United States Government Accountability Office GAO Report to the Committee on Armed Services U S Senate July 2005 INDUSTRIAL SECURITY DOD Cannot Ensure Its Oversight of Contractors under Foreign Influence Is Sufficient GAO-05-681 July 2005 INDUSTRIAL SECURITY Accountability Integrity Reliability Highlights Highlights of GAO-05-681 a report to Committee on Armed Services U S Senate DOD Cannot Ensure Its Oversight of Contractors under Foreign Influence Is Sufficient Why GAO Did This Study What GAO Found The Department of Defense DOD is responsible for ensuring that U S contractors safeguard classified information in their possession DOD delegates this responsibility to its Defense Security Service DSS which oversees more than 11 000 contractor facilities that are cleared to access classified information Some U S contractors have foreign connections that may require measures to be put into place to reduce the risk of foreign interests gaining unauthorized access to classified information DSS’s oversight of contractors under FOCI depends on contractors self-reporting foreign business transactions such as foreign acquisitions As part of its oversight responsibilities DSS verifies the extent of the foreign relationship works with the contractor to establish protective measures to insulate foreign interests and monitors contractor compliance with these measures In summary GAO found that DSS cannot ensure that its approach to overseeing contractors under FOCI is sufficient to reduce the risk of foreign interests gaining unauthorized access to U S classified information In response to a Senate report accompanying the National Defense Authorization Act for Fiscal Year 2004 GAO assessed the extent to which DSS has assurance that its approach provides sufficient oversight of contractors under foreign ownership control or influence FOCI What GAO Recommends GAO recommends that DOD direct DSS to improve data collection and analysis of FOCI transactions and protective measures and direct DSS to systematically assess the effectiveness of the FOCI process to reduce risk of foreign interests gaining unauthorized access to classified information DSS should formulate a human capital strategy and plan to evaluate whether its staff need better information training and tools to perform FOCI responsibilities DOD did not concur with our recommendations and stated the process is sufficient First DSS does not systematically ask for collect or analyze information on foreign business transactions in a manner that helps it properly oversee contractors entrusted with U S classified information In addition DSS does not collect and track the extent to which classified information is left in the hands of a contractor under FOCI before measures are taken to reduce the risk of unauthorized foreign access During our review we found instances in which contractors did not report foreign business transactions to DSS for several months We also found a contractor under foreign ownership that appeared to operate for at least 6 months with access to U S classified information before a protective measure was implemented to mitigate foreign ownership Second DSS does not centrally collect and analyze information to assess its effectiveness and determine what corrective actions are needed to improve oversight of contractors under FOCI For example DSS does not know the universe of all contractors operating under protective measures the degree to which contractors are complying overall with measures or how its oversight could be strengthened by using information such as counterintelligence data to bolster its measures Third DSS field staff face a number of challenges that significantly limit their ability to sufficiently oversee contractors under FOCI Field staff told us they lack research tools and training to fully understand the significance of corporate structures legal ownership and complex financial relationships when foreign entities are involved Staff turnover and inconsistencies over how guidance is to be implemented also detract from field staff’s ability to effectively carry out FOCI responsibilities www gao gov cgi-bin getrpt GAO-05-681 To view the full product including the scope and methodology click on the link above For more information contact Ann CalvaresiBarr at 202 512-4841 or calvaresibarra@gao gov United States Government Accountability Office Contents Letter 1 Results in Brief Background DSS’s Approach to Overseeing FOCI Contractors Is Insufficient Conclusions Recommendations for Executive Action Agency Comments 3 4 8 15 16 17 Appendix I Scope and Methodology 20 Appendix II Comments from the Department of Defense 21 Table Table 1 Types of Protective Measures 7 Figure 1 Overview of DSS’s FOCI Process Figure 2 Knowledge Gaps in DSS’s FOCI Process 6 9 Figures Abbreviations DOD DSS FOCI Department of Defense Defense Security Service foreign ownership control or influence This is a work of the U S government and is not subject to copyright protection in the United States It may be reproduced and distributed in its entirety without further permission from GAO However because this work may contain copyrighted images or other material permission from the copyright holder may be necessary if you wish to reproduce this material separately Page i GAO-05-681 Industrial Security United States Government Accountability Office Washington DC 20548 July 15 2005 The Honorable John W Warner Chairman Committee on Armed Services United States Senate The Honorable Carl Levin Ranking Minority Member Committee on Armed Services United States Senate The Department of Defense DOD depends on numerous U S contractor facilities to develop and produce military technologies such as those used in tactical aircraft and military satellites that require access to classified information DOD’s Defense Security Service DSS on behalf of DOD and 23 other federal departments administers the National Industrial Security Program which was established to ensure that contractors appropriately safeguard classified information in their possession while performing work for the U S government DSS is responsible for providing oversight and assistance to U S contractors that are cleared for access to classified information Among these contractors are those under foreign ownership control or influence FOCI —that is a situation in which a foreign interest has the power to decide matters affecting a contractor’s operations and that could result in unauthorized access to U S classified information or adversely affect the performance of classified contracts 1 The policy of the U S government is to allow foreign interests to invest in U S contractors as long as those investments do not pose a threat to U S national security interests DSS depends on the contractor to self-report information about certain business transactions with foreign entities such as foreign ownership of a contractor’s stock Once it becomes aware that a contractor has come under foreign influence through such transactions DSS is responsible for verifying the extent of the foreign relationship DSS and the contractor 1 FOCI is defined in the National Industrial Security Program Operating Manual which prescribes the requirements restrictions and safeguards that contractors are to follow to prevent the unauthorized disclosure of classified information Page 1 GAO-05-681 Industrial Security then work together to decide what appropriate action or measure is to be taken to protect U S classified information from unauthorized disclosure to foreign interests DSS relies on a number of protective measures to reduce the risk of foreign entities having unauthorized access to classified information including requiring a foreign owner to transfer title of company stock to U S citizen trustees approved by DOD DSS is also responsible for monitoring the contractors’ implementation of the protective measures put in place to mitigate FOCI and relies on contractors to report instances of