Ann Murphy, Office of the Chief Administrative Officer NOAA Trusted Agent Training Silver Spring, MD October 2014 National Oceanic and Atmospheric Administration Deemed Export Compliance Program

2 Outline Background How NOAA ensures ongoing compliance Annual Certification requirements

3 Background The Office of the Inspector General (OIG) reported that “NOAA lacks an overall deemed export control policy to effectively monitor foreign national access to controlled technology…” NOAA was required to develop a Deemed Export Compliance Program to: – respond to the OIG recommendations – manage and mitigate risk of unauthorized release of controlled US technology to foreign nationals in the United States

International Collaboration and Export Controls -NOAA values foreign national contributions to our science and research Challenge is to balance: --the need to collaborate to accomplish our mission (good science) with ---the inherent national security risks and the need to protect sensitive assets, including export controlled technology and intellectual property 4

NOAA’s Export Control Compliance Program- Key Components -NOAA Administrative Order , Technology Controls and Foreign National Access (policies for foreign national access to EAR technology) -Assessments to complete a list of foreign nationals (FN) working at NOAA (FN List) -Assessments to create an inventory of EAR-controlled technology (CT) at facilities --Required: 1) Access Control Plans for all assessed facilities to manage risk 2) Access Control Information Sheets for all controlled items in ACP 3) CT assessments at all facilities before FNs are permitted access -Outreach for NOAA staff who work with FNs and/or EAR-controlled technology -Determine applicability of deemed export controls to NOAA-sponsored research ---Issued: 1) clause for contracts/grants to ensure EAR compliance 2) Guidance to protect against unauthorized release of EAR-controlled technology related to NOAA research (Research Tool) -Included the Department of Commerce (DOC) security procedures in the NOAA policy to ensure foreign national visits comply with DOC policy (DAO ) 5

6 NOAA Deemed Export Compliance Measures Ongoing Deemed Export Compliance Requirements: –Line Offices (LO)/Staff Offices (SO) maintain “live” updates of Foreign National Lists, LO/SO Controlled Technology Inventories, and Access Control Plans of assessed facilities –LOs/SOs send quarterly updates of Foreign National Lists and Controlled Technology Inventories to the Chief Administrative Officer (CAO) –Access Control Plans are updated as needed (e.g. if you acquire new technology, if you move to a new building, etc..) --Facilities that have conducted assessments must prepare an Access Control Plan, even if there is only EAR 99 technology

7 Deemed Export Annual Certification Who? When? What? Signed by Deputy Assistant Administrators/Staff Office Directors and submitted to the Chief Administrative Officer Due third week of October every year What is due? Certification Statement Foreign National List Controlled Technology Inventory List of Facilities assessed for Controlled Technology and Points of Contact at these facilities List of Facilities not assessed for Controlled Technology Access Control Plans List of Export Licenses applied for and/or obtained

8 NOAA Deemed Export Compliance and DOC Foreign National Access Procedures NOAA Administrative Order (NAO) , Technology Controls and Foreign National Access (May 11, 2006) The NAO: 1. Formalizes NOAA Management Model and Line Office/Staff Office Roles and Responsibilities (Controlled Technology Coordinator) 2. Incorporates requirements from Department Administrative Order (DAO) , Foreign National Visitor and Guest Access Program -DAO requires Senior Administrative Official (NOAA CAO) endorsement of all foreign national guests (CAO endorsements are valid for up to one year; requests must be renewed for length of stay beyond one year)** -NOAA CAO reviews Endorsement Supplement Form (ESF) -What is that?

9 “Endorsement Supplement” (ESF) for the NOAA Sponsor of Foreign National Guests The Chief Administrative Officer must receive the ESF before providing concurrence on Appendix B for foreign national guests DSNs and CTCs: –Provide justification that the value gained from the collaboration is balanced with the need to protect information –Provide assurance that a controlled technology assessment has been conducted and an Access Control Plan is in place prior to access by a foreign national guest –Agree to Office of Marine and Aviation Operations (OMAO) reporting requirements if the foreign national will access an OMAO platform (Vessel or Aircraft) ESF does not grant access to controlled technology or facilities NMFS employees use FNRS to process “guest” requests

10 Foreign National Access Request Process The Department Sponsor/NOAA (DSN) determines if the foreign national is a “visitor” or “guest” and sends required data to OSY. Visit Data: Each Sponsor sends Bio data/PII (NAO , Section 5.08) to directly to OSY (Do not PII; encrypt or fax) -OSY conducts checks the foreign nationals against internal and interagency databases ESF and Appendix B: If “guest,” the DSN completes the required sections of the ESF and Appendix B and submits to CTC for CAO endorsement (NMFS uses FNRS)

Foreign National Access Request Process- continued Some things to consider while filling out ESF or FNRS: --Appendix B, paragraph 3, “Normal Work Area”- DSN is responsible for NOAA’s assets in this area --Has a Controlled Technology assessment been completed at all facilities in the DSN’s LO or SO? CTC certifies this --OSY requires NOAA concurrence on each foreign national mission justification (does the visit support NOAA’s goals?) Appendix C: Once OSY provides “conditional approval” for the visit, DSN sends signed Appendix C directly to OSY within 72 hours of the FN’s arrival Flow Chart outlines this process 11

Deemed Export Website 12

How to Sponsor a Foreign National at NOAA 13

The NOAA Foreign National Registration System (FNRS) 14

15

16 Violations of NAO Internal Post-Assessments: Required for foreign nationals not processed in accordance with the NAO Document potential risk to agency Not a punitive action Serve as awareness and education tool

NOAA Organization Approx. 12,500 employees Approx contractors 800 facilities nationwide NOAA Corps has Civilians and Officers of the NOAA Commissioned Corps –-Manages approx. 19 large vessels, small boats, and approx. 12 aircraft 17

Balance Between Openness and Security Dept. of Commerce (DOC) recognizes the value of foreign national contributions to U.S. science, technology, and research Foreign Nationals are offered access to DOC facilities, staff and information However, there is an element of risk associated with access to federal facilities Sponsors must: -Balance the need to collaborate with the need to protect sensitive assets (risk), including export controlled technology -Take responsibility for the successful completion of the visit -Ensure an Access Control Plan is in place for their facility 18

Key points for NOAA Managers NOAA needs to: Use the expertise of engineers and technical specialists to classify technology used in their Line Offices Identify who is responsible for the controlled technology (CT) and prepare access control plans to document the safeguards for the CT Be aware of BIS specific definition of terms such as “technology” and “use” 19

Key points for NOAA Employees - All NOAA employees : - Awareness of policies (e.g. NAO/DAO ) and laws (e.g. EAR, ITAR); -Ensure exports and deemed exports are authorized and licensed, if applicable; -Sponsor foreign nationals in accordance with policies (DAO/NAO ) -Protect sensitive assets in your program area from unauthorized release to foreign nationals -- including, but not limited to, export controlled items 20

QUESTIONS? Where can you learn more? You may also contact your LO/CO Controlled Technology Coordinators (CTC) NOAA Deemed Export Team: Ann Murphy, Hugh Schratwieser 21

Helpful Links: Export Control and Sponsoring Foreign Nationals ccess_control_procedures/how-to-sponsor-a- foreign-national-at-a-noaa-facility.html ccess_control_procedures/031411_hosting_a _foreign_national_flowchart.pptx 22