oversight

Export Controls: Implementation of the 1998 Legislative Mandate for High Performance Computers

Published by the Government Accountability Office on 1999-10-28.

Below is a raw (and likely hideous) rendition of the original report. (PDF)

                          United States General Accounting Office

GAO                       Testimony
                          Before the Committee on Armed Services, House of
                          Representatives




For Release on Delivery
Expected at
10:00 a.m., EDT
                          EXPORT CONTROLS
Thursday,
October 28, 1999

                          Implementation of the 1998
                          Legislative Mandate for
                          High Performance
                          Computers
                          Statement of Harold J. Johnson, Associate Director,
                          International Relations and Trade Issues, National Security
                          and International Affairs Division




GAO/T-NSIAD-00-53
          Mr. Chairman and Members of the Committee:

          We are pleased to be here to discuss our recent report on the export of high
          performance computers to countries of concern that might use the
          computers for military or nuclear proliferation purposes.1 In 1996, the
          executive branch removed licensing requirements for most exports of high
          performance computers to civilian end users but retained a licensing
          requirement for countries of concern. This change made exporters
          responsible for determining whether they needed to apply for an export
          license based on their knowledge of the end user’s activities. In 1997,
          several U.S. exporters shipped high performance computers to Russian
          nuclear weapons laboratories and to a military end user in China without
          licenses. Because the Congress believed that U.S. exporters may be
          unaware of end users’ activities, it included a provision in the fiscal year
          1998 National Defense Authorization Act (P.L. 105-85) requiring exporters
          to notify the Commerce Department of any proposed export of a high
          performance computer to countries of concern so that a determination
          could be made whether the export needed a license. Countries that pose
          such a concern include China, Russia, India, Pakistan, Israel, and Egypt.
          The act also requires Commerce to verify that high performance computers
          exported to countries of concern, regardless of whether a license was
          required, are being used by the appropriate end user.

          You asked us to determine whether (1) exporters’ notifications to
          Commerce of proposed sales of high performance computers to countries
          of concern have resulted in any license applications and what action was
          taken on these licenses and (2) Commerce is verifying the use of high
          performance computers after their export to these countries. I will briefly
          summarize our principal findings.



Summary   We found that most of the 938 proposed exports of high performance
          computers to civilian end users in countries of concern from February 3,
          1998, when procedures implementing the 1998 authorization act became
          effective, to March 19, 1999, did not require a license. The agencies that
          reviewed the exporters’ proposals—the Departments of Commerce,
          Energy, Defense, and State and, until March 1999, the Arms Control and
          Disarmament Agency—allowed 828 proposed high performance computer

          1
           Export Controls: 1998 Legislative Mandate for High Performance Computers
          (GAO/NSIAD-99-208, Sept. 24, 1999).




          Page 1                                                              GAO/T-NSIAD-00-53
exports to continue without a license, but they required license
applications for 101 proposed exports. Nine export proposals were
classified as “incomplete” and returned to the exporter. The majority of the
agencies’ objections to the 101 proposed exports were based on concerns
that the proposed end users of the computers might have been involved in
military or proliferation-related activities. Of the 101 license applications
required, 16 were approved and 6 were denied. The remaining 79 were
returned to the exporters without action, which essentially blocks the
proposed export. Licenses that were approved had additional conditions
placed on the reexport or end use of the computers. The majority of these
applications involved China, India, and Israel. Licenses were required in
nine cases where the end user had previously received computers without
a license before the Authorization Act was implemented.

The Act contains no time limit for the completion of post-shipment
verifications. As of November 17, 1998, Commerce had performed
post-shipment verifications of 104 exported high performance computers,
or 27 percent of the verifications required on the 390 high performance
computers exported during fiscal year 1998. In a report to Congress,
Commerce stated that all 104 post-shipment verifications were favorable;
that is, the computer had been seen during an on-site visit and nothing was
inconsistent with the license or license exceptions. However, a verification
conducted by Commerce but not yet completed detected the possible
diversion of two computers to a military end user in apparent violation of
U.S. export control regulations. The Commerce Department is investigating
these diversions.

Of the 286 high performance computer exports where post-shipment
verifications had not been completed, almost two-thirds (187) involve
exports to China. According to Commerce, the verifications have not been
done because China’s policy prior to June 1998 did not permit
post-shipment verifications, or the exports did not meet requirements
agreed upon in a June 1998 memorandum of understanding between the
Department of Commerce and China’s Ministry of Foreign Trade and
Economic Cooperation.

