United States General Accounting Office GAO Testimony Before the Committee on Armed Services, House of Representatives For Release on Delivery Expected at 10:00 a.m., EDT EXPORT CONTROLS Thursday, October 28, 1999 Implementation of the 1998 Legislative Mandate for High Performance Computers Statement of Harold J. Johnson, Associate Director, International Relations and Trade Issues, National Security and International Affairs Division GAO/T-NSIAD-00-53 Mr. Chairman and Members of the Committee: We are pleased to be here to discuss our recent report on the export of high performance computers to countries of concern that might use the computers for military or nuclear proliferation purposes.1 In 1996, the executive branch removed licensing requirements for most exports of high performance computers to civilian end users but retained a licensing requirement for countries of concern. This change made exporters responsible for determining whether they needed to apply for an export license based on their knowledge of the end user’s activities. In 1997, several U.S. exporters shipped high performance computers to Russian nuclear weapons laboratories and to a military end user in China without licenses. Because the Congress believed that U.S. exporters may be unaware of end users’ activities, it included a provision in the fiscal year 1998 National Defense Authorization Act (P.L. 105-85) requiring exporters to notify the Commerce Department of any proposed export of a high performance computer to countries of concern so that a determination could be made whether the export needed a license. Countries that pose such a concern include China, Russia, India, Pakistan, Israel, and Egypt. The act also requires Commerce to verify that high performance computers exported to countries of concern, regardless of whether a license was required, are being used by the appropriate end user. You asked us to determine whether (1) exporters’ notifications to Commerce of proposed sales of high performance computers to countries of concern have resulted in any license applications and what action was taken on these licenses and (2) Commerce is verifying the use of high performance computers after their export to these countries. I will briefly summarize our principal findings. Summary We found that most of the 938 proposed exports of high performance computers to civilian end users in countries of concern from February 3, 1998, when procedures implementing the 1998 authorization act became effective, to March 19, 1999, did not require a license. The agencies that reviewed the exporters’ proposals—the Departments of Commerce, Energy, Defense, and State and, until March 1999, the Arms Control and Disarmament Agency—allowed 828 proposed high performance computer 1 Export Controls: 1998 Legislative Mandate for High Performance Computers (GAO/NSIAD-99-208, Sept. 24, 1999). Page 1 GAO/T-NSIAD-00-53 exports to continue without a license, but they required license applications for 101 proposed exports. Nine export proposals were classified as “incomplete” and returned to the exporter. The majority of the agencies’ objections to the 101 proposed exports were based on concerns that the proposed end users of the computers might have been involved in military or proliferation-related activities. Of the 101 license applications required, 16 were approved and 6 were denied. The remaining 79 were returned to the exporters without action, which essentially blocks the proposed export. Licenses that were approved had additional conditions placed on the reexport or end use of the computers. The majority of these applications involved China, India, and Israel. Licenses were required in nine cases where the end user had previously received computers without a license before the Authorization Act was implemented. The Act contains no time limit for the completion of post-shipment verifications. As of November 17, 1998, Commerce had performed post-shipment verifications of 104 exported high performance computers, or 27 percent of the verifications required on the 390 high performance computers exported during fiscal year 1998. In a report to Congress, Commerce stated that all 104 post-shipment verifications were favorable; that is, the computer had been seen during an on-site visit and nothing was inconsistent with the license or license exceptions. However, a verification conducted by Commerce but not yet completed detected the possible diversion of two computers to a military end user in apparent violation of U.S. export control regulations. The Commerce Department is investigating these diversions. Of the 286 high performance computer exports where post-shipment verifications had not been completed, almost two-thirds (187) involve exports to China. According to Commerce, the verifications have not been done because China’s policy prior to June 1998 did not permit post-shipment verifications, or the exports did not meet requirements agreed upon in a June 1998 memorandum of understanding between the Department of Commerce and China’s Ministry of Foreign Trade and Economic