Following is an excerpt from the GAO report:
September 6, 2002

Results in Brief

To work with controlled dual-use technologies in the United States, foreign nationals and the firms that employ or sponsor them must comply with U.S. export control and visa regulations. The firms should in many cases hold a deemed export license and the foreign nationals should have an appropriate visa classification such as an H-1B specialized employment classification. Commerce issues deemed export licenses to firms that employ or sponsor foreign nationals after consulting the departments of Defense State and Energy. Deemed export licenses are generally valid for 2 years and comprise almost 10 percent of all export licenses approved by Commerce. An H-1B classification allows a U.S. employer to fill a specialty occupation with a foreign worker. The Department of State issues H-1B visas to foreign nationals residing outside the United States while the Immigration and Naturalization Service INS approves requests from foreign nationals in the United States to change their immigration status to H-1B.

In fiscal year 2001, Commerce approved 822 deemed export license applications and rejected 3. Most of the approved licenses allowed foreign nationals from countries of concern to work with advanced computer electronic or telecommunication and information security technologies in the United States. China accounted for 73 percent of licenses approved in fiscal year 2001. Russia, Iran, India, Syria, Israel, Iraq, and Pakistan accounted for another 14 percent collectively. Not all domestic transfers of controlled technology to foreign nationals require a license. For example, certain types of dual-use technology and software may be provided to foreign nationals from India, Pakistan and Israel without a license. Also research that will be disseminated publicly is exempt from export controls.

To better direct its efforts to detect possible unlicensed deemed exports in fiscal year 2001 Commerce screened thousands of applications for H-1B and other types of visas submitted by foreign nationals overseas. From these applications it developed 160 potential cases for follow-up by enforcement staff in the field. However, we identified two shortcomings in these efforts. First, Commerce did not screen thousands of H-1B change-of-status applications submitted domestically to INS for foreign nationals already in the United States. We found that in fiscal year 2001 about 15,000 individuals from countries of concern changed their immigration status to obtain jobs that could have involved controlled technology. Second, Commerce could not readily track the disposition of the 160 cases referred to field offices for follow-up because it lacks a system for doing so. As a result of these shortcomings, Commerce may be missing opportunities to detect firms that should have applied for deemed export licenses.

Commerce attaches security conditions to almost all licenses to mitigate the risk of providing foreign nationals with controlled dual-use technologies. However, according to senior Commerce officials, Commerce staff do not regularly visit firms to determine whether these conditions are being implemented because of competing priorities, resource constraints and inherent difficulties in enforcing several conditions. For example, they asserted that their staff (1) does not have the technical expertise to determine if a foreign national has helped design semiconductors that exceed a certain technology threshold and (2) cannot monitor intangible technology transfers such as those that may occur in a foreign national's conversations with fellow employees. Department of Defense (DOD) officials asserted that these conditions are critical to DOD's willingness to accept many deemed export license applications.

In this report, we recommend that the Secretary of Commerce use available INS data to identify foreign nationals potentially subject to deemed export licensing requirements. We also recommend that the Secretary of Commerce, in consultation with the Secretaries of Defense State and Energy, establish a risk-based program to monitor compliance with deemed export license conditions that draws upon the full range of technical expertise available to the Secretary. If the secretaries conclude that enforcement of certain security conditions is not practical, we recommend that they jointly develop conditions that are enforceable or devise alternative methods to ensure that deemed exports do not place U.S. national security interests at risk.

In commenting on a draft of this report, DOD stated that it concurred with our recommendations. Commerce stated that it would consult with other departments on the practicality of implementing the recommendations. Commerce stated that it would contact INS to explore ways of referring to Commerce H-1B change-of-status applications involving employment that might result in access to sensitive technology. In response to a recommendation in our draft report, Commerce also stated that it would establish a new database by the end of calendar year 2002 that will allow its analysts to check on the status of their field office referrals.

Commerce also said that it is developing a more extensive monitoring program for firms that have been issued deemed export licenses although it disagreed with our assessment that it currently lacks an effective monitoring process. It asserted that Commerce staff monitor the submission of required internal control plans by firms and contact firms who fail to submit these documents. It further asserted that it would continue to visit select firms to monitor compliance with license conditions. We do not agree with Commerce's assessment of the effectiveness of its monitoring process. Commerce's process is essentially limited to administrative checks by headquarters staff to determine whether firms have submitted required paperwork. We found no evidence that Commerce selects and visits certain firms for the purpose of verifying compliance with deemed export license conditions. As a result, we believe our recommendation that Commerce establish a risk-based program to monitor compliance is still appropriate.