The Departments of Commerce, Energy, Defense, and State were provided
an opportunity to comment on our report. Energy did not comment and
State provided oral technical comments, which we incorporated in our
report. The Defense Department reviewed the report and had no
comments. Commerce said that the report did not acknowledge that it had
to divert enforcement resources from investigations and other preventive



Page 2                                                      GAO/T-NSIAD-00-53
             enforcement activities to conduct the legislatively mandated post-shipment
             verifications and that it would soon be impossible to perform the
             verifications mandated by law. Commerce also stated that most
             uncompleted verifications were in China and that 103 of 200 outside of
             China were completed. Although the 1998 Act requires post-shipment
             verifications on all high performance computers exported since November
             18, 1997, whether licensed or not, Commerce believes that it is futile to
             seek to verify the use of high performance computers exported to China
             before the end-use visit arrangement or without end-use certificates. This is
             particularly true in view of the proposed changes to control levels for
             exports military end users in countries of concern.

             The July 1999 announcement to change export control levels removed
             future licensing requirements for many high performance computers that
             have already been exported to China. Notwithstanding the new control
             levels established by the executive branch, the act requires Commerce to
             conduct post-shipment verifications on all licensed and unlicensed high
             performance computers at certain performance levels that are exported to
             countries of concern, including China.



Background   The legislation authorizes a 10-day period following notification for
             Commerce to circulate among the Departments of Defense, State, and
             Energy2 the exporters’ notifications of proposed exports of high
             performance computers (HPC). The act requires a license to export if any
             of these agencies raises a written objection to the export without a license.
             According to National Security Council guidance, agency objections are to
             state whether the proposed export represents a risk of diversion for a
             military or proliferation end use or to an end user of concern. If no
             objection is raised during the 10-day period, the exporter may ship the
             computers without a license. Exporters that plan to ship HPCs to users that
             are already known to be of military or proliferation concern must apply
             directly to Commerce for an export license; they do not need to go through
             the notification process.

             To indicate the level of concern the United States has with regard to the
             export of HPCs, the executive branch has organized countries into four


             2
              The Arms Control and Disarmament Agency also reviewed cases until March 31, 1999,
             when it was terminated as an independent entity and its arms control and nonproliferation
             functions were merged with the State Department.




             Page 3                                                                GAO/T-NSIAD-00-53
                           tiers. Each tier after tier 1 represents a successively higher level of concern
                           to U.S. security interests. (App. I contains a list of countries in the four
                           tiers.) Tier 3 contains 50 countries that are of concern for military or
                           proliferation reasons. The executive branch also established separate
                           control levels for different types of end-users in tier 3. For end users of
                           military or proliferation concern, the controls require a license to export
                           high performance computers that perform over 2,000 millions of
                           theoretical operations per second (MTOPS). For civilian end users in tier
                           3 countries, a license was required to export computers that perform over
                           7,000 MTOPS. For exports of HPCs performing between 2,000 and 7,000
                           MTOPS, an exporter could ship the computers without a license, provided
                           the exporter determined that the recipient was a civilian end user.3

                           The act also requires Commerce to perform post-shipment verifications in
                           tier 3 countries on the use of all licensed and unlicensed computers that
                           perform more than 2,000 MTOPS. This requirement applies to all high
                           performance computers exported from the United States on or after
                           November 18, 1997. Verifications confirm the physical location of the
                           computers and, to the extent practical, verify whether they are being used
                           as intended. The current legislative requirement to conduct verifications on
                           all computers performing over 2,000 MTOPS that were exported to
                           countries of concern is not affected by the July 1999 executive
                           announcement to raise export control levels.



The Legislation’s Effect   The responsible executive branch agencies objected to 101 of 938 the
                           notifications of proposed HPC export to tier 3 countries between February
on HPC Exports             3, 1998, and March 19, 1999.

                           Of the 101 objections raised regarding the proposed HPC exports, the Arms
                           Control and Disarmament Agency (ACDA) and the Department of Defense
                           submitted 59 and 55, respectively; the State Department submitted 14; and
                           Commerce submitted 3. The Department of Energy raised no objections.



                           3
                            In July 1999, the executive branch further revised licensing levels for tier 3 countries and
                           reported these changes to Congress. The level for civilian end users was raised from 7,000
                           MTOPS to 12,300 MTOPS, effective immediately, and for military end users from 2,000
                           MTOPS to 6,500 MTOPS, effective in 6 months. The executive branch also raised the
                           National Defense Authorization Act notification levels from 2,000 MTOPS to 6,500 MTOPS.
                           By law, this change will take effect 6 months after the executive branch reports the changes
                           to Congress.




