Military Secrets Leak From U.S. Universities With Rules Flouted
April 30 (Bloomberg) -- For 15 days in late 2009, Internet users in 36 countries, including China, Russia, Iran and Pakistan, viewed sensitive information about U.S. weapons technology that was supposed to be for American eyes only.
The disclosure, which prompted a rebuke from a U.S. State Department official, came from a Georgia Institute of Technology course for federal employees and contractors on infrared technology used in weapons-aiming systems for aircraft, ships and tanks. Asked by instructor David Schmieder to copy the course onto a DVD, Georgia Tech's media staff instead uploaded it to servers.
"I completely forgot the course's access was restricted," Media Quality Control Supervisor Edward Bailey told university investigators, according to documents obtained from Georgia Tech through a public-records request.
The lapse by Atlanta-based Georgia Tech illustrates how colleges and federal arms-control regulators are often lax in enforcing Americans-only limits intended to prevent theft of military technology from U.S. campuses. Even as they enroll more graduate students from countries such as China and Iran, universities are conducting more research that is restricted to American citizens and permanent residents because of its national-security implications. Foreign governments are targeting universities to "obtain restricted information or products," the FBI said in a 2011 report.
Culture of Openness
Eager to preserve their culture of openness and global collaboration, campuses are skirting -- and even flouting -- export-control laws that require foreigners to hold government licenses to work on sensitive projects.
Using unlicensed foreign students on export-controlled projects "happens all the time," said Michael Deal, an international trade lawyer in Arlington, Virginia, and a former official at the U.S. Commerce Department, which regulates technology that has both civilian and military applications. "The academic world is completely undisciplined about it. Its casual approach has undoubtedly led to the erosion of the U.S. competitive advantage."
Basic research is open to people of any nationality. Classified work, such as electronic counter-measures that jam enemy radar, requires all participants to have security clearances. Export controls -- over, for example, developing trucks with extra protection against mines and explosives -- occupy a middle ground. They exempt fundamental research that is ordinarily publishable or already in the public domain, as well as courses that are widely taught and in the academic catalog.
Cumbersome Controls
Universities, which blocked a 2004 proposal to expand export controls, are now backing an Obama administration initiative to streamline them. They say that outmoded, cumbersome controls damage America's economic competitiveness and discriminate against foreign students. Stanford University and the University of California don't accept restricted contracts.
"I don't think people consider how many brilliant people come to the U.S. as foreign students and stay here," said William Wulf, a professor at the University of Virginia, and former chairman of the Computer Science and Telecommunications Board of the National Research Council. "Roughly 30 percent of the startup companies in Silicon Valley are started by somebody who was a foreign student."
While export-control violators are subject to imprisonment or fines, the federal government rarely goes after universities. Rather than investigate violations, the government depends on universities to disclose them. Once they do, it usually lets them off with a warning.
'Voluntary Compliance'
Enforcement "is grounded in voluntary compliance, in essence an honor system, on the part of the academic community," according to a 2009 court filing by the U.S. Justice Department. "Neither any government agency nor any university has the ability, resources or manpower to audit and supervise every government-funded export-controlled project being conducted in an academic setting."
The number of voluntary disclosures by industry and academia is increasing 10 percent a year, said a State Department official, who asked not to be named. The State Department administers the International Traffic in Arms Regulations (ITAR), which govern export of military items and information.
"We respond to voluntary reports and other information," the official said. "We don't go out and knock on doors. We're not out here to burn people. We say, 'Go forth and sin no more.' Would you prefer me to go after an inadvertent disclosure to a U.K. student or arms shipping to a narco-trafficker?"
Must Have License
Before a foreign national can participate in export- controlled research, the university must first obtain a license from the government. If the student comes from any of about 20 countries, the State Department normally denies the license application. That list includes countries subject to an arms embargo, such as China, as well as five nations that the U.S. regards as sponsors of terrorism, such as Iran and Syria. Students from those five are generally ineligible for Commerce licenses too.
Licenses are usually granted for students from most other countries. Commerce approved 93 percent of applications in fiscal 2010 for "deemed export" licenses, of which almost 60 percent came from companies or universities wanting to release controlled technology to Chinese nationals.
Mistake Acknowledged
Georgia Tech didn't tell the State Department for almost six months about the Internet linking of the infrared-technology course. The university then sought to minimize the breach by citing an assurance from an Army official that much of the information had been approved for public release. When the official denied making this statement, Georgia Tech filed a corrected report acknowledging the mistake. Still, the State Department, which reproved Georgia Tech for "serious violations," didn't seek penalties.
Tensions between law enforcement and academia over balancing national security with the global pursuit of knowledge came into focus in the case of University of Tennessee professor J. Reece Roth, a 74-year-old plasma technology innovator and a graduate of the Massachusetts Institute of Technology, who began serving a four-year prison sentence in January for conspiracy and violating the Arms Export Control Act.