noncompliance with its protective measures In a report accompanying the National Defense Authorization Act for Fiscal Year 2004 the Senate Armed Services Committee directed us to review DSS’s oversight of contractors with foreign business relationships In response we examined the extent to which DSS has assurance that its approach provides sufficient oversight of contractors under foreign ownership control or influence 2 To assess DSS’s oversight of U S contractors involved in foreign business transactions we interviewed and obtained documentation from DSS headquarters DSS field offices and selected contractors operating under various protective measures We reviewed DSS’s guidance and procedures for overseeing contractors that operate under FOCI and for monitoring contractors’ compliance with protective measures We examined and analyzed 27 case files for contractors that had various types of foreign business transactions reviewed by DSS which we discussed with DSS headquarters and field officials We performed our work from June 2004 to May 2005 in accordance with generally accepted government auditing standards Details on our scope and methodology can be found in appendix I 2 As part of its report accompanying the National Defense Authorization Act for Fiscal Year 2004 S Rep No 108-46 at 345-346 2003 the Senate Committee on Armed Services also directed us to review DOD’s National Industrial Security Program In response to that request we assessed 1 DSS’s oversight of U S contractor facilities’ implementation of the National Industrial Security Program and 2 DSS’s adherence to required procedures after a security violation and possible compromise of classified information Our assessment was detailed in the following report GAO Industrial Security DOD Cannot Provide Adequate Assurance That Its Oversight Ensures the Protection of Classified Information GAO-04-332 Washington D C Mar 3 2004 Page 2 GAO-05-681 Industrial Security Results in Brief DSS cannot ensure that its oversight of contractors under FOCI is sufficient to reduce the risk of foreign interests gaining unauthorized access to U S classified information First DSS does not systematically ask for information that would allow it to know if contractors are reporting foreign business transactions when they occur DSS also does not collect and track the extent to which classified information is accessible to a contractor under FOCI before measures are taken to reduce the risk of unauthorized foreign access Without this information DSS is limited in its ability to effectively oversee contractors under FOCI and take actions when needed to protect classified information from undue foreign access During our review we found instances in which contractors did not report foreign business transactions to DSS for several months In addition we found a contractor under foreign ownership that appeared to have had access to U S classified information for at least 6 months before a protective measure was implemented Second DSS does not centrally collect and analyze information to assess its effectiveness and determine what corrective actions are needed to improve oversight of contractors under FOCI For example DSS does not know the total number of contractors operating under all protective measures and the degree to which contractors are complying overall with protective measures Third DSS field staff face a number of challenges in carrying out their responsibilities in overseeing contractors under FOCI Field staff told us they lack research tools and training to fully understand the significance of corporate structures legal ownership and complex financial relationships when foreign entities are involved Field staff also informed us that staff turnover further compounded these challenges In addition we found inconsistencies in how field staff understand and implement FOCI guidance These challenges combined significantly limit DSS field staff’s ability to sufficiently oversee contractors under FOCI to minimize the risk of unauthorized foreign access to U S classified information In light of our findings we are recommending that the Secretary of Defense take certain actions to 1 improve DDS’s knowledge of the timing of foreign business transactions 2 assess the overall effectiveness of DSS’s oversight of contractors under FOCI and 3 develop a human capital strategy that would provide the appropriate support for industrial security representatives DOD did not concur with our recommendations In commenting on a draft of our report DOD indicated that it believes the FOCI process is adequate to ensure the protection of classified information However DOD did not provide evidence to support this belief Given the vulnerabilities we identified in our report our recommendations stand Page 3 GAO-05-681 Industrial Security Background The National Industrial Security Program was established in 1993 for the protection of classified information DSS administers the National Industrial Security Program on behalf of DOD and 23 other federal departments and agencies DSS is responsible for providing oversight advice and assistance to more than 11 000 U S contractor facilities that are cleared for access to classified information Contractor facilities can range in size be located anywhere in the United States and include manufacturing plants laboratories and universities About 221 industrial security representatives work out of 25 DSS field offices across the United States and serve as the primary points of contact for these facilities DSS is responsible for ensuring that these contractors meet requirements to safeguard classified information under the National Industrial Security Program Contractors must have facility security clearances under this program before they can work on classified contracts To obtain a facility security clearance contractors are required to selfreport foreign business transactions on a Certificate Pertaining to Foreign Interests form 3 Examples of such transactions include foreign ownership of a contractor’s stock a contractor’s agreements or contracts with foreign persons and whether non-U S citizens sit on a contractor’s board of directors DSS’s industrial security representatives provide guidance to contractors on filling out the certificate If a contractor declares no foreign business transactions on the certificate DSS places the certificate in the contractor’s file located in the field When U S contractors with facility security clearances have changes in foreign business transactions to report they are required to complete the certificate again and resubmit it every 5 years even if no foreign transactions take place Because a U S company can own a number of contractor facilities the corporate headquarters or another legal entity within that company is required to complete the certificate 4 3 Throughout our report we refer to information reported by contractors on the Certificate Pertaining to Foreign Interests form or the changes afterwards as foreign business transactions 4 Each business structure has its own set of legal requirements Within the National Industrial Security Program the most common type of business structure is the corporation A corporation may be organized as a single corporate entity a multiple facility organization with divisions or a parent-subsidiary relationship Under a multiple facility organization the home office is the legal entity while the divisions are extensions of the legal entity In a parent-subsidiary relationship the parent and the subsidiary are separate legal entities Page 4 GAO-05-681 Industrial Security When contractors declare foreign transactions on their certificates and notify DSS industrial security representatives are responsible for ensuring that contractors properly identify all relevant foreign business transactions They are also required to collect analyze and verify pertinent information about these transactions For example by examining various corporate documents