GAO cites weakness in NASA’s export control policies

   A congressional watchdog agency warned that weaknesses in the National Aeronautics and Space Administration (NASA) export control policy and implementation of foreign national access procedures at some centers increase the risk of unauthorized access to export-controlled technologies.
   NASA policies provide center directors wide latitude in implementing export controls. However, NASA procedures do not clearly define the level of center export administrator (CEA) authority and organizational placement, leaving it to the discretion of the center director, said the Government Accountability Office in a report released Thursday.
   GAO found that seven of the 10 CEAs are at least “three levels removed” from the center director. Three of these seven stated that their placement detracted from their ability to implement export control policies by making it difficult to maintain visibility to staff, communicate concerns to the center director, and obtain resources, while the other four did not express concerns about their placement.
   However, in a 2013 meeting of export control officials, the CEAs recommended placing the CEA function at the same organizational level at each center for uniformity, visibility and authority.
   GAO identified and the NASA Inspector General also reported instances in which two centers did not comply with NASA policy on foreign national access to NASA technologies. For example, during a four-month period in 2013, one center allowed foreign nationals on a major program to fulfill the role of sponsors for other foreign nationals, including determining access rights for themselves and others. “Each instance risks damage to national security,” GAO said.
   Due to access concerns, the NASA administrator restricted foreign national visits in March 2013 and directed each center to assess compliance with foreign national access and develop corrective plans. By June 2013, six centers identified corrective actions, but only two set timeframes for completion and only one planned to assess the effectiveness of actions taken. “Without plans and time frames to monitor corrective actions, it will be difficult for NASA to ensure that actions are effective,” GAO warned.
   The GAO also noted, “NASA headquarters export control officials and CEAs lack a comprehensive inventory of the types and location of export-controlled technologies, and NASA headquarters officials have not addressed deficiencies raised in oversight tools, limiting their ability to take a risk-based approach to compliance.”
   Three CEAs have early efforts under way to better identify technologies that could help focus compliance on areas of greatest risk. For example, one CEA is working with NASA’s Office of Protective Services Counterintelligence Division to identify the most sensitive technologies at the center to help tailor oversight efforts. “Such approaches, implemented NASA-wide, could enable the agency to better target existing resources to protect sensitive technologies,” GAO said.
   GAO recommended the NASA administrator create guidance to better define the CEA function, establish timeframes to implement foreign national access corrective actions and assess results, and form a more risk-based approach to oversight, among other actions. “NASA concurred with all of our recommendations and provided information on actions taken or planned to address them,” GAO said.