Cooperation. The Departments of Commerce, Energy, Defense, and State were provided an opportunity to comment on our report. Energy did not comment and State provided oral technical comments, which we incorporated in our report. The Defense Department reviewed the report and had no comments. Commerce said that the report did not acknowledge that it had to divert enforcement resources from investigations and other preventive Page 2 GAO/T-NSIAD-00-53 enforcement activities to conduct the legislatively mandated post-shipment verifications and that it would soon be impossible to perform the verifications mandated by law. Commerce also stated that most uncompleted verifications were in China and that 103 of 200 outside of China were completed. Although the 1998 Act requires post-shipment verifications on all high performance computers exported since November 18, 1997, whether licensed or not, Commerce believes that it is futile to seek to verify the use of high performance computers exported to China before the end-use visit arrangement or without end-use certificates. This is particularly true in view of the proposed changes to control levels for exports military end users in countries of concern. The July 1999 announcement to change export control levels removed future licensing requirements for many high performance computers that have already been exported to China. Notwithstanding the new control levels established by the executive branch, the act requires Commerce to conduct post-shipment verifications on all licensed and unlicensed high performance computers at certain performance levels that are exported to countries of concern, including China. Background The legislation authorizes a 10-day period following notification for Commerce to circulate among the Departments of Defense, State, and Energy2 the exporters’ notifications of proposed exports of high performance computers (HPC). The act requires a license to export if any of these agencies raises a written objection to the export without a license. According to National Security Council guidance, agency objections are to state whether the proposed export represents a risk of diversion for a military or proliferation end use or to an end user of concern. If no objection is raised during the 10-day period, the exporter may ship the computers without a license. Exporters that plan to ship HPCs to users that are already known to be of military or proliferation concern must apply directly to Commerce for an export license; they do not need to go through the notification process. To indicate the level of concern the United States has with regard to the export of HPCs, the executive branch has organized countries into four 2 The Arms Control and Disarmament Agency also reviewed cases until March 31, 1999, when it was terminated as an independent entity and its arms control and nonproliferation functions were merged with the State Department. Page 3 GAO/T-NSIAD-00-53 tiers. Each tier after tier 1 represents a successively higher level of concern to U.S. security interests. (App. I contains a list of countries in the four tiers.) Tier 3 contains 50 countries that are of concern for military or proliferation reasons. The executive branch also established separate control levels for different types of end-users in tier 3. For end users of military or proliferation concern, the controls require a license to export high performance computers that perform over 2,000 millions of theoretical operations per second (MTOPS). For civilian end users in tier 3 countries, a license was required to export computers that perform over 7,000 MTOPS. For exports of HPCs performing between 2,000 and 7,000 MTOPS, an exporter could ship the computers without a license, provided the exporter determined that the recipient was a civilian end user.3 The act also requires Commerce to perform post-shipment verifications in tier 3 countries on the use of all licensed and unlicensed computers that perform more than 2,000 MTOPS. This requirement applies to all high performance computers exported from the United States on or after November 18, 1997. Verifications confirm the physical location of the computers and, to the extent practical, verify whether they are being used as intended. The current legislative requirement to conduct verifications on all computers performing over 2,000 MTOPS that were exported to countries of concern is not affected by the July 1999 executive announcement to raise export control levels. The Legislation’s Effect The responsible executive branch agencies objected to 101 of 938 the notifications of proposed HPC export to tier 3 countries between February on HPC Exports 3, 1998, and March 19, 1999. Of the 101 objections raised regarding the proposed HPC exports, the Arms Control and Disarmament Agency (ACDA) and the Department of Defense submitted 59 and 55, respectively; the State Department submitted 14; and Commerce submitted 3. The Department of Energy raised no objections. 