NOAA Deemed Exports Compliance Program

1. NOAA Deemed Exports Compliance Program Ann Murphy/Michele Peruch Office of the Chief Administrative Officer Hugh Schratwieser General Counsel Washington, DC June 7-9, 2011 Seattle, WA June 28-30, 2011

2. Outline • Background • How NOAA has ensured ongoing compliance • Annual Certification requirements

3. Background • The Office of the Inspector General (OIG) reported that “NOAA lacks an overall deemed export control policy to effectively monitor foreign national access to controlled technology…” • NOAA was required to develop a Deemed Export Compliance Program to: • respond to the OIG recommendations • manage and mitigate risk of unauthorized release of controlled US technology to foreign nationals in the United States

4. What happened next? • BIS trained over 175 NOAA employees on deemed exports in 2005, after the OIG report was issued • These individuals conducted assessments at: • NOAA facilities with foreign nationals • NOAA Critical Infrastructure sites • How did they document the assessment? • Foreign National List (October 2005) • Controlled Technology Inventory (October 2005) • Access Control Plans (December 2005) • NOAA added Deemed Exports Compliance Clause to Grants and Contract Agreements

5. What did NOAA do with the findings? • Locations that identified controlled technology: • Determined whether BIS export licenses were needed for foreign nationals that required access to the controlled technology • Prepared Access Control Plans to safeguard controlled technology • Facilities that have conducted assessments must prepare an Access Control Plan, even if there is only EAR 99 technology

6. How did NOAA formalize Deemed Export compliance measures? • Ongoing Deemed Export Compliance Requirements: • Line Offices (LO)/Corporate Offices (CO) maintain “live” updates of Foreign National Lists, LO/CO Controlled Technology Inventories, and Access Control Plans of assessed facilities • LOs/COs send quarterly updates of Foreign National Lists and Controlled Technology Inventories to the Chief Administrative Officer (CAO) • Access Control Plans are updated as needed (e.g. if you acquire new technology, if you move to a new building, etc..)

7. Deemed Export Website

8. Deemed Export Annual Certification Who? When? What? • Signed by Deputy Assistant Administrators/Corporate Office Directors and submitted to the Chief Administrative Officer • Due third week of October every year • What is due? • Certification Statement • Foreign National List • Controlled Technology Inventory • List of Facilities assessed for Controlled Technology and Points of Contact at these facilities • List of Facilities not assessed for Controlled Technology • Access Control Plans • List of Export Licenses applied for and/or obtained

9. Deemed Export Website

10. How did NOAA formalize deemed export compliance and DOC foreign national access procedures? • Promulgated NOAA Administrative Order (NAO) 207-12, Technology Controls and Foreign National Access (May 11, 2006) • The NAO: • Formalizes management model and Line Office/Corporate Office roles and responsibilities (Controlled Technology Coordinator/Steering Committee) • Incorporates requirements from Department Administrative Order (DAO) 207-12, Foreign National Visitor and Guest Access Program • Still required under HSPD-12 badge policies • DAO 207-12 requires Bureau Senior Administrative Official (NOAA-CAO) endorsement of foreign national guests --The CAO will endorse guests for up to one year; requests must be renewed for length of stay beyond one year • NOAA CAO reviews Endorsement Supplement Form (ESF) • What is that?

11. NOAA Line Office (LO)/Corporate Office (CO) Endorsement Supplement for the NOAA Sponsor of Foreign National Guests (“Endorsement Supplement”) • The Chief Administrative Officer must receive this form before signing Appendix B for foreign national guests • Provides justification that the value gained from the collaboration is balanced with the need to protect information • Provides assurance that a controlled technology assessment has been conducted prior to arrival of a foreign national guest • Provides instruction to consult with Office of Marine and Aviation Operations (OMAO) if the foreign national will access an OMAO platform • ESF does not grant access to controlled technology or facilities • NMFS employees use FNRS to process “guest” requests

12. Foreign National Access Procedures • The Department Sponsor/NOAA (DSN) determines if the foreign national is a “visitor” or “guest” and sends required data to OSY. • If “guest,” the DSN completes the required sections of the ESF and Appendix B. - Appendix B, paragraph 3, “Normal Work Area”- DSN is responsible for NOAA’s assets in this area and others • Has a Controlled Technology assessment been completed at all facilities in the DSN’s LO or CO? • Once OSY authorizes the visit, submit Appendix C directly to the servicing security office • Flow Chart outlines this process

13. How to Sponsor a Foreign National to NOAA

16. Violations of NAO 207-12 Internal Post-Assessments: • Required for foreign nationals not processed in accordance with the NAO • Document potential risk to agency • Not a punitive action • Serve as awareness and education tool

17. QUESTIONS? Where can you learn more? http://deemedexports.noaa.gov You may also contact your LO/CO Controlled Technology Coordinators (CTC) http://deemedexports.noaa.gov/contacts.html OCAO/GC Deemed Export Team: Ann Murphy, Michele Peruch, Hugh Schratwieser