons, officials at some of the  universities we visited discussed their efforts to conduct restricted  party screenings for other process areas, such as shipping,  procurement, and gifts. We found that individuals or offices  responsible for these processes at some universities manually  screened entities. In one case, this was because the other offices did  not have access to the restricted party screening software that the  export control officer used.

For this element, we assessed the extent to which the university had  developed processes for maintaining relevant export control-related  records. See figure 9 for the results of our assessment.

University Policies and Practices Related to Element 4—Recordkeeping

All nine of the universities we visited have developed policies and  practices that fully align with this element concerning recordkeeping.  Below, we provide additional detail on universities’ recordkeeping  activities.

At least five of the nine universities we visited maintain their export  compliance-related records in an electronic database or other electronic  system. For example, one university’s system tracks each research  project from start to finish and enables officials to search for all export  control-flagged research proposals and awards, technology control plans,  and other documents. One of the officials also told us that the system will  alert the export control officer to any technology control plans with an  upcoming expiration date. Officials at another university explained that  their system also enables them to track all the approved technology  control plans to quickly identify who is working under a technology control  plan on campus at any point in time.

Five of the nine universities we visited have written export compliance  program manuals, and all of those universities’ manuals include  information concerning recordkeeping requirements. For example, four of  the five manuals specifically note that export control-related files must be  maintained for at least 5 years, and four identify the types of records that  need to be maintained, including export reviews, contracts, licenses,  technology control plans, and shipping documents, among others.

For this element, we assessed universities’ activities within two sub- elements: whether the university (1) provided export control-related  training to all employees involved in exports and (2) required any  individuals to complete mandatory export control-related training. See  figure 10 for the results of our assessment.

University Policies and Practices Related to Element 5—Training

Seven of the nine universities we visited have developed policies and  practices that fully align with this element concerning training, while the  other two have not. Below, we provide additional detail on universities’  activities within the following two sub-elements:

Provides export control-related training to all employees  involved in exports. Seven of the nine universities we visited stated  that they provide export control-related trainings to researchers and  other officials involved in the implementation of export control  regulations. The export control-related training available to various  university officials at the universities we visited varies depending on  officials’ level of interaction with export controls. For example, at least  five of the universities’ export control officers we interviewed provide  export control-related training tailored to the needs of staff whom the  university relies on to identify requests for export-controlled items or  research involving export-controlled items, including the procurement  office and the Office of Grants and Contracts. One export control  officer stated that he provides annual training to officials in the Office  of Grants and Contracts and provides biannual training to officials in  the procurement office. He noted that he spends the most time  training officials responsible for reviewing grants and contracts  because they are the “gate keepers” for all research proposals and  research funding coming into the university. The two universities that  do not provide export control-related training to all employees involved  in exports do make some export control-related information available.  An official from one of the universities said that the university provides  access to online export control-related trainings developed by a for- profit entity. The export control officer at the other university said that  although the university does not conduct formal training, he conducts  frequent outreach and provides materials to increase university  officials’ awareness of export control regulations.

Conducts mandatory training for researchers conducting  research involving export-controlled items. Seven of the nine  universities we visited require researchers conducting research  involving export-controlled items to complete training with the export  control officer prior to beginning their project. Furthermore,  researchers at four of these universities are required to complete  additional periodic training to refresh their understanding of their  compliance roles and responsibilities every 1 to 3 years. Most of the  universities that conduct required export control training have varying  systems in place to document attendance. For example, three of the  nine universities we visited require attendees to sign a form certifying  that they have completed the technology control plan training and  understand their responsibilities.

For this element, we assessed the extent to which the university  conducted periodic audits of its export control compliance program to  assess its effectiveness and integrity. See figure 11 for the results of our  assessment.

University Policies and Practices Related to Element 6—Internal Audits

Eight of the nine universities we visited have developed policies and  practices that fully or partially align with this element concerning internal  audits, while one of the universities’ policies and practices did not align  with this element. Below, we provide additional detail on universities’  efforts to conduct periodic audits of their export control compliance  programs to assess their effectiveness and integrity.

Eight of the nine universities we visited conduct some type of internal  audit to assess the export compliance program’s effectiveness. For  example, five export control officers at these universities review all  technology control plans annually. One official said her office conducts  these annual reviews to ensure that researchers are properly  implementing the technology control plans and to determine if the plans  need to be updated to address any changes to the export control  regulations.

