US needs to get better at preventing foreign access to advanced technology

GAO watchdogs find holes in high-tech access, licensing rules

When it comes to protecting the US family jewels - high-tech data on everything from aeronautics, information systems and electronics to lasers and unmanned aerial vehicles --  parts of the government tasked with protecting those assets need to do a way better job.

That was the chief conclusion of a report called " Improvements Needed to Prevent Unauthorized Technology Releases to Foreign Nationals in the United States," out this week from the watchdogs at the Government Accountability Office.  The Department of Commerce shoulders much, though not all of the blame in the GAO report. But the GAO says the department has not implemented GAO's recommendations to the export enforcement system involving monitoring license compliance and using immigration data for deemed export enforcement.

For more on security: 20 hot IT security issues

"Commerce has not created a program to monitor security conditions in licenses or used existing immigration data to enforce deemed export regulations. The Commerce department, the Immigration and Customs Enforcement agency and the Federal Bureau of Investigation have also not implemented recommendations to improve coordination on export control investigations, including those of foreign nationals subject to deemed export controls," the GAO stated. So called deemed licenses must be approved by the Department of Commerce before companies can transfer specific technologies to foreign nationals in the US.

The GAO report found a number of key issues threatening access to controlled US high tech, including:   

  • Foreign businessmen, scientists, engineers, and academics from countries of concern have gained unauthorized access to controlled dual-use technologies in the United States, according to intelligence and law enforcement sources.
  • From fiscal years 2004 to 2009, the US Commerce Department fined 14 US companies about $2.3 million for making unauthorized transfers of controlled technologies to foreign nationals from 25 countries. Commerce also suspended the export privileges of one company and two individuals for 20 years each. The majority of the enforcement actions involved foreign nationals from three countries.
  • Commerce Dept. officials stated that they screened 150 visa applications from US posts overseas in fiscal year 2009 to identify potential unlicensed deemed exports-fewer than the 54,000 visa applications screened in fiscal year 2001-because of a change in procedures that is more reactive, focusing on leads and intelligence information, rather than proactive screening.
  • While the US Citizenship and Immigration Service approved a large number of foreign nationals for specialty occupation visas from 2004 to 2009, Commerce issued deemed export licenses authorizing the transfer of technology to a smaller number of foreign nationals during the same period. The US government addressed shortages of US-born engineers and scientists by approving specialty occupation visas in occupational fields including engineering, computers, electronics, and the biological sciences to approximately 1.05 million foreign nationals from what GAO calls "13 countries of concern," that the agency only identifies in a classified report.
  • From fiscal years 2004 to 2009, Commerce issued deemed export licenses authorizing the release of technology to 3,178 foreign nationals from the same 13 countries. However, not all foreign nationals with H-1B specialty occupation visas are required to apply for deemed export licenses, the GAO stated. According to intelligence reports and law enforcement sources, as well as congressional testimony and law enforcement officials, a small group of countries is responsible for most of the efforts to acquire controlled technologies for military purposes.
  • The Commerce dept. has not implemented recommendations that the GAO and others made involving monitoring compliance with deemed export licensing conditions and using immigration data to improve deemed export enforcement.
  • The Commerce dept. continues to lack a compliance program to monitor security conditions on deemed export licenses, even though the GAO 2002 and the Commerce IG's 2004 reports recommended that it establish one. A compliance program should involve on-site inspections of facilities to determine whether the license holder is complying with specific license conditions. In particular, all potential points of access to the controlled technology should be reviewed for appropriate safeguards, and a technology control plan to prevent foreign nationals from accessing controlled technologies should be implemented to ensure compliance with license conditions, according to the Commerce IG. The security conditions are imposed to help prevent foreign nationals from obtaining unlicensed access to controlled technologies and are attached to almost all of the deemed export licenses approved. In fiscal year 2006, Commerce established a program to monitor licensing conditions, but discontinued it after fiscal year 2007, citing competing priorities and budget constraints.
  • Commerce does not use all existing Department of Homeland Security immigration data to detect firms that should have applied for deemed export licenses. In 2002, we recommended that Commerce use all existing immigration data, including data from change-of-status applications, to identify foreign nationals who could be subject to deemed export licensing regulations. In response to our recommendation, Commerce and DHS have begun discussing how to share these data, but have not finalized arrangements. DHS announced proposed changes to its primary immigration form in February 2010 that would make it easier for Commerce, ICE, and FBI to use immigration data for deemed export enforcement.

For its part the Commerce dept. said it would review specialty occupation visas covered by deemed export license applications.  The department also stated that it would review prior GAO and Inspectors General recommendations as part of the ongoing Export Control Reform process.

The FBI in written comments, stated it has "conducted deemed export outreach to small-to-midsize biotechnology companies through several venues, including strategic task forces, counterintelligence working groups, conferences, and other initiatives, in coordination with the US intelligence community and federal law enforcement agencies, including ICE and Commerce.  The FBI also stated that through participation in the NEECN [National Export Enforcement Coordination Network] and other arenas, FBI, ICE, and Commerce have worked to resolve coordination of export enforcement activities."

Follow Michael Cooney on Twitter: nwwlayer8  

Layer 8 Extra

Check out these other hot stories:

Scientists set NASA space priorities; can it carry them out?

NASA finds no grandeur in Glory satellite failure

Air Force set for second super-secret spacecraft blast-off

Sunspots? We don't need no stinking sunspots

AT&T loses corporate privacy case, war of "words"

Chip promises 50% cut in mobile power consumption

NASA recruiting sponsors for new high-tech competitions

FBI activates electronic posse to go after serial rapist

US House crimps consumer safety database money

FBI: Internet crime high but types of misdeeds changing

Is IT skills gap keeping companies from hiring?

Former Avaya chief D'Ambrosio takes reigns at Sears

Want your own, sort of, personal submarine?

NASA wants spacecraft designed for Mars return trip

NASA satellite primed for first ever Mercury orbit

The weirdest, wackiest and stupidest sci/tech stories of 2010

Join the Network World communities on Facebook and LinkedIn to comment on topics that are top of mind.

Copyright © 2011 IDG Communications, Inc.