the industrial security representatives can determine corporate structures and ownership and identify key management officials The representatives may consult with DSS counterintelligence officials who can provide information about threats to U S classified information If contractors’ answers on the certificates indicate that foreign transactions meet certain DSS criteria or exceed thresholds such as the percentage of company stock owned by foreign persons the representatives forward these FOCI cases to DSS headquarters DSS headquarters works with contractors to determine what if any protective measures are needed to reduce the risk of foreign interests gaining unauthorized access to U S classified information DSS field staff are then responsible for monitoring contractor compliance with these measures Figure 1 shows highlights of the FOCI process Page 5 GAO-05-681 Industrial Security Figure 1 Overview of DSS’s FOCI Process Who is involved in the process Identification and verification of FOCI Mitigation of FOCI Contractor facilities’ officials Submit Certificate Pertaining to Foreign Interests along with supporting documentation to DSS Submit plan to DSS headquarters for protective measures Industrial security representatives in DSS field offices Verify information in foreign interest certificate and in supporting documentation Determine if answers on certificate meet criteria or exceed thresholds that require DSS headquarters’ review If criteria are met or thresholds are exceeded forward case to headquarters If case does not require headquarters review maintain documentation in field office file DSS headquarters officials Conduct further review of contractorsupplied FOCI information Determine need for protective measures Oversight of contractors with FOCI Participate in DSS security review Submit compliance report and hold annual FOCI meeting when required with DSS industrial security representatives Conduct security review Review compliance report and attend annual FOCI meeting when required with contractors Review and approve contractors’ plans for protective measures Hold initial meeting with contractors to discuss protective measures Review compliance report and attend first annual FOCI meeting when required with contractors Source DSS data GAO analysis and presentation On a case-by-case basis DSS headquarters can approve the use by contractors of one of six types of protective measures voting trust agreements proxy agreements special security agreements security control agreements board resolutions and limited facility clearances These protective measures are intended to insulate contractor facilities from undue foreign control and influence and to reduce the risk of unauthorized foreign access to classified information Protective measures vary in the degree to which foreign entities are insulated from classified information and are not intended to deny foreign owners the opportunity Page 6 GAO-05-681 Industrial Security to pursue business relationships with their U S -based contractor facilities working on classified contracts Table 1 provides a general description of each of these protective measures In addition to these measures DSS can also require contractors to take certain actions to mitigate specific FOCI situations such as termination of loan agreements or elimination of debt owed to a foreign entity Table 1 Types of Protective Measures Protective measure General description Voting trust agreement • Foreign owners transfer legal title to the stock of the foreign-owned U S company to U S citizen trustees that are approved by DOD Proxy agreement • Special security agreement • Similar to a voting trust except foreign owners retain legal title to the stock and transfer voting rights of stock to U S citizen proxy holders that are approved by DOD Allows representatives of the foreign owner to be on the U S contractor’s board of directors but requires U S citizen outside directors that are approved by DOD Contractors under a special security agreement are denied access to classified information such as Top Secret special access and other sensitive information unless DOD determines it is in the U S national interest and grants an exception Similar to a special security agreement and used when contractor is not effectively owned or controlled by foreign person s Unlike contractors under a special security agreement contractors under a security control agreement are not denied access to classified information such as Top Secret special access and other sensitive information Resolution by contractor’s board of directors certifying that foreign shareholder s shall not have access to classified information or be permitted to hold positions that enable them to influence the performance of classified contracts Requires industrial security agreement with the foreign government of the country from which foreign ownership is derived Access to classified information is restricted to performance on a specific contract as defined by the government customer but there is no restriction on foreign management control and influence • Security control agreement • • Board resolution • Limited facility clearance • • Source DSS data GAO analysis and presentation For contractors operating under voting trust proxy special security or security control agreements industrial security representatives are supposed to conduct annual FOCI meetings with contractor staff who are responsible for ensuring compliance with these protective measures In preparation for these annual meetings contractors are required to produce and submit to DSS annual FOCI compliance reports that can describe specific acts of noncompliance with protective measures changes in organizational structure or changes in security procedures at the contractor and other issues that have occurred over the course of a year Industrial security representatives should then review the reports to determine how contractors are fulfilling their obligations under the Page 7 GAO-05-681 Industrial Security protective measures In addition DSS generally conducts security reviews annually for facilities that store classified information or every 18 months for facilities that do not have classified information on site However for contractors operating under voting trust proxy special security or security control agreements industrial security representatives are required to conduct a security review every 12 months whether the contractor has classified information on site or not These reviews are designed to determine security vulnerabilities and contractor compliance with National Industrial Security Program requirements and to evaluate the overall quality of the facility’s security program including compliance with protective measures to mitigate FOCI DSS will not grant a new facility security clearance to a contractor until all relevant FOCI have been mitigated In addition DSS shall suspend an existing clearance if FOCI at a contractor facility has not been mitigated A contractor with a suspended facility clearance can continue to work on an existing classified contract unless the government contracting office denies access to the existing contract In addition the contractor cannot be awarded a new classified contract until the clearance is restored DSS’s Approach to Overseeing FOCI Contractors Is Insufficient DSS does not systematically ask for collect or analyze foreign business transactions in a manner that helps it properly oversee contractors entrusted with U S classified information nor does DSS aggregate and analyze information to determine the overall effectiveness of its oversight of FOCI contractors Notably DSS does not know if contractors are reporting foreign business transactions as they occur and lacks knowledge about how much time a contractor facility with unmitigated FOCI has access to classified information 5 Figure 2 shows a general description of gaps in DSS knowledge about the FOCI process Furthermore