                           Page 4                                                                   GAO/T-NSIAD-00-53
                      According to Commerce, an agency will often not object if an objection has
                      already been raised by another agency.

                      The majority of the objections were based on concerns that the proposed
                      end users of the HPCs might have been involved in some military or
                      proliferation-related activity. This was particularly evident in ACDA’s
                      objections to telecommunications end users in China. Of ACDA’s
                      59 objections, 39 were for exports to China and 29 of those involved
                      telecommunications end users, which, according to ACDA officials, have
                      close ties with China’s military. The HPCs could therefore contribute to the
                      military’s command and control capability. The Defense Department had
                      similar concerns with several other civil entities in China about the risk of
                      diversion of HPCs to military end users and uses.

                      During the review process, objections were made to nine proposed HPC
                      exports to end users that had previously received HPCs without a license.4
                      Of the nine proposed exports, four were for end users in China, four were
                      for India, and one was for Israel. The agencies raised objections on the four
                      proposed HPC exports to China based on their potential diversion from
                      telecommunication and university end users for military and proliferation-
                      related activities. Objections to the four proposed HPC exports to India
                      were based on the sanctions imposed due to proliferation concerns. One
                      objection to a proposed HPC export to Israel involved an Israeli university
                      that might have had connections to proliferation-related activities.
                      Commerce approved a license for one export and returned the remaining
                      eight applications to the exporters without action.



Implementation of     Section 1213 of the legislation requires the Secretary of Commerce to
                      conduct post-shipment verifications (PSV) on each HPC performing over
Post-Shipment         2,000 MTOPS exported from the United States to a tier 3 country, whether
Verifications Is      licensed or unlicensed, on or after the date of the statute’s enactment,
Incomplete and Has
Several Limitations


                      4
                       These HPC exports, completed prior to the legislatively mandated review procedures, did
                      not require a license under the regulations at that time if the HPC performed between 2,000
                      and 7,000 MTOPS and if the exporter believed the HPC was going to a civilian end user.




                      Page 5                                                                 GAO/T-NSIAD-00-53
which was November 18, 1997.5 The PSVs confirm the physical location of
the HPC and, to the extent practical, verify whether it is being used as
intended. However, there are limitations to determining end use. While the
legislation contains no time limit for completing PSVs, Commerce has
completed PSVs on 104 HPC exports, or about 27 percent of those
verifications required for the HPCs exported during fiscal year 1998.
Commerce reported that all 104 PSVs were favorable. However, a PSV
conducted by Commerce that has yet to be completed detected the
possible diversion of two computers to a military end user, in apparent
violation of U.S. export control regulations. The Commerce Department is
investigating these possible diversions.

The Commerce Department uses U.S. personnel from its Bureau of Export
Administration or its U.S. and Foreign Commercial Service officers located
at U.S. embassies and consulates to conduct legislatively mandated
post-shipment verifications of the use of HPCs. Export Administration
teams, which typically comprise two agents, go to a country or a group of
countries for a 2- to 3-week period to conduct PSVs and pre-license checks
and to meet with businesses to educate them on U.S. export control
regulations. During fiscal year 1998, Export Administration teams took two
trips to Russia, one trip each to Israel and Egypt, and one trip to India to
conduct PSVs. No trips were made to China. Commerce’s guidelines
instruct the PSV officials to determine

• what the serial number of the HPC is and, if possible, whether the
  machine has been upgraded;
• what the location of the HPC is, including a complete address, telephone
  number, fax number, and the name of a contact person, if the HPC has
  been resold or retransferred;
• whether the HPC is being used in a manner consistent with the stated
  purpose;
• whether anyone has remote access to the computer and, if so, who does
  and for what purpose;
• whether the HPC is located in a secure area and whether the level of
  security seems consistent with the function performed or seems overly
  strict for a commercial facility; and



5
 The July 1, 1999, revision of licensing levels does not affect the act’s requirement to conduct
post-shipment verifications on all exported computers performing over 2,000 MTOPS
exported to tier 3 countries.




Page 6                                                                     GAO/T-NSIAD-00-53
• whether any activities seem inconsistent with the stated end-use,
  including indications of ownership or operations by a military
  organization or involvement of an organization in the design,
  manufacture, storage, use, or testing of nuclear, chemical, or biological
  weapons.

