Export Controls: Enforcement Agencies Should Better Leverage Information to Target Efforts Involving U.S. Universities
Fast Facts
Millions of foreign students and scholars study at U.S. universities, and many contribute to U.S. research. But, there's a risk that some may illegally access and share sensitive information, such as data or technology, with their home countries.
Agencies involved in addressing this threat said that outreach and education increases university officials' awareness of research security threats and builds stronger relationships with university officials.
To help prevent illegal transfers, we recommended that agencies determine which universities are at greater risk for such transfers and target outreach and education to them.
Highlights
What GAO Found
According to U.S. government agencies, foreign entities are targeting sensitive research conducted by U.S. universities and other institutions. Releases or other transfers of certain sensitive information to foreign persons in the United States are subject to U.S. export control regulations. Such releases or transfers, which are considered to be exports, are commonly referred to as deemed exports. A U.S. Assistant Secretary of State wrote in 2020 that greater attention needed to be paid to deemed exports. He noted that these transfers, including the “know how” of cutting-edge science and its applications, are what China's military–civil fusion strategy seeks in its attempts to mine and exploit U.S. academia's open knowledge system.
Hypothetical Examples of Deemed Exports Subject to Export Control Regulations
Agencies involved in enforcing export control regulations—the Departments of Commerce and Homeland Security (DHS) and the Federal Bureau of Investigation (FBI)—conduct outreach to universities to strengthen efforts to prevent sensitive technology transfers, including unauthorized deemed exports. According to officials, outreach increases awareness of threats to research security and builds stronger two-way relationships with university officials. The agencies identified this outreach as a key enforcement mechanism.
However, additional information about universities' risks could enhance the agencies' outreach efforts. For example, Commerce does not base its outreach on analysis of universities' risk levels and has not identified any risk factors to guide its outreach priorities. DHS has ranked roughly 150 U.S. universities for outreach, and FBI provides information to all of its field offices to guide their outreach priorities; however, both agencies base these efforts on only one risk factor. Identifying and analyzing any additional relevant risk factors could provide a more complete understanding of universities' risk levels and could further inform Commerce's, DHS's, and FBI's efforts to target limited resources for outreach to at-risk universities.
Why GAO Did This Study
Over 2 million foreign students and scholars studied at U.S. universities in 2019, in many cases contributing to U.S. research. The U.S. government implements export controls to, among other things, mitigate the risk of foreign students' and scholars' obtaining controlled and sensitive information that could benefit foreign adversaries.
GAO was asked to review agencies' efforts to address risks associated with foreign students and scholars who may seek to evade export control regulations. This report examines the extent to which agencies are assessing universities' risk of unauthorized deemed exports to prioritize outreach.
GAO reviewed related laws and regulations; analyzed agency data; and interviewed agency officials in Washington, D.C., and 15 U.S. field offices. GAO based its selection of these offices on their proximity to research universities, their geographic dispersion, and other agencies' field office locations.
This is a public version of a sensitive report issued in March 2022 that included additional information on (1) challenges agencies face in efforts to enforce export control regulations, particularly for deemed exports at universities, and (2) the extent to which agencies coordinate their efforts and share information. Information that agencies deemed sensitive has been removed.
Recommendations
GAO is making eight recommendations to strengthen Commerce's, DHS's, and FBI's ability to prioritize outreach to at-risk universities. All three agencies concurred with the recommendations.
Recommendations for Executive Action
| Agency Affected | Recommendation | Status |
|---|---|---|
| Department of Commerce | The Secretary of Commerce should ensure that the Under Secretary for Industry and Security identifies relevant risk factors and analyzes this information to identify universities at greater risk for sensitive technology transfers, including unauthorized deemed exports. (Recommendation 1) |
The Department of Commerce concurred with the recommendation. In June 2022, Commerce's Assistant Secretary for Export Enforcement released a policy memorandum that established a new Academic Outreach Initiative. The memorandum also identified three risk factors that Commerce will consider when identifying priority universities for outreach. According to Commerce, it identified these risk factors through consultations with other agencies, including the Department of Defense and intelligence agencies, as well as open source and classified reporting, investigative cases, and interagency working groups. Through this effort, Commerce identified a list of 20 initial prioritized universities for outreach and assigned an Outreach Agent for each of these universities. According to the policy memorandum, Outreach Agents will work to establish long-term partnerships with the prioritized universities to help those universities prevent unauthorized exports. Commerce further stated in October 2022 that it continues to identify additional risk factors and considers this effort an iterative and on-going process. The identification and analysis of relevant risk factors helped inform Commerce's efforts to target limited resources for outreach to at-risk universities.
|
| Department of Commerce | The Secretary of Commerce should ensure that the Under Secretary for Industry and Security shares the results of any analyses aimed at identifying U.S. universities at greater risk for sensitive technology transfers, including unauthorized deemed exports, with EE field offices. (Recommendation 2) |
The Department of Commerce concurred with the recommendation. In June 2022, Commerce's Assistant Secretary for Export Enforcement released a policy memorandum that established a new Academic Outreach Initiative and it identified three risk factors that Commerce will consider when identifying priority universities for outreach. After analyzing these risk factors, Commerce identified a list of 20 initial prioritized universities for outreach. Commerce headquarters officials provided the list of prioritized universities to the management officials in field offices. The field office management assigned a dedicated Outreach Agent to cover the universities within a field office's area of responsibility. According to the policy memorandum, Outreach Agents will work to establish long-term partnerships with the prioritized universities to help those universities prevent unauthorized exports. Commerce emails show that Outreach Agents have coordinated their engagement with the identified universities, and Commerce stated that these agents have already begun traveling to establish and further develop their relationships with the 20 universities. The identification and analysis of relevant risk factors and sharing the results of this analysis with field offices helped inform Commerce's field offices' prioritization of outreach to universities at greater risk for sensitive technology transfers and enhanced the agency's efforts to target limited resources more effectively.