3 In July 1999, the executive branch further revised licensing levels for tier 3 countries and reported these changes to Congress. The level for civilian end users was raised from 7,000 MTOPS to 12,300 MTOPS, effective immediately, and for military end users from 2,000 MTOPS to 6,500 MTOPS, effective in 6 months. The executive branch also raised the National Defense Authorization Act notification levels from 2,000 MTOPS to 6,500 MTOPS. By law, this change will take effect 6 months after the executive branch reports the changes to Congress. Page 4 GAO/T-NSIAD-00-53 According to Commerce, an agency will often not object if an objection has already been raised by another agency. The majority of the objections were based on concerns that the proposed end users of the HPCs might have been involved in some military or proliferation-related activity. This was particularly evident in ACDA’s objections to telecommunications end users in China. Of ACDA’s 59 objections, 39 were for exports to China and 29 of those involved telecommunications end users, which, according to ACDA officials, have close ties with China’s military. The HPCs could therefore contribute to the military’s command and control capability. The Defense Department had similar concerns with several other civil entities in China about the risk of diversion of HPCs to military end users and uses. During the review process, objections were made to nine proposed HPC exports to end users that had previously received HPCs without a license.4 Of the nine proposed exports, four were for end users in China, four were for India, and one was for Israel. The agencies raised objections on the four proposed HPC exports to China based on their potential diversion from telecommunication and university end users for military and proliferation- related activities. Objections to the four proposed HPC exports to India were based on the sanctions imposed due to proliferation concerns. One objection to a proposed HPC export to Israel involved an Israeli university that might have had connections to proliferation-related activities. Commerce approved a license for one export and returned the remaining eight applications to the exporters without action. Implementation of Section 1213 of the legislation requires the Secretary of Commerce to conduct post-shipment verifications (PSV) on each HPC performing over Post-Shipment 2,000 MTOPS exported from the United States to a tier 3 country, whether Verifications Is licensed or unlicensed, on or after the date of the statute’s enactment, Incomplete and Has Several Limitations 4 These HPC exports, completed prior to the legislatively mandated review procedures, did not require a license under the regulations at that time if the HPC performed between 2,000 and 7,000 MTOPS and if the exporter believed the HPC was going to a civilian end user. Page 5 GAO/T-NSIAD-00-53 which was November 18, 1997.5 The PSVs confirm the physical location of the HPC and, to the extent practical, verify whether it is being used as intended. However, there are limitations to determining end use. While the legislation contains no time limit for completing PSVs, Commerce has completed PSVs on 104 HPC exports, or about 27 percent of those verifications required for the HPCs exported during fiscal year 1998. Commerce reported that all 104 PSVs were favorable. However, a PSV conducted by Commerce that has yet to be completed detected the possible diversion of two computers to a military end user, in apparent violation of U.S. export control regulations. The Commerce Department is investigating these possible diversions. The Commerce Department uses U.S. personnel from its Bureau of Export Administration or its U.S. and Foreign Commercial Service officers located at U.S. embassies and consulates to conduct legislatively mandated post-shipment verifications of the use of HPCs. Export Administration teams, which typically comprise two agents, go to a country or a group of countries for a 2- to 3-week period to conduct PSVs and pre-license checks and to meet with businesses to educate them on U.S. export control regulations. During fiscal year 1998, Export Administration teams took two trips to Russia, one trip each to Israel and Egypt, and one trip to India to conduct PSVs. No trips were made to China. Commerce’s guidelines instruct the PSV officials to determine • what the serial number of the HPC is and, if possible, whether the machine has been upgraded; • what the location of the HPC is, including a complete address, telephone number, fax number, and the name of a contact person, if the HPC has been resold or retransferred; • whether the HPC is being used in a manner consistent with the stated purpose; • whether anyone has remote access to the computer and, if so, who does and for what purpose; • whether the HPC is located in a secure area and whether the level of security seems consistent with the function performed or seems overly strict for a commercial facility; and 5 The July 1, 1999, revision of licensing levels does not affect the act’s requirement to conduct post-shipment verifications on all exported computers performing over 2,000 MTOPS exported to tier 3 countries. Page 6 