DSS field staff said they lack research tools and sufficient training regarding the subject of foreign transactions and have indicated challenges with regard to staff turnover 5 “Unmitigated FOCI” refers to situations in which contractors with facility security clearances are under FOCI and protective measures are needed but not yet implemented Page 8 GAO-05-681 Industrial Security Figure 2 Knowledge Gaps in DSS’s FOCI Process Potential period of unmitigated FOCI FOCI business transaction occurs Contractor self-reports FOCI transaction to DSS If protective measure is required DSS and contractor decide which type of measure to implement Contractor implements protective measure DSS’s FOCI process DSS does not analyze whether contractors self-report transactions DSS does not know how much time passes before contractor implements the protective measure Source DSS data GAO analysis and presentation Note Per the National Industrial Security Program Operating Manual DSS shall suspend the facility clearance of a contractor with unmitigated FOCI DSS Cannot Ensure Timely Reporting from FOCI Contractors or Determine the Extent to Which FOCI Is Unmitigated DSS does not systematically ask for information that would allow it to know if contractors are reporting certain foreign business transactions when they occur which begins the process for reducing FOCI-related security risks DSS industrial security representatives are responsible for advising contractors that timely notification of foreign business transactions is essential The National Industrial Security Program Operating Manual requires contractors with security clearances to report any material changes of foreign business transactions previously notified to DSS but does not specify a time frame for doing so DSS is dependent on contractors to self-report transactions by filling out the Certificate Pertaining to Foreign Interests form but this form does not ask contractors to provide specific dates for when foreign transactions took place In addition DSS does not compile or analyze how much time passes before DSS becomes aware of foreign business transactions DSS field staff told us that some contractors report foreign business transactions as they occur while others report transactions months later if at all During our review we found a few instances in which contractors were not reporting foreign business transactions when they occurred One contractor did not report FOCI until 21 months after awarding a subcontract to a foreign entity Another contractor hired a foreign national as its corporate president but did not report this transaction to DSS and DSS did not know about the FOCI change until 9 months later when the industrial security representative came across the information on the Page 9 GAO-05-681 Industrial Security contractor’s Web site In another example DSS was not aware that a foreign national sat on a contractor’s board of directors for 15 months until we discovered it in the process of conducting our audit work Without timely notification from contractors DSS cannot track when specific foreign business transactions took place and therefore is not in a position to take immediate action so that FOCI is mitigated if necessary In addition DSS does not determine the time elapsed from reporting of foreign business transactions by contractors with facility clearances to the implementation of protective measures or when suspensions of facility clearances occur Without protective measures in place unmitigated FOCI at a cleared contractor increases the risk that foreign interests can gain unauthorized access to U S classified information During our review we found two cases in which contractors appeared to have operated with unmitigated FOCI before protective measures were implemented For example officials at one contractor stated they reported to DSS that their company had been acquired by a foreign entity However the contractor continued operating with unmitigated FOCI for at least 6 months In the other example a foreign-purchased contractor continued operating for 2 months with unmitigated FOCI Contractor officials in both examples told us that their facility clearances were not suspended According to the National Industrial Security Program Operating Manual DSS shall suspend the facility clearance of a contractor with unmitigated FOCI DSS relies on field office staff to make this determination Because information on suspended contractors with unmitigated FOCI is maintained in the field DSS headquarters does not determine at an aggregate level the extent to which and under what conditions it suspends contractors’ facility clearances due to unmitigated FOCI DSS Does Not Maintain Aggregate Information to Assess Overall Effectiveness of the FOCI Process DSS does not centrally collect and analyze information to determine the magnitude of contractors under FOCI and assess the effectiveness of its oversight of those contractors For example DSS does not know how many contractors under FOCI are operating under all types of protective measures and therefore does not know the extent of potential FOCIrelated security risks Although DSS tracks information on contractors operating under some types of protective measures it does not centrally compile data on contractors operating under all types of protective measures 6 Specifically DSS headquarters maintains a central repository 6 There may be multiple contractor locations under a particular protective measure but the legal parent signs the measure that covers its divisions Page 10 GAO-05-681 Industrial Security of data on contractors under voting trust agreements proxy agreements and special security agreements—protective measures intended to mitigate majority foreign ownership However information on contractors under three other protective measures—security control agreements limited facility clearances and board resolutions—are maintained in paper files in the field offices 7 DSS does not aggregate data on contractors for all six types of protective measures and does not track and analyze overall numbers In addition DSS does not conduct overall analysis of foreign business transactions reported by contractors on their Certificate Pertaining to Foreign Interests forms or maintain aggregate information for contractors’ responses Consequently DSS does not know the universe of FOCI contractors operating under protective measures and DSS cannot determine the extent to which contractors under FOCI are increasing or if particular types of foreign business transactions are becoming more prevalent This information would help DSS target areas for improved oversight According to DSS officials centralizing and tracking information on contractors under all types of measures would require more resources because information is dispersed in paper files in DSS field offices around the country DSS does not systematically compile and analyze trends from its oversight functions to identify overall compliance trends or concerns with implementation of protective measures by contractors DSS industrial security representatives are responsible for ensuring compliance of FOCI contractors under certain protective measures through annual FOCI meetings where they discuss contractors’ compliance reports 8 Industrial security representatives notify headquarters of the results of the meetings and place compliance reports and their own assessments in paper files located in field offices However DSS headquarters does not use annual compliance reports to assess trends to evaluate overall effectiveness of the FOCI process 7 The field office files are the official record for documenting information on contractor facilities’ security programs and industrial security representatives’ interactions with those contractors including those under FOCI The paper folders contain such information as the identity of the facility owner contractor-submitted Certificate Pertaining to Foreign Interests forms and the