|
| Department of Commerce | The Secretary of Commerce should ensure that the Under Secretary for Industry and Security implements a mechanism to periodically assess the relevance and sufficiency of risk factors used for prioritizing universities for outreach to address new or evolving threats to U.S. university research, including threats pertaining to sensitive technology transfers and unauthorized deemed exports. (Recommendation 3) |
The Department of Commerce concurred with the recommendation. In March 2023, Commerce stated that it plans to establish a procedural document to implement a mechanism to periodically assess the relevance and sufficiency of risk factors. Commerce initially expected to complete this effort by the end of the 2023 calendar year but in February 2024 Commerce revised its estimated completion date to December 31, 2024. We will continue to monitor Commerce's progress in implementing this recommendation.
|
| United States Immigration and Customs Enforcement | The Director of ICE should assess which, if any, additional risk factors are relevant for identifying universities at greater risk for sensitive technology transfers, including unauthorized deemed exports. (Recommendation 4) |
The Department of Homeland Security concurred with the recommendation. In August 2022, ICE reported that it was continuing to use an annually published, open source academic registry to assess contributor identification in research and academic publishing to identify researchers' connections to certain organizations. According to ICE, it expanded this effort by querying this network to identify any indicators that analyst subject matter experts can assess for additional risks and previously unknown connections to calculate which U.S. universities are of the highest risk for sensitive technology transfers. At that time, ICE was also examining other potential risk factors. As of January 2023, ICE had developed a new university risk ranking that incorporates an additional risk factor. The identification and analysis of an additional relevant risk factor helped inform ICE's efforts to target limited resources for outreach to at-risk universities.
|
| United States Immigration and Customs Enforcement | The Director of ICE should implement a mechanism to periodically assess the relevance and sufficiency of risk factors considered in identifying at-risk universities to address new or evolving threats to U.S. university research, including threats pertaining to sensitive technology transfers and unauthorized deemed exports. (Recommendation 5) |
The Department of Homeland Security concurred with the recommendation. In August 2022, ICE reported that it had reassessed the relevance and sufficiency of risk factors and documented this analysis in a memorandum. ICE stated that it examined analysis from stakeholders such as the DHS Office of Strategy, Policy, and Plans; academic institutions; and ICE intelligence analysts, as well as collecting extensive feedback from field agents throughout calendar year 2021 and 2022. From this analysis, ICE determined that the original risk factors identified remain relevant. Moreover, in January 2023, ICE clarified that its mechanism to periodically assess the relevance and sufficiency of risk factors is ongoing communication with various stakeholders, including agents executing the academic outreach program and intelligence analysts. Through these ongoing communications, ICE identified the new risk factor that it incorporated into its updated risk ranking assessment. The periodic assessment of the relevance and sufficiency of risk factors considered in identifying at-risk universities will help ICE address new or evolving threats to U.S. university research.
|
| United States Immigration and Customs Enforcement | The Director of ICE should share with field offices the results of any analyses aimed at identifying U.S. universities at greater risk for sensitive technology transfers. (Recommendation 6) |
The Department of Homeland Security (DHS) concurred with the recommendation. In response to the recommendation, DHS shared two lists with all field offices to support field offices prioritization for academic outreach in June 2022. This included the university risk ranking and the Department of Defense's list of cleared schools, which DHS stated provides some high-value targets for outreach. Field office agents are expected to review these lists to identify universities within their area of responsibility. Sharing the results of the analyses identifying at-risk universities with field offices helped DHS further target limited resources for outreach to at-risk U.S. universities.
|
| Federal Bureau of Investigation | The Director of FBI should ensure that the appropriate offices assess which, if any, additional risk factors should be considered in identifying universities at greater risk for sensitive technology transfers, including unauthorized deemed exports. (Recommendation 7) |
The FBI concurred with the recommendation. In response to the recommendation, the FBI examined analyses from various stakeholders across the FBI, including the Office of Private Sector academia team, Counterintelligence Division, field offices, and academic institutions/associations and determined that the original risk factors identified remained relevant. In addition, FBI identified other risk factors, or data inputs, that field offices can consider when determining university outreach priorities. The identification and analysis of an additional relevant risk factor helped inform FBI's efforts to target limited resources for outreach to at-risk universities.
|
| Federal Bureau of Investigation | The Director of FBI should ensure that the appropriate offices implement a mechanism to periodically assess the relevance and sufficiency of risk factors considered in identifying at-risk universities to address new or evolving threats to U.S. university research, including threats pertaining to sensitive technology transfers and unauthorized deemed exports. (Recommendation 8) |
The FBI concurred with the recommendation. In July 2023, FBI reported that it has developed a mechanism for ongoing, periodic discussions with various stakeholders within and outside FBI to continuously assess factors that may help identify universities facing greater risk for export control violations and related threats. For example, the Counterintelligence Division and Office of Private Sector are meeting semi-annually with four key academia associations to discuss risk factors. The periodic assessment of the relevance and sufficiency of risk factors considered in identifying at-risk universities will help FBI address new or evolving threats to U.S. university research.
|