Working with Knoxville-based Atmospheric Glow Technologies Inc., Roth used a Chinese and an Iranian graduate student --both unlicensed -- on an export-controlled Air Force contract to develop plasma actuators to guide the flight of unmanned aircraft. Disregarding a warning by Robin Witherspoon, then the university's export-control officer, Roth took a laptop computer containing export-restricted files to China, and had the Chinese student e-mail him research information.
Tennessee Case
University officials contacted federal authorities. Atmospheric Glow Technologies pleaded guilty to 10 counts of export control violations and cooperated in the investigation. The university wasn't prosecuted because it didn't know of or condone Roth's actions and disclosed them to the FBI once they came to light, said Assistant U.S. Attorney Will Mackie.
When FBI investigators questioned Roth, he told them that the university's policy of non-discrimination against foreign students "would essentially trump" export controls, an FBI agent testified at Roth's 2008 trial.
"His opinion stated to us was in essence that perhaps we should not have export controls," the agent said.
While he doesn't "necessarily believe" that university policy takes precedence over government regulation, he does think that "academic freedom and research is going to be severely impacted" by his prosecution, Roth testified. He criticized FBI tactics such as having the Chinese student secretly record a conversation with him, and said Congress should re-examine export controls.
Doctoral Degrees
"This contention that any export-controlled information must not go out of the country is going to make it virtually impossible for scholars to take their laptops out of the United States," Roth said.
Roth testified that foreigners made up "probably about 60 percent to 70 percent" of graduate students in electrical engineering and computer science at the University of Tennessee. In 2010, 54 percent of U.S. doctoral degrees in engineering were awarded to non-resident aliens, according to the Washington- based American Society for Engineering Education. Foreigners on temporary visas made up 46 percent of science and engineering graduate students at Georgia Tech, according to a federal survey.
China sent 76,830 graduate students to U.S. universities in 2010-2011, more than any other country and up almost 16 percent from the prior year, according to the Institute of International Education in New York. Iran ranked sixth with 4,696 graduate students, a 24 percent increase.
103 Iranians
Even as their laboratories depend on foreign graduate students, universities are escalating U.S.-only research. The University of Illinois at Urbana-Champaign has 103 graduate students from Iran alone, including 21 in computer science. Foreigners on temporary visas made up almost 60 percent of Illinois graduate students in computer science in 2009, according to a federal survey.
At the same time, Illinois ramped up to between 90 and 100 export-controlled research projects this year, generating $50 million in revenue, a fivefold increase in five years, said Howard Guenther, associate vice chancellor for research. "We've had an explosion in the number of programs" requiring foreigners to be licensed, partly because the government is funding more ITAR-controlled projects, he said.
Illinois has beefed up export-control staff to review contracts, negotiate with funders, and train researchers, Guenther said. It hasn't had any violations, he said.
'A Challenge'
Export-controlled work has "very clearly" increased at Purdue University, said Peter Dunn, associate vice president for research. "It can be a challenge to find an American researcher."
The University of California and Stanford don't accept U.S.-only contracts. Research that "would restrict access on the part of certain students should not be conducted at universities where our mission is to educate students and disseminate knowledge," Stanford spokeswoman Lisa Lapin said in an e-mail.
Other schools profit from the University of California's principled stand, said Patrick Schlesinger, an assistant vice chancellor at the flagship Berkeley campus. "More and more schools are deciding, 'We love hearing that Berkeley won't take on a research project,'" he said. "'That means our school will get a chance at it.'"
U.S. Talent Pool
Seeking export-controlled revenue is shortsighted, said Edward Lee, a Berkeley professor of electrical engineering and computer sciences. "Organizations that do engage in these projects are giving up opportunities to work with some of the best and brightest students," Lee said. "The unfortunate reality in the U.S. is that the talent pool in technical fields is pretty spare."
If the government imposes conditions after the contract has been awarded, researchers shouldn't accept them, Berkeley administrators said in a 2005 university publication. Among their recommendations for "dodging the 'deemed-export' bullet": "Publish early and often to ensure that your research qualifies as 'publicly available,'" and "do not attend meetings from which foreign nationals are barred."
Most universities that take on export-controlled research construe the restrictions narrowly. Because rules can be ambiguous, acting as if a project is fundamental research often makes it so, said Ben Griffiths, senior legal counsel at the University of Wisconsin.
University of Texas
The University of Texas at Austin has disclosed four violations, said Susan Sedwick, associate vice president for research. Three were minor, she said. The other, "an existing situation that I discovered when I came here" six years ago, involved taking controlled equipment and software abroad. "Not that the university hadn't looked at it, they just looked at it in the wrong way," she said. "They thought they had an exemption that they didn't."
Sedwick's office monitors grants and contracts, advises faculty, and works closely with the university's information security staff and international office to ensure compliance, she said.
Mississippi State University is warier than most schools of invoking exemptions, said Ray Vaughn, associate vice president for research. It recently stopped a contract and sent it to the State Department for review even though the faculty member insisted it was fundamental research, he said.
"I would rather lose a contract than end up in that gray area," Vaughn said.