In addition, seven of the nine universities we visited have an internal audit  group, and four of these audit groups had conducted an audit of the  export compliance program within recent years. One university official  explained that the audit group’s periodic review of the export compliance  program once found that the project management system did not provide  enough transparency, and on the basis of this finding, the export control  officer was able to petition the university for additional funding to further  improve the system in place to track all research projects. According to an  official at another university, a quality assurance official at his university  audits a sample of research awards each month. Every few months, this  official identifies a mistake, such as a failure to screen a foreign party  against the lists of restricted parties. When a mistake is identified, the  export control officer then screens the foreign party and counsels the  person who missed this step. These audits provide universities with an  opportunity to identify any potential gaps and continually improve their  programs.

Element 7—Reporting and Addressing Violations

For this element, we assessed the extent to which the university had  developed clear procedures outlining the actions employees should take  in the event that potential noncompliance is identified. See figure 12 for  the results of our assessment.

University Policies and Practices Related to Element 7—Reporting and Addressing Violations

All nine of the universities we visited have developed policies and  practices that fully align with this element concerning the reporting of  violations. For example, officials at seven universities told us that they  have a compliance hotline that people can use to report suspected  violations. Two of these seven universities described additional actions  they have taken to further educate their university community about the  need to report potential export control violations by adding such  information to flyers for the university compliance hotline and advertising  this information online. Officials at three of the universities also discussed  escalation procedures they have in place to investigate a potential export  control violation. For example, one export control officer explained that he  is responsible for investigating and reporting any violations. If he needs to  initiate an investigation, he will select a team of university officials to  enquire about the violation and determine whether a violation has  occurred. Following the investigation, the Vice President for Research is  responsible for determining whether the university needs to self-disclose  a violation to the relevant federal regulatory agency.

Five of the nine universities we visited had written export compliance  program manuals, and all of those universities’ manuals included  information concerning export control violations. For example, some of  the manuals include a discussion about the legal and criminal penalties  associated with export control violations and emphasize the importance of  reporting any potential violations. In addition, two of the universities’  manuals describe the need to develop corrective action plans to prevent  recurrence of any violations arising from systemic institutional practices or  procedures.

Three of the nine universities we visited had voluntarily disclosed export  control violations. For example, one university disclosed information  regarding a foreign person’s unauthorized access to ITAR-controlled  technology because the lead researcher on the project and the  procurement office did not know the technology was controlled. According  to the export control officer at this university, her office is working with the  procurement office to ensure that the future procurement of controlled  technologies is flagged for review by the export control officer prior to  ordering. This updated procedure will enable the export control officer to  work with the lead researcher to develop a technology control plan if the  university agrees to support the procurement of such a technology.

For this element, we assessed the extent to which each university  documented export control compliance processes, roles and  responsibilities, and other relevant information in a manual to help the  university implement its compliance program. See figure 13 for the results  of our assessment.

University Policies and Practices Related to Element 8—Export Compliance Manual

Five of the nine universities we visited have developed export compliance  manuals, consistent with this element, while the other four have not.  These manuals describe the export control-related roles and  responsibilities of various offices and officials on campus, including the  export control officer and university researchers, among others. In  general, the manuals also describe a number of export control  compliance procedures, including the initial review of research proposals,  development of technology control plans for research involving export- controlled items, training requirements, and processes for investigating  potential violations, among others. Four of the five universities developed  manuals in 2015 or earlier, and one university developed a manual in  2018. Three of the universities that published manuals in or before 2015  have updated their manuals at least once, but one of these universities  has not updated its manual since 2013.

Appendix IV: Analysis of Export Compliance- Related Information on U.S. Universities’ Websites

We reviewed the public websites of a statistically generalizable sample of  100 U.S. universities expending more than $15 million for research and  development annually, on average, to determine the extent to which  universities publicly share export control-related information with their  campus community. Using research expenditure data collected by the  National Science Foundation for 2013 through 2017, we identified 292  public and private U.S. universities that expended more than $15 million  on research and development, on average, over a 5-year period. We  selected a stratified, random sample of 100 universities from this list to  provide representation from a diverse set of universities in our sample.  Next, we created a top and bottom stratum based on total research and  development expenditures. The top stratum included universities with  expenditures above $250 million (85 universities) and the bottom stratum  included universities with expenditures between $15 million and $250  million (207 universities). The sample included 55 universities from the  bottom stratum and 45 from the top stratum. Of the 55 universities from  the bottom stratum, 30 are public and 25 are private. Of the 45  universities from the top stratum, 25 are public and 20 are private.