When conducting a PSV, officials confirm that the computer has arrived at
the intended location and either qualifies for a license exception (if it has
been exported without a license) or is being used under the terms of the
license. According to an Export Administration official, a favorable PSV
means that an HPC has been seen during an on-site visit and that nothing
was inconsistent with the license or the license exception. An unfavorable
PSV means that an inconsistency was found between the actual end use
and the end-use intended for the export. The Export Administration’s
Office of Export Enforcement may investigate the inconsistency,
depending on its seriousness.


Mr. Chairman, this concludes my prepared testimony. I would be happy to
respond to any questions you or other members may have.

Contacts and Acknowledgments

For further information regarding this testimony, please contact Jim
Johnson at 512-3540. Individuals making key contributions to this
testimony were Jim Shafer, Charles Bolton and Jason Fong.




Page 7                                                       GAO/T-NSIAD-00-53
Appendix I

Licensing Requirements for High Performance
Computer Exports, by Country Group                                                                 Appendix
                                                                                                          I




                     Four country groups and licensing requirements have been established for
                     high performance computer exports, as follows:

                     • Tier 1 (32 countries: Western Europe, Eastern Europe, Japan , Canada,
                       Mexico, Brazil, Australia, New Zealand). No prior government review
                       (license exception) for all computers, but companies must keep records
                       on higher performance shipments that will be provided to the U.S.
                       government, as directed.
                     • Tier 2 (102 countries: Latin American, South Korea, Association of
                       Southeast Asian Nations, or ASEAN; Slovak Republic; Slovenia; South
                       Africa). No prior government review (license exception) for computers
                       performing up to 20,000 MTOPS, with record-keeping and reporting as
                       directed; individual license (requiring prior government review) for
                       computers performing above 20,000 MTOPS.
                     • Tier 3 (50 countries: India, Pakistan, all Middle East/Maghreb, the
                       former Soviet Union, China, Vietnam, rest of Eastern Europe). No prior
                       government review (license exception) for computers performing up to
                       2,000 MTOPS. Individual license for military and proliferation-related
                       end uses and users and license exception for civilian end users for
                       computers performing between 2,000 MTOPS and 7,000 MTOPS, with
                       exporter record-keeping and reporting as directed. Individual license for
                       all end users for computers performing above 7,000 MTOPS. Above
                       10,000 MTOPS, additional safeguards may be required at the end-user
                       location.
                     • Tier 4 (7 countries: Iraq, Iran, Libya, North Korea, Cuba, Sudan, and
                       Syria). Current policies continue to apply (i.e., virtual embargo on
                       computer exports).

                     For all these groups, reexport and retransfer provisions continue to apply.
                     The government continues to implement the Enhanced Proliferation
                     Control Initiative, which authorizes the government to block exports of
                     computers of any level in cases involving exports for end uses or to end
                     users of proliferation concern or risks of diversion to proliferation
                     activities. Criminal as well as civil penalties apply to violators of the
                     initiative.




(711464)     Leter   Page 8                                                     GAO/T-NSIAD-00-53
Ordering Information

The first copy of each GAO report and testimony is free.
Additional copies are $2 each. Orders should be sent to the
following address, accompanied by a check or money order made
out to the Superintendent of Documents, when necessary, VISA and
MasterCard credit cards are accepted, also.

Orders for 100 or more copies to be mailed to a single address are
discounted 25 percent.

Orders by mail:

U.S. General Accounting Office
P.O. Box 37050
Washington, DC 20013

or visit:

Room 1100
700 4th St. NW (corner of 4th and G Sts. NW)
U.S. General Accounting Office
Washington, DC

Orders may also be placed by calling (202) 512-6000
or by using fax number (202) 512-6061, or TDD (202) 512-2537.

Each day, GAO issues a list of newly available reports and
testimony. To receive facsimile copies of the daily list or any list
from the past 30 days, please call (202) 512-6000 using a touchtone
phone. A recorded menu will provide information on how to obtain
these lists.

For information on how to access GAO reports on the INTERNET,
send an e-mail message with “info” in the body to:

info@www.gao.gov

or visit GAO’s World Wide Web Home Page at:

http://www.gao.gov
United States                       Bulk Mail
General Accounting Office      Postage & Fees Paid
Washington, D.C. 20548-0001           GAO
                                 Permit No. GI00
Official Business
Penalty for Private Use $300

Address Correction Requested