results of the contractor’s last two security reviews In addition to the file folders DSS has a facilities database that contains information on facilities’ security programs DSS officials acknowledged that the database is prone to data integrity and data loss problems that need to be addressed 8 The protective measures include voting trust proxy special security and security control agreements Page 11 GAO-05-681 Industrial Security Finally the use of protective measures at FOCI contractor facilities was designed in part to counter attempts to gather classified information through unauthorized means DSS does not assess trends from its own counterintelligence data or information gathered by other intelligence agencies to evaluate whether protective measures are effectively mitigating FOCI risk across the board For example a 2004 DSS counterintelligence report states that foreign information targeting through e-mail and Internet communication and collection methods is on the rise However according to DSS officials not all protective measures at FOCI contractors include provisions to monitor e-mail or other Internet traffic By assessing counterintelligence trends to analyze the effectiveness of protective measures in countering foreign information collection attempts DSS could identify weaknesses in its protective measures and adjust them accordingly DSS Industrial Security Representatives Face Challenges in Carrying Out FOCI Responsibilities DSS’s field staff face numerous challenges complexities in verifying FOCI cases limited tools to research FOCI transactions insufficient FOCI training staff turnover and inconsistencies in implementing guidance on FOCI cases For industrial security representatives verifying if a contractor is under FOCI is complex Industrial security representatives cited various difficulties verifying FOCI information To verify if a contractor is under FOCI industrial security representatives are required to understand the corporate structure of the legal entity completing the Certificate Pertaining to Foreign Interests form and evaluate the types of foreign control or influence that exist for each entity within a corporate family DSS officials informed us that tracing strategic company relationships country of ownership and foreign affiliations and suppliers or reviewing corporate documentation—such as loan agreements financial reports or Securities and Exchange Commission filings—is complicated For example representatives are required to verify information on stock ownership by determining the distribution of the stock among the stockholders and the influence or control the stockholders may have within the corporation This entails identifying the type of stock and the number of shares owned by the foreign person s to determine their authority and management prerogatives which DSS guidance indicates may be difficult to ascertain in certain cases According to DSS field officials verifying information is especially difficult when industrial security representatives have limited exposure to FOCI cases In some field offices we visited industrial security representatives had few or no Page 12 GAO-05-681 Industrial Security FOCI cases and therefore had limited knowledge about how to verify foreign business transactions Some industrial security representatives in one field office told us they do not always have the tools needed to verify if contractors are under FOCI As part of their review process industrial security representatives are responsible for verifying what a contractor reports on its Certificate Pertaining to Foreign Interests form and determining the extent of foreign interests in the company Industrial security representatives conduct independent research using the Internet or return to the contractor for more information to evaluate the FOCI relationships and hold discussions with management officials such as the chief financial officer treasurer and legal counsel DSS headquarters officials told us additional information sources such as the Dun and Bradstreet database of millions of private and public companies are currently not available in the field However some industrial security representatives stated that such additional resource tools would be beneficial for verifying complex FOCI information In addition industrial security representatives stated they lacked the training and knowledge needed to better verify and oversee contractors under FOCI For example DSS does not require its representatives to have financial or legal training While some FOCI training is provided representatives largely depend on DSS guidance and on-the-job training to oversee a FOCI contractor In so doing representatives work with more experienced staff or seek guidance when needed from DSS headquarters In a 1999 review DSS recognized that recurring training was necessary to ensure industrial security representatives remain current on complex FOCI issues and other aspects of the FOCI process DSS headquarters officials said that they have held regionwide meetings where they discussed FOCI case scenarios and responded to questions about the FOCI process However we found that the training needs on complex FOCI issues are still a concern to representatives In fact many said they needed more training to help with their responsibility of verifying FOCI information including how to review corporate documents strategic company relationships and financial reports DSS field officials said the DSS training institute currently offers a brief training unit on FOCI Page 13 GAO-05-681 Industrial Security covering basic information 9 DSS established a working group of DSS field and headquarters staff to look at ways to improve the training program including more specific FOCI training The group submitted recommendations in March 2005 to field managers for their review 10 DSS is also planning to work with its training institute to develop additional FOCI courses to better meet the needs of the industrial security representatives According to field staff industrial security representatives operate in an environment of staff turnover which can affect their in-depth knowledge of FOCI contractors Officials from one-third of the field offices we reviewed noted staff retention problems DSS officials at two of these field offices said that in particular they have problems retaining more experienced industrial security representatives Field officials said that when an industrial security representative retires or leaves the staff member’s entire workload is divided among the remaining representatives who already have a substantial workload In addition DSS guidance advises field office officials to rotate contractor facilities among industrial security representative every 3 years if possible as a means of retaining DSS independence from the contractors DSS officials told us the rotation can actually occur more frequently because of staff turnover DSS headquarters officials said they are formulating a working group to help improve staff retention in the field Compounding these challenges are inconsistencies among field offices in how industrial security representatives said they understood and implemented DSS guidance for reviewing contractors under FOCI For example per DSS guidance security reviews and FOCI meetings should be performed every 12 months for contractors operating under special security agreements security control agreements voting trust agreements and proxy agreements However we found that some industrial security representatives were inconsistent in implementing the guidance For example one representative said a contractor under a special security 9 DSS officials told us that new industrial security representatives participate in a 12-week mentoring program prior to attending a 4-week course at the DSS training institute The mentoring program consists of separate units that contain activities that must be completed before an industrial security representative is