OIG: NASA’s Implementation of Export Control and Foreign National Access Management Recommendations
WHY WE PERFORMED THIS AUDIT
Throughout its history, NASA has been at the forefront of science and space exploration and responsible for numerous scientific and technological discoveries and innovations. In the course of this work, the Agency partners with foreign countries and foreign nationals on projects and research, some of which may contain sensitive space-related technology and information. The challenge for NASA has been to sustain and nurture these partnerships while protecting the Agency’s sensitive information.
Beginning in 2009, Federal law enforcement agencies received complaints that foreign nationals working as contractors at NASA’s Ames Research Center (Ames) had been given improper access to “export-controlled information.” Furthermore, in 2013 questions arose regarding a Chinese national’s access to Agency data and information technology systems at the Langley Research Center (Langley). The NASA Office of Inspector General (OIG) investigated and issued reports regarding the Ames and Langley matters. In addition, the Government Accountability Office (GAO) and National Academy of Public Administration (NAPA) issued reports in 2014 examining NASA’s Export Control Program and foreign national access management. Collectively, the OIG, GAO, and NAPA made 40 recommendations to improve NASA’s export control and foreign national access processes and procedures.
We initiated this audit to assess NASA’s implementation of the OIG, GAO, and NAPA recommendations and the actions the Agency has taken to protect export-controlled information. We visited NASA Headquarters, Ames, Langley, and the Johnson Space Center and spoke with personnel responsible for developing and implementing export control and foreign national access policies, processes, and procedures.
WHAT WE FOUND
NASA has taken significant steps to address the recommendations made by the OIG, GAO, and NAPA. As of December 31, 2015, the Agency had implemented all of the OIG’s recommendations, 5 of GAO’s 7 recommendations, and 18 of NAPA’s 27 recommendations. For example, in March 2014 in response to NAPA recommendations, NASA established a Foreign National Access Management Program under its Office of Protective Services, proposed revisions to its policy regarding foreign national access, and drafted an operating manual to address the issue.
However, some Center officials raised concerns that several requirements in the draft Agency policy – specifically those requiring fingerprints from foreign nationals not living in or likely to visit the United States – are not practical and will impose undue burdens on their projects and programs. We found that due to a lack of effective collaboration and communication, NASA did not fully capitalize on opportunities to address these and other concerns. Consequently, completion of policy revisions and the foreign national access manual needed to address several recommendations has taken longer than expected.
In addition, NASA should improve the Export Control Program’s self-assessment process and sharing of lessons learned, including those resulting from voluntary disclosures, actions that could reduce the risk of future violations of export control and foreign national access rules and procedures. Our review of the annual export control audits from the three Centers we visited found that auditors concentrated primarily on administrative requirements rather than evaluating the effectiveness of the functional and procedural components. Furthermore, although NASA policy encourages sharing knowledge and best practices, Center personnel were generally unaware of the actions other Centers had taken to improve their export control and foreign national access processes and procedures.
WHAT WE RECOMMENDED
In order to improve NASA’s Export Control and Foreign National Access Management Programs, we made six recommendations, including that the Agency review export control and foreign national access processes and procedures at all Centers, address deficiencies, and share best practices; further engage with Headquarters and Center stakeholders to develop foreign national access management policies that will complement NASA’s international and bilateral support agreements and foreign national students and interns; combine the Export Control and Foreign National Access Operations Manuals to ensure clarity and consistency between the two Programs; ensure annual audit reports are standardized and consistently evaluated across Centers; and establish a methodology for increasing voluntary disclosures and sharing disclosures across Centers.
In response to a draft of our report, management concurred with five of the six recommendations, disagreeing with our recommendation to combine the Export Control and Foreign National Access Operations Manuals. Although management concurred with our recommendation to review processes and procedures at all Centers, we did not find its proposed actions fully responsive; therefore, this recommendation and the recommendation to combine the Operations Manuals remain unresolved pending further discussions with the Agency. The other four recommendations are resolved and will be closed upon completion and verification of the proposed corrective actions.