We assessed the information on the selected universities’ websites  against six of the eight elements of an effective export compliance  program:  1.  Management commitment and organizational structure  2.  Export authorization and tracking export-controlled items  5.  Reporting and addressing violations  6.  Export compliance manual  We did not review information related to risk assessments or internal  audits on the selected universities’ websites because we did not expect  universities to publicly publish this type of information.

Management Commitment and Organizational Structure

Of the 100 universities in our sample, 77 maintained a dedicated web  page for export control-related information, and 79 provided contact  information for the person or office responsible for complying with export  control regulations on their website. However, only about half of the  universities’ websites identified an export control officer or similar official,  and only 24 included a public statement from university management  supporting the export compliance programs. See table 8 for additional  results from our website analysis.

Management commitment and  organizational structure  Entities should have public management  support for their compliance program,  sufficient resources to conduct compliance  activities, and a clear organizational structure  identifying individuals responsible for  compliance. related information?

Export Control  Officer or similar  title identified?

Export control roles  and responsibilities of  researchers  described?

Export Authorization and Tracking Export-Controlled Items

Export authorization and tracking export- controlled items  Entities should develop processes to (1)  ensure the organization makes correct export  decisions, including identifying when U.S.  government authorization is required prior to  exporting; (2) track and protect any export- controlled items being used or developed by  the organization; and (3) screen all parties  associated with an export transaction against  the U.S. proscribed/restricted parties lists prior  to exporting.

A majority of the 100 universities’ websites included information about  relevant export regulations and a definition of exports, and almost half  provided additional resources or tools for researchers to better  understand how or whether their research involves items subject to export  control regulations; however, a limited number provided information about  practices the university may employ to protect export-controlled items.  For example, 74 of the 100 universities published information about the  International Traffic in Arms Regulations (ITAR) and the Export  Administration Regulations (EAR) on their websites. About half of the  universities also maintained a frequently asked questions section  concerning export control regulations and about half provided tools such  as decision tree matrices to help researchers determine whether an  export may require a license. However, less than a third of the  universities’ websites included any information about technology control  plans or guidance regarding foreign visitors, which are practices that  universities may undertake to protect export-controlled items used in  university research or other academic activities. For example, only 27 of  the 100 universities’ websites contained explanations of when a  technology control plan would be necessary. See table 9 for additional  results from our website analysis.

Twenty of the 100 universities’ websites provided information regarding  export compliance recordkeeping requirements. See table 10 for these  results.

About half of the universities’ websites provided information about export  control trainings available online, developed by the university,  associations, or for-profit organizations, among others. However, only 21  of the 100 universities’ websites provided information about how to  request university-provided, in-person training regarding export  compliance. See table 11 for additional results from our website analysis.

Only about a quarter of the universities’ websites provided guidance  about when to report potential violations, but about half of the universities’  websites provided information about the potential administrative or  criminal penalties associated with export control violations. See table 12  for additional results from our website analysis.

Reporting and addressing violations  Entities should develop clear procedures  outlining the actions employees should take in  the event that potential noncompliance is  identified. Entities should also develop  processes for identifying and addressing the  root cause of any noncompliant activity.

Guidance on when to report  a potential export control  violation?

Less than half of the universities in our sample published an export  compliance manual on their website. See table 13 for these results.

Appendix V: Comments from the Department of State

Appendix VI: Comments from the Department of Defense

Appendix VII: GAO Contact and Staff Acknowledgments

Kimberly Gianopoulos, (202) 512-8612 or gianopoulosk@gao.gov.

In addition to the contact named above, Juan Gobel (Assistant Director),  Drew Lindsey (Assistant Director), Amanda Bartine (Analyst-in-Charge),  Taylor Bright, Debbie Chung, Neil Doherty, Tina Huang, Kathryn Long,  Sulayman Njie, and Jina Yu made key contributions to this report. Ashley  Alley and Justin Fisher provided technical assistance.

Over 1.2 million foreign students studied—with many contributing to important research—at U.S. universities in 2018. But there is a risk they may “export” sensitive knowledge that they gain to their home countries.

The Departments of State and Commerce share guidance with exporters, including universities, to help them comply with export control regulations and safeguard controlled data and technologies that may be shipped overseas or shared with foreign nationals in the U.S. However, we found that this guidance doesn’t address issues most relevant to universities.

Our 4 recommendations include improving guidance and outreach to universities.