Export Control Compliance at University: GAO Calls for Improved Guidance

The US Government Accountability Office (GAO) published a report entitled "Export Controls: State and Commerce Should Improve Guidance and Outreach to Address University-Specific Compliance Issues."¹ While recognizing the increasing national security concerns involving foreign students and scholars at US universities, the GAO Report identifies certain challenges that universities face in export control compliance and recommends that US government enforcement agencies provide guidance that is more tailored to universities.

Based on its review, GAO concluded that most of the nine universities it visited have robust export compliance practices in the following four areas: (1) management commitment and organizational structure, (2) export authorization and tracking export-controlled items, (3) recordkeeping, and (4) reporting and addressing violations.² On the other hand, GAO concluded that some universities had weaknesses in the following four areas, among others: (1) risk assessment, (2) training, (3) internal audits, and (4) export compliance manuals.³

The GAO Report provides helpful insight both for universities to consider in targeting their focus for improvement, as well as on efforts the US government should undertake to improve the overall compliance posture of the academic community.

Increasing National Security Concerns at US Universities

Recent government reports and enforcement activities reflect a growing concern over unauthorized access to technology at US universities, with a particular focus on China. GAO cites to a 2019 white paper by the Federal Bureau of Investigation (FBI) and a September 2019 report from the Department of Defense (DOD), both of which concluded that foreign adversaries are increasingly seeking to exploit US technology through illicit and illegitimate means at US research universities.⁴ The GAO Report also provides statistics of foreign students and scholars at US universities, noting that nearly a third of foreign students at US universities are from China, many of whom study science, technology, engineering, or mathematics.⁵

This concern has prompted a number of investigations and enforcement actions that involve universities. For example, on May 4, 2020, top House Republicans announced a probe into Chinese efforts to "infiltrate" US colleges and sent a letter to Secretary of Education Betsy DeVos requesting information on Chinese investment in US colleges and universities.⁶ In so doing, the Members voiced concerns over, among others, China's "attempt to steal confidential information and technology."⁷

In addition, the US Department of Justice (DOJ) continues to bring enforcement actions seeking to limit Chinese influence at US universities. For example, on May 11, 2020, DOJ announced that it had arrested a professor at the University of Arkansas for allegedly failing to disclose his ties to the Chinese government and certain Chinese companies.⁸ Media reports also suggest that there are a large number of ongoing investigations by the FBI into Chinese access to US research at US colleges and universities.⁹

US Export Control Laws in the University Context

The US government controls the export of goods, technology and software from the United States through the International Traffic in Arms Regulations (ITAR),¹⁰ which are administered by the Directorate of Defense Trade Controls (DDTC) of the US Department of State, and the Export Administration Regulations (EAR),¹¹ which are administered by the Bureau of Industry and Security (BIS) of the US Department of Commerce. The ITAR regulates the export of military items, while the EAR regulates the export of commercial products more generally, including "dual-use" commercial items that have military as well as nonmilitary applications.

Certain items used in or produced by university research activities may be subject to US export controls. These export-controlled items may include tangible items, such as certain biological samples or research equipment, but may also include intangible items, such as technology, source code and software. Importantly, US export controls also apply to release of export-controlled items to a foreign national in the United States. Therefore, giving access to export-controlled items to a foreign student or scholar may qualify as "a deemed export" and require a license under the ITAR or the EAR.

That said, there are a number of exceptions that exclude certain items from control under the ITAR and the EAR. Of particular relevance in the university context, the following are not subject to the ITAR or the EAR: published information that is generally available to the public without restrictions,¹² "fundamental research,"¹³ and certain information that is taught in regular coursework at universities and other academic institutions.¹⁴

Existing Guidance and Agency Outreach Efforts: Mismatch for Universities

To help exporters better understand and comply with export control laws, both BIS and DDTC have developed a set of written guidance and they conduct outreach activities, such as training, presentations at conferences and site visits.¹⁵ However, the GAO Report notes that existing guidance and outreach efforts may not provide adequate guidance or support for university and academic settings.