approved to attend the 4-week course In either the program or the course only one unit or section of training pertains to general FOCI information 10 According to DSS the overall goal for this working group was to connect professional development to the individual employee the budget and DSS’s mission Page 14 GAO-05-681 Industrial Security agreement was subject to a security review every 18 months because the contractor did not store classified information on-site 11 In addition two industrial security representatives told us they did not conduct annual FOCI meetings for contractors that were operating under a proxy agreement and security control agreement respectively We also found that industrial security representatives varied in their understanding or application of DSS guidance for when they should suspend a contractor’s facility clearance when FOCI is unmitigated The guidance indicates that when a contractor with a facility clearance is determined to be under FOCI that requires mitigation by DSS headquarters the facility security clearance shall be suspended until a protective measure is implemented However we were told by officials in some field offices that they rarely suspend clearances when a contractor has unmitigated FOCI as long as the contractor is demonstrating good faith in an effort to provide documentation to DSS to identify the extent of FOCI and submits a FOCI mitigation plan to DSS Officials in other field offices said they would suspend a contractor’s facility clearance once they learned the contractor had unmitigated FOCI Conclusions The protection of classified information has become increasingly important in light of the internationalization of multibillion-dollar cooperative development programs such as a new-generation fighter aircraft and a growing number of complex cross-border industrial arrangements Although such developments offer various economic and technological benefits there can be national security risks when foreign companies control or influence U S contractors with access to classified information Given the growing number of DOD contractors with connections to foreign countries it is critical for DSS to ensure that classified information is protected from unauthorized foreign access In carrying out its responsibilities DSS is dependent on self-reported information from the contractors about their foreign activities creating vulnerabilities outside of DSS’s control Within this environment unless DSS improves the collection and analysis of key information and provides its field staff with the training and tools they need to perform FOCI responsibilities DSS will continue to operate without knowing how 11 DSS reported in a 1999 review of its FOCI process that the oversight by industrial security representatives was not always consistent and at that time DSS recommended that FOCI companies should be assessed annually rather than on an 18-month schedule Page 15 GAO-05-681 Industrial Security effective its oversight is at reducing the risk of foreign interests gaining unauthorized access to U S classified information Recommendations for Executive Action To improve knowledge of the timing of foreign business transactions and reduce the risk of unauthorized foreign access to classified information we recommend that the Secretary of Defense direct the director of DSS to take the following three actions • clarify when contractors need to report foreign business transactions to DSS • determine how contractors should report and communicate dates of specific foreign business transactions to DSS and • collect and analyze when foreign business transactions occurred at contractor facilities and when protective measures were implemented to mitigate FOCI To assess overall effectiveness of DSS oversight of contractors under FOCI we recommend that the Secretary of Defense direct the director of DSS to take the following three actions • collect and analyze data on contractors operating under all protective measures as well as changes in types and prevalence of foreign business transactions reported by contractors • collect aggregate and analyze the results of annual FOCI meetings contractors’ compliance reports and data from the counterintelligence community and • develop a plan to systematically review and evaluate the effectiveness of the FOCI process To better support industrial security representatives in overseeing contractors under FOCI we recommend the Secretary of Defense direct the director of DSS to formulate a human capital strategy and plan that would encompass the following two actions • evaluate the needs of representatives in carrying out their FOCI responsibilities and Page 16 GAO-05-681 Industrial Security • Agency Comments and Our Evaluation determine and implement changes needed to job requirements guidance and training to meet FOCI responsibilities and explore options for improving resource tools and knowledge-sharing efforts among representatives In commenting on a draft of our report DOD disagreed with our conclusions that improvements are needed to ensure sufficient oversight of contractors under FOCI and it also disagreed with our recommendations to improve oversight Overall DOD’s comments indicate that it believes that the actions DSS takes when it learns of FOCI at contractors is sufficient However DOD has not provided evidence necessary to support its assertions In fact we found two cases in which contractors appeared to have operated with unmitigated FOCI before protective measures were put into place Unmitigated FOCI at contractors increases the risk that foreign interests can gain unauthorized access to U S classified information Further DOD states that we did not establish a link between collecting and analyzing FOCI data and the effectiveness of DSS’s oversight or the protection of classified information We found that DSS lacks fundamental FOCI information—including information on the universe of FOCI contractors and trends in overall contractor compliance with protective measures—that is needed to determine the effectiveness of the FOCI process and the sufficiency of oversight Ultimately without making this determination DSS cannot adequately ensure it is taking necessary steps to reduce the risk of foreign interests gaining unauthorized access to classified information Unless our recommendations are implemented we are concerned that DSS will continue to operate on blind faith that its FOCI process is effective and its oversight is sufficient DOD did not concur with seven of our recommendations and only partially concurred with the eighth Regarding our first three recommendations which aim to improve DSS’s knowledge of the timing of foreign business transactions and reduce the risk of unauthorized foreign access to classified information DOD argues that having such information will not help protect classified information However as we noted in our report without this information DSS is not in a position to know when FOCI transactions occur so that timely protective measures can be implemented to mitigate FOCI as needed—the purpose of the FOCI process Regarding our next three recommendations which aim to enable DSS to assess the overall effectiveness of its oversight of contractors under FOCI DOD argues that it does not need to collect and analyze information on the Page 17 GAO-05-681 Industrial Security universe of contractors under FOCI and trends in foreign business transactions or aggregate compliance and counterintelligence information However without this information DSS limits its ability to identify vulnerabilities in the FOCI process and to target areas for improving oversight of contractors including potential changes to protective measures DOD also argues that it has three mechanisms to systematically evaluate DSS’s processes DSS’s Inspector General a management review process for industrial security field office oversight and a standards and quality program However DOD has not provided evidence