Revenue Before Security
Academia's failure to police export controls shows that it puts tuition revenue from foreign students ahead of national security, said U.S. Representative Dana Rohrabacher, a California Republican. "The universities are out to make money, and they are going to do it even if it puts American security at risk" by teaching students from hostile countries how to make technology, he said.
Universities have been waging a political battle against U.S.-only rules since 2004, when a series of reports by federal inspectors general criticized academia. "At least one university allowed foreign nationals access to export-controlled technologies without obtaining an export license," which "could allow foreign nations to counter or reproduce the technology," the Department of Defense inspector general found.
When the Commerce Department's inspector general called for more controls, universities stymied the proposal.
Crippling Effect
"The higher education community really pushed back and expressed very clearly our concern about the crippling effect on the open research environment," said Robert Hardy, director of contracts and intellectual property management for the Council on Governmental Relations, a Washington-based association of research universities.
In December 2007, an advisory committee of industry and university leaders suggested pruning Commerce's restricted list. It "is too all-encompassing, covering a vast spectrum of militarily less important items ranging from police handcuffs to hunting rifles, and from conventional radios to mass-market computers," the committee said.
The National Research Council, a nonprofit organization of prominent scientists, joined the chorus in 2009, attacking export controls as "unwieldy, slow" and "difficult to administer rationally."
Overhauling Controls
Responding to such criticisms, the Obama administration is overhauling the controls, in the face of opposition from some Republican members of Congress and hardliners within the State and Defense departments. It's working to move some items from the State Department's list of controlled military and satellite technology to Commerce's dual-use roster, which has fewer prohibited countries and a lower bar.
At Georgia Tech, export controls affect classes as well as research. As of November 2010, Georgia Tech Research Institute, the university's applied research arm, offered 69 professional- education courses for federal employees and contractors, of which eight were classified. Fifteen were restricted under State Department rules.
Schmieder, 67, a principal research scientist at Georgia Tech, is familiar with such distinctions. He testified as an expert witness for the government in the 2010 conviction of Noshir Gowadia in federal court in Hawaii for selling classified missile technology to China. (Gowadia's appeal is pending.)
Uploaded to Servers
Schmieder had his restricted September 2009 course, "Infrared Technology and Applications," videotaped because he planned to retire and wanted to train his successor. He asked the university's media specialists to place the video on a DVD.
After encountering technical problems copying the tape to a disc, Bailey, the media supervisor, suggested making it available by a link. Under the impression the sessions would only be available internally at Georgia Tech, Schmieder agreed.
The course, including 14 Power Point slides displaying technical data from export-controlled sources, was uploaded to Georgia Tech's servers on Nov. 19, 2009. It remained accessible until Dec. 4, when Schmieder noticed the mistake. He notified university staff and the material was immediately removed from servers.
Users in 36 countries viewed the slides 660 times, led by the U.S. with 278, the Netherlands with 68, and India with 52. There were 33 hits from China, 17 from Saudi Arabia, nine from Pakistan, two from Russia and one from Iran.
Difficult to Locate
While Georgia Tech subsequently traced most of the hits to IP addresses in the U.S., South America, Australia and Western Europe, it didn't identify users in the countries of greatest concern, such as China and Iran. Instead of specific addresses, such countries have a block of addresses all registered to their governments, university spokesman Matt Nagel said.
There were 16 hits to the video of the course instruction, all from the U.S., the university said. Because the slides and video were placed on separate servers, "it would have been difficult for someone to locate all the pieces and put them back together into a coherent whole," Schmieder said.
Following an internal investigation, Georgia Tech vice provost Steven McLaughlin disclosed the violation on May 24, 2010, to the State Department's Directorate of Defense Trade Controls. He wrote that the university had been assured by an Army export control officer for night-vision technology that many of the slides had since been approved for public release.
Georgia Tech retracted that statement three months later after the Army's Night Vision Lab contacted Schmieder to deny that it had approved the information's release.
'Serious Violations'
"It was my personal opinion that most of the images were to be approved," Schmieder said. "My comments were misinterpreted" to have come from the Army.
The State Department "determined that serious violations did occur," Daniel J. Buzby, deputy director of its Office of Defense Trade Controls Compliance, notified McLaughlin on Sept. 23, 2010. "This compilation of information is so comprehensive and so sensitive in its description of U.S. Government technology directions that DTCC is concerned over how it was allowed to be placed on a World Wide Web-accessible server."
In response, Georgia Tech prohibited video recording of restricted courses without prior written approval. It also discussed the incident with everyone involved and provided additional training for all research institute employees, McLaughlin said.
"In hindsight, I would do more to remind my co-workers of the sensitive nature of the material and the need for special handling," Schmieder said.
To contact the reporter on this story: Daniel Golden in Boston at dlgolden@bloomberg.net
To contact the editor responsible for this story: Jonathan Kaufman at jkaufman17@bloomberg.net
Find out more about Bloomberg for iPhone: http://m.bloomberg.com/iphone/Eugene.
No comments:
Post a Comment