In particular, the GAO Report notes that officials of universities and university associations, who were interviewed in connection with the report, expressed concerns that DDTC and BIS guidance and outreach programs do not address the issues that are most relevant in the university context.¹⁶ For example, some officials indicated that the focus of most DDTC and BIS guidance is on industry, which makes the guidance difficult to implement in the university context because universities are primarily focused on open and fundamental research, whereas companies are focused on developing proprietary technologies. Relatedly, some officials noted that it is difficult to explain the concept of "deemed export" or the applicability of export control laws in general to university researchers. In addition, four out of nine university officials interviewed stated that they rely on university associations, rather than DDTC or BIS, to develop a common understanding or interpretation of the applicable ITAR and EAR regulations for the university context.

University and university association officials noted that additional guidance on specific topics relevant to universities would be helpful. Examples of specific topics suggested include "deemed exports," "fundamental research," and university-specific export compliance. These officials also said that it would be helpful for DDTC and BIS to work with university associations to develop guidance for universities.

GAO also pointed out that DDTC's compliance guidance does not specifically include risk assessments.¹⁷ Although DDTC stated that risk assessment was not included because it "assumes that exporters conduct a risk assessment for each compliance element as a matter of course,"¹⁸ the GAO Report noted that this exclusion may result in lack of periodic risk assessments by exporters, including universities.

Export-Related Challenges Identified by Universities: Areas for Further Focus

In addition to those noted above, university and university association officials interviewed for the GAO Report also identified a unique set of challenges in working with and obtaining guidance from the US government agencies that fund some of their research and monitor national security threats to the United States, including DOD.

Inconsistent Reporting Requirements for Financial Conflicts of Interest. Various agencies that provide research funding to universities require that the recipient universities report potential financial conflicts of interest, such as ties to foreign governments. University and university association officials stated that federal agencies have different requirements for reporting financial and other conflict of interests.¹⁹ Because universities typically receive funding from multiple agencies, differing reporting requirements for conflicts of interest pose a particular challenge. In addition, differing requirements make it difficult for universities to develop a single compliance procedure and increase the likelihood of mistakes.

The relevant agencies are seeking to address this issue through an interagency working group called the Joint Committee on the Research Environment (JCORE). According to the GAO Report, JCORE has drafted guidance and guidelines for funding agencies and universities, which are currently under review and would help address this issue.

Lack of University-Specific Resources. University and university association officials also stated that there is a lack of university-specific resources on export control issues, and that existing resources are inadequate for application in the university context.²⁰ In particular, existing resources often incorporate classified information and materials, which cannot be shared with the broader university community. In addition, existing guidance and information do not address the university environment. University officials pointed to FBI threat briefings, specifically, as failing to address the university context.

To begin to address these concerns, DOD and FBI have partnered with academic institutions to alleviate the challenges on information sharing. For example, FBI, in partnership with the Academic Security and Counter Exploitation Program, has developed unclassified materials that can be shared with the wider university community.²¹

Inconsistent Interpretation of Regulations by DOD. University and university association officials also voiced concerns over inconsistent interpretation of export control regulations, including the apparent misunderstanding of the term "fundamental research" by DOD officials.²² For example, they stated that DOD officials have sought to include export control-related clauses in research-related contracts, when such clauses are not relevant to the contract and may even conflict with other terms of the contract. In addition, there is a concern over DOD's increasing inclusion of publication restrictions in research contracts for projects that universities believe are fundamental research (and, thus, would be subject to an exception under the export control regulations discussed above).

DOD acknowledged that some officials have inconsistently interpreted the export regulations, including the term "fundamental research," and that some program and contracting officers working on applied research contracts may not be sufficiently familiar with the concept of "fundamental research." DOD is trying to address this issue through its Office of Basic Research, which convened a workshop for basic research program officers in October 2019 and is planning on developing a checklist for program officers. However, the GAO Report notes that these actions may not be sufficient because they do not include efforts to educate contracting officers.

Conclusion

Based on its findings, GAO recommends that DDTC and BIS continue to provide more university-specific guidance and that DDTC include periodic risk assessment in its export control guidelines. In the meantime, the GAO Report also serves as notice to universities both that US enforcement agencies are working to improve outreach and guidance relevant to the academic context, but also that the US government is keenly focused on risks of export control violations by universities and unlikely to defer enforcement in the near term, whether or not GAO faults the agencies for insufficient guidance.

© Arnold & Porter Kaye Scholer LLP 2020 All Rights Reserved. This Advisory is intended to be a general summary of the law and does not constitute legal advice. You should consult with counsel to determine applicable legal requirements in a specific fact situation.