in its comments that these mechanisms are focused on systematically reviewing and evaluating the effectiveness of the FOCI process Regarding our last two recommendations—to formulate a human capital strategy and plan that would better support industrial security representatives in overseeing FOCI contractors—DOD does not believe that its industrial security representatives need additional support DOD supports this belief with two points First DOD states that because less than 3 percent of the approximately 12 000 cleared companies overseen by DSS have any FOCI mitigation most DSS industrial security representatives do not oversee such contractors Yet it is unclear how DOD arrived at these figures because DSS does not collect and analyze information on all contactors operating under protective measures Regardless of the number of these contractors industrial security representatives must have adequate support—including training and guidance—to verify if contractors are under FOCI and to ensure contractors comply with any protective measures put in place In the course of our review we found that industrial security representatives are not sufficiently equipped to fulfill their FOCI responsibilities Second DOD noted that DSS is under new leadership and is exploring operational improvements as well as implementing a new industrial security information management system While it is too early to assess the effect of these proposals it is also unclear how these efforts will bring about any needed changes to industrial security representatives’ job requirements guidance tools and training As we concluded in our report DSS’s dependence on self-reported information from contractors about their foreign activities creates vulnerabilities outside of DSS’s control Given these vulnerabilities it is imperative that DSS improve the collection and analysis of key information on the FOCI process and provide its industrial security representatives with the training and tools they need to perform their FOCI responsibilities If DSS continues to operate without knowing how Page 18 GAO-05-681 Industrial Security effective its oversight is and does not support the representatives in carrying out their FOCI responsibilities then the value of DSS’s management and the FOCI process should be open for further examination Therefore we did not modify our recommendations DOD also provided technical comments which we addressed DOD’s letter is reprinted in appendix II along with our evaluation of its comments We are sending copies of this report to interested congressional committees the Secretary of Defense the Director Defense Security Service the Assistant to the President for National Security Affairs and the Director Office of Management and Budget We will make copies available to others upon request In addition this report will be available at no charge on the GAO Web site at http www gao gov If you have any questions about this report please contact me at 202 512-4841 Major contributors to this report are Anne-Marie Lasowski Maria Durant Ian A Ferguson Suzanne Sterling Kenneth E Patton Lily J Chin and Karen Sloan Ann Calvaresi-Barr Director Acquisition and Sourcing Management Page 19 GAO-05-681 Industrial Security Appendix I Scope and Methodology Appendix I Scope and Methodology To assess the Defense Security Service’s DSS process for determining and overseeing contractors under foreign ownership control or influence FOCI we reviewed Department of Defense DOD regulations and guidance on FOCI protective measures included in the National Industrial Security Program Operating Manual and the Industrial Security Operating Manual as well as DSS policies procedures and guidance for verifying contractors under FOCI and for overseeing them We discussed with DSS officials at headquarters and field locations how they use DSS guidance to oversee FOCI contractors We also discussed DSS roles and responsibilities for headquarters and field staff and challenges in overseeing contractors that report FOCI and the use of FOCI information to evaluate effectiveness of the process We reviewed DSS training materials to learn about the type of training DSS offers industrial security representatives in meeting their FOCI responsibilities We also examined FOCI studies conducted by DSS to determine the results of earlier DSS reviews of the FOCI process We visited nine field offices that varied in how many FOCI contractors they monitored and in their geographic location Through discussions with DSS officials at headquarters in Alexandria Virginia and from nine field offices we identified FOCI contractors operating under various protective measures and examined DSS actions to verify FOCI and oversee the implementation of protective measures at contractor facilities We collected information on a nonrepresentative sample of 27 contractor facility case files reviewed by DSS for FOCI In addition we visited 8 of the 27 contractor facilities and spoke with security officials corporate officers and board members to obtain additional clarification on the types of protective measures and the FOCI process We spoke with DSS headquarters and field staff regarding actions taken to implement protective measures and reviewed supporting documentation maintained by DSS and contractor facilities During our visits to nine field offices we discussed the contents of selected contractor facility file folders to understand how DSS oversees contractors’ implementation of protective measures determines unmitigated FOCI and assesses the effectiveness of the FOCI process Because we did not take a statistical sample of case files the results of our analyses cannot be generalized However we confirmed that the data used to select the files that we reviewed were consistent with the information in the facility files that we reviewed Page 20 GAO-05-681 Industrial Security Appendix II Comments from the Department of Defense Appendix II Comments from the Department of Defense GAO’s comments supplementing those in the report text appear at the end of this appendix See comment 1 See comment 2 See comment 3 Page 21 GAO-05-681 Industrial Security Appendix 11 Comments from the Department of Defense little in this report that would improve the FOCI process or justify the cost of implementation Thank you for the opportunity to comment on the report Sincerely Cou erintelligence and Security Attachment Comments to the GAO Recommendations on the GAO Draft Report dated June 10 2005 Page 22 GAO-05-681 Industrial Security Appendix II Comments from the Department of Defense See comment 4 See comment 5 Page 23 GAO-05-681 Industrial Security Appendix II Comments from the Department of Defense See comment 6 See comment 7 See comment 8 Page 24 GAO-05-681 Industrial Security Appendix II Comments from the Department of Defense See comment 9 See comment 10 See comment 4 See comment 11 Page 25 GAO-05-681 Industrial Security Appendix II Comments from the Department of Defense See comment 12 See comment 13 See comment 11 Page 26 GAO-05-681 Industrial Security Appendix II Comments from the Department of Defense See comment 14 Page 27 GAO-05-681 Industrial Security Appendix II Comments from the Department of Defense The following are GAO’s comments on the Department of Defense’s letter dated June 29 2005 GAO’s Comments 1 It is unclear how DOD came to the conclusion that our report lacks an understanding of the national policy governing contractors’ access to classified information given that our description of the policy and process in the background of our report is taken directly from documentation provided by DSS Further DOD did not provide in its technical comments any suggested amendments to remove perceived misunderstandings from our report 2 Cleared U S citizens need not break the law for foreign interests to gain unauthorized access to classified information or adversely affect performance of classified contracts Classified information can be at risk when foreign