Executive Summary

Background	The threat to NASA's technological information is continually increasing as foreign entities seek to gain technological and economic advantages. While the National Aeronautics and Space Act of 1958 (the Space Act) promotes the sharing of information to the greatest practical extent, it also seeks to preserve the preeminent position of the United States in aeronautics and space. Moreover, the obligation to protect export-controlled technologies from unauthorized disclosure is found not only in policy statements, such as those in the Space Act, but also in statutes such as the Trade Secrets Act and the export control laws (see Appendix B) that have strict criminal, civil, and administrative penalties. In 1995, NASA established an Export Control Program. The program consists of a NASA-wide system established to ensure that exports(1) to foreign parties in international activities are consistent with the U.S. Export Administration Regulations (the Export Regulations) and the International Traffic in Arms Regulations (the Arms Regulations).
Objective	Our overall objective was to evaluate NASA's control of export-controlled technologies. Specifically, we determined whether NASA identified all export-controlled technologies related to the Space Station, Space Shuttle, and other major programs and established adequate controls over export-controlled technologies to preclude unauthorized or unlicensed transfers. Appendix A contains additional details on our objectives, scope, and methodology.
Results of Audit	NASA has not identified all export-controlled technologies related to its major programs and does not maintain a catalog of classifications for transfers of export-controlled technologies (see Finding A). Also, Agency oversight of and training for personnel in the Export Control Program (the Program) need improvement. Specifically, annual audits of each Center's (2) export control system were not adequately performed (see Finding B) and NASA personnel lack training in controlling and documenting export-controlled technologies (see Finding C). As a result, NASA may not have adequate control over export-controlled technologies to preclude unauthorized or unlicensed transfers.
Revised Recommendation	In response to management's comments on a draft of this report, we revised the recommendation to state that NASA should develop a cataloging process for export-controlled technologies, whereas the draft recommendation showed that NASA should maintain an inventory for all sensitive technologies.
Recommendations	The Office of External Relations should develop policies and procedures to ensure that all export-controlled technologies are identified and protected, only qualified personnel perform export control audits, and NASA employees involved directly or indirectly with technology are trained in classifying and protecting export-controlled technologies. In particular, the Associate Administrator for External Relations should: Establish policy and procedures for a cataloging process of controlled technology export classifications that would be available for all NASA Installations. Define qualifications of personnel who perform Export Control Program audits. Designate only qualified personnel to perform the annual audits of the Export Control Program, in accordance with established policy. Establish policy for resolving and following up on recommendations resulting from export control audits. Enhance the current export control training program for NASA personnel, to include training in U.S. export laws and regulations and in procedures for classifying and documenting exports. Expand training on a recurring basis to NASA employees involved directly or indirectly with technology control.
Management's Response	Management concurred with the revised recommendations and stated it was taking action to correct the reported weaknesses. Management plans to develop a catalog of classifications for specific exports, improve training and guidance for Export Control Program auditors, and enhance and strengthen training for NASA employees involved directly or indirectly with technology control.
Evaluation of Management's Response	Management's planned actions are responsive to all of the recommendations.