GAO/T-NSIAD-00-53 • whether any activities seem inconsistent with the stated end-use, including indications of ownership or operations by a military organization or involvement of an organization in the design, manufacture, storage, use, or testing of nuclear, chemical, or biological weapons. When conducting a PSV, officials confirm that the computer has arrived at the intended location and either qualifies for a license exception (if it has been exported without a license) or is being used under the terms of the license. According to an Export Administration official, a favorable PSV means that an HPC has been seen during an on-site visit and that nothing was inconsistent with the license or the license exception. An unfavorable PSV means that an inconsistency was found between the actual end use and the end-use intended for the export. The Export Administration’s Office of Export Enforcement may investigate the inconsistency, depending on its seriousness. Mr. Chairman, this concludes my prepared testimony. I would be happy to respond to any questions you or other members may have. Contacts and Acknowledgments For further information regarding this testimony, please contact Jim Johnson at 512-3540. Individuals making key contributions to this testimony were Jim Shafer, Charles Bolton and Jason Fong. Page 7 GAO/T-NSIAD-00-53 Appendix I Licensing Requirements for High Performance Computer Exports, by Country Group Appendix I Four country groups and licensing requirements have been established for high performance computer exports, as follows: • Tier 1 (32 countries: Western Europe, Eastern Europe, Japan , Canada, Mexico, Brazil, Australia, New Zealand). No prior government review (license exception) for all computers, but companies must keep records on higher performance shipments that will be provided to the U.S. government, as directed. • Tier 2 (102 countries: Latin American, South Korea, Association of Southeast Asian Nations, or ASEAN; Slovak Republic; Slovenia; South Africa). No prior government review (license exception) for computers performing up to 20,000 MTOPS, with record-keeping and reporting as directed; individual license (requiring prior government review) for computers performing above 20,000 MTOPS. • Tier 3 (50 countries: India, Pakistan, all Middle East/Maghreb, the former Soviet Union, China, Vietnam, rest of Eastern Europe). No prior government review (license exception) for computers performing up to 2,000 MTOPS. Individual license for military and proliferation-related end uses and users and license exception for civilian end users for computers performing between 2,000 MTOPS and 7,000 MTOPS, with exporter record-keeping and reporting as directed. Individual license for all end users for computers performing above 7,000 MTOPS. Above 10,000 MTOPS, additional safeguards may be required at the end-user location. • Tier 4 (7 countries: Iraq, Iran, Libya, North Korea, Cuba, Sudan, and Syria). Current policies continue to apply (i.e., virtual embargo on computer exports). For all these groups, reexport and retransfer provisions continue to apply. The government continues to implement the Enhanced Proliferation Control Initiative, which authorizes the government to block exports of computers of any level in cases involving exports for end uses or to end users of proliferation concern or risks of diversion to proliferation activities. Criminal as well as civil penalties apply to violators of the initiative. (711464) Leter Page 8 GAO/T-NSIAD-00-53 Ordering Information The first copy of each GAO report and testimony is free. Additional copies are $2 each. Orders should be sent to the following address, accompanied by a check or money order made out to the Superintendent of Documents, when necessary, VISA and MasterCard credit cards are accepted, also. Orders for 100 or more copies to be mailed to a single address are discounted 25 percent. Orders by mail: U.S. General Accounting Office P.O. Box 37050 Washington, DC 20013 or visit: Room 1100 700 4th St. NW (corner of 4th and G Sts. NW) U.S. General Accounting Office Washington, DC Orders may also be placed by calling (202) 512-6000 or by using fax number (202) 512-6061, or TDD (202) 512-2537. Each day, GAO issues a list of newly available reports and testimony. To receive facsimile copies of the daily list or any list from the past 30 days, please call (202) 512-6000 using a touchtone phone. A recorded menu will provide information on how to obtain these lists. For information on how to access GAO reports on the INTERNET, send an e-mail message with “info” in the body to: email@example.com or visit GAO’s World Wide Web Home Page at: http://www.gao.gov United States Bulk Mail General Accounting Office Postage & Fees Paid Washington, D.C. 20548-0001 GAO Permit No. GI00 Official Business Penalty for Private Use $300 Address Correction Requested
Export Controls: Implementation of the 1998 Legislative Mandate for High Performance Computers
Published by the Government Accountability Office on 1999-10-28.
Below is a raw (and likely hideous) rendition of the original report. (PDF)