nationals at a cleared FOCI contractor facility are not identified and timely protective measures are not established to mitigate their influence 3 DOD’s position that there is little in our report that would enable DSS to improve the FOCI process or justify the cost of implementing our recommendations underscores the department’s failure to grasp the gravity of our findings DOD has neither systematically evaluated the effectiveness of its FOCI process nor identified opportunities to strengthen its oversight for contractors under FOCI Our recommendations specifically target correcting these weaknesses Further raising concerns about cost without evaluating the effectiveness of its FOCI process is shortsighted 4 According to the National Industrial Security Program Operating Manual contractors are required to report material changes to FOCI information previously reported and every 5 years even if no change occurs We added a footnote to further clarify the definition of foreign business transactions used in our report 5 DOD’s response concerning self-reporting underscores the department’s complacency regarding its responsibility to take actions needed to prevent foreign interests from gaining unauthorized access to U S classified information While we recognize that DSS is dependent on self-reporting and that some vulnerabilities are outside of DSS’s control there are numerous steps DOD could take to mitigate these vulnerabilities For example if DSS implemented our recommendation to clarify when reporting should occur and require reporting dates when specific foreign business transactions took place Page 28 GAO-05-681 Industrial Security Appendix II Comments from the Department of Defense then DSS could monitor whether contractors are reporting foreign transactions on time and put mitigation measures in place as appropriate 6 While DOD maintains that contractors are to report material changes concerning FOCI information as they occur we found that the National Industrial Security Program Operating Manual does not state this As we reported DSS field staff told us that while some contractors report transactions as they occur some do not report transactions until months later if at all Specifying a time frame for contractors could result in more timely reporting of these transactions 7 As we reported the FOCI process begins when a contractor reports FOCI information Having information on when foreign transactions occur would enable DSS to take timely action to impose safeguards or restrictions authorized by the National Industrial Security Program Operating Manual 8 Unmitigated FOCI at a cleared contractor increases the risk that foreign interests can gain unauthorized access to U S classified information During our review we found two cases in which contractors appeared to have operated with unmitigated FOCI before protective measures were put in place Therefore it is important to know the length of time between when a foreign transaction occurs and when protective measures are put in place to mitigate FOCI 9 According to the National Industrial Security Program Operating Manual a contractor under FOCI with an existing facility clearance shall have its clearance suspended or revoked unless protective measures are established to remove the possibility of unauthorized access to classified information or adversely affect performance on classified contracts DOD’s characterization of DSS having the option to suspend the clearance of contractors with unmitigated FOCI seems to differ from what is stated in the manual 10 It is unclear why DOD does not see the value in collecting information on contractors operating under all six protective measures when DSS already centrally collects information on contractors operating under three measures DSS cannot assess the overall effectiveness of its FOCI process unless it has a complete and accurate account of contractors operating under all types of protective measures 11 It is unclear how DOD determined that less than 3 percent of its cleared contractors are operating under all six protective measures because DSS does not centrally collect and analyze this information Page 29 GAO-05-681 Industrial Security Appendix II Comments from the Department of Defense for all six measures In addition the most recent information provided to us by DSS indicated that there are about 11 000 contractor facilities participating in the National Industrial Security Program rather than the 12 000 cited in DOD’s comments Further DOD did not provide technical comments to revise the number of contractor facilities stated in our report 12 Industrial security representatives may use the results of annual meetings compliance reports and counterintelligence data to assess an individual contractor’s security posture However as stated in our report DSS does not systematically compile and analyze trends from these oversight activities Aggregating overall compliance and counterintelligence trends is valuable because it would allow DSS to identify actual or potential weaknesses evaluate effectiveness and take actions as needed to improve its FOCI process 13 Citing how long the program has been in existence misses the point and DOD does not provide evidence that the needs of representatives are well known As we reported industrial security representatives face numerous challenges in carrying out their FOCI responsibilities which formulates the basis of our recommendation to evaluate the needs of the representatives Assessing their needs is particularly important given the increasingly complex environment—characterized by international cooperative defense programs and a growing number of cross-border defense industrial relationships—in which industrial security representatives work 14 As stated in our report industrial security representatives told us they lacked the training and knowledge they needed to verify complex FOCI cases and oversee contractors under FOCI 120348 Page 30 GAO-05-681 Industrial Security GAO’s Mission The Government Accountability Office the audit evaluation and investigative arm of Congress exists to support Congress in meeting its constitutional responsibilities and to help improve the performance and accountability of the federal government for the American people GAO examines the use of public funds evaluates federal programs and policies and provides analyses recommendations and other assistance to help Congress make informed oversight policy and funding decisions GAO’s commitment to good government is reflected in its core values of accountability integrity and reliability Obtaining Copies of GAO Reports and Testimony The fastest and easiest way to obtain copies of GAO documents at no cost is through GAO’s Web site www gao gov Each weekday GAO posts newly released reports testimony and correspondence on its Web site To have GAO e-mail you a list of newly posted products every afternoon go to www gao gov and select “Subscribe to Updates ” Order by Mail or Phone The first copy of each printed report is free Additional copies are $2 each A check or money order should be made out to the Superintendent of Documents GAO also accepts VISA and Mastercard Orders for 100 or more copies mailed to a single address are discounted 25 percent Orders should be sent to U S Government Accountability Office 441 G Street NW Room LM Washington D C 20548 To order by Phone Voice TDD Fax 202 512-6000 202 512-2537 202 512-6061 To Report Fraud Waste and Abuse in Federal Programs Contact Congressional Relations Gloria Jarmon Managing Director JarmonG@gao gov 202 512-4400 U S Government Accountability Office 441 G Street NW Room 7125 Washington D C 20548 Public Affairs Paul Anderson Managing Director AndersonP1@gao gov 202 512-4800 U S Government Accountability Office 441 G Street NW Room 7149 Washington D C 20548 Web site www gao gov fraudnet fraudnet htm E-mail fraudnet@gao gov Automated answering system 800 424-5454 or 202 512-7470 PRINTED ON RECYCLED PAPER