1

EXPORT CONTROLS & SANCTIONS COMPLIANCE

David BradyDirector and Facilities Security OfficerOffice of Export and Secure Research ComplianceVirginia Tech

Erica KroppOffice of Research Administration & AdvancementUniversity of Maryland Center for Environmental Science

June 22, 2009

2

What are Export Controls?

US laws that regulate the distribution to foreign nationals and foreign countries of strategically important technology, services and information for reasons of foreign policy and national security.

Export control laws apply to all activities – not just sponsored research projects.

3

What is an Export?

Transfer of controlled technology, information, equipment, software, source code or services (ITAR) to a foreign person in the US or abroad by any means; e.g.,actual shipment outside the US visual inspection in or outside US written or oral disclosure

4

What is a “Deemed” Export?

Any release of technology or source code subject to the EAR to a foreign national within the U.S.Technology: specific information

required for the development, production, or “use” of a controlled item

Such release shall be “deemed” to be an export to the country or countries of origin of the foreign national.

5

Who are U.S. Persons? U.S. citizensU.S. citizensAliens who are “Lawful Permanent

Residents” (Green Card holders)

Other “Protected Individuals” designated an asylee or refugeea temporary resident under

amnesty provisionAny entity incorporated to do Any entity incorporated to do

business in the U.S. business in the U.S.

6

Who are Foreign Persons?

“Foreign Person” means everyone else:Any foreign interest and any US Person

effectively owned or controlled by a foreign interest

Includes foreign businesses not incorporated in the U.S., persons representing other Foreign Persons, any foreign government

Includes: H1B Work Visa, F1 Study Visa, J1 Training Visa, E1 Investors Visa, TN Work Visa, L1 Intra-Company Transfer Visa, K and V Fiancée Visas

EAR does not use the term foreign personinstead refers to “foreign national”- they mean the same thing

7

Definition: License

Formal written permission (with conditions and time limits) from the Department of State or the Department of Commerce which grants permission to export a controlled item or technology to a foreign national, or in the case of the Department of Treasury, grants permission to travel to and/or perform certain activities in/for sanctioned countries.

8

Use of terms

Exclusion – Outside the regulations requiring a license; not subject to the regulations

Exemption (ITAR/OFAC) or Exception (EAR) - License not required for item or activity as defined within the regulations.

9

Who Controls Exports & Sanctions? U.S. Dept of Commerce*

Bureau of Industry and Security Patent and Trademark Office Bureau of the Census

U.S. Dept of Energy Nuclear Regulatory Commission

U.S. Dept of Homeland Security Customs and Border Protection

U.S. Department of Justice Bureau of Alcohol, Tobacco, Firearms, and Explosives

U.S. Dept of State* Directorate of Defense Trade Controls

U.S. Dept of Treasury* Office of Foreign Assets Control*Focus of this presentation

10

Responsible US Agencies

State Department: Inherently military technologies--International Traffic in Arms Regulations (ITAR)

Examples usually clearly military:-Firearms and Armaments-Tanks and Military Vehicles-Developmental Military Aircraft and Vessels-Experimental Military Electronics

-Military Training Equipment -Protective Personnel Equipment

But also spacecraft/satellites & related equipment

11

Responsible US Agencies

Commerce Department: “Dual-Use” technologies (primary civil use) -- Export Administration Regulations (EAR)

Examples not as clearly subject to controls: Computers Marine Materials, Chemicals, Micro-Organisms, Toxins Sensors and Lasers Nuclear Materials

12

Responsible US Agencies

Treasury Department, Office of Foreign Assets Control (OFAC): Prohibits transactions with countries subject to boycotts, trade sanctions, embargoes

Examples: Balkans, Belarus, Cuba, Iran, Iraq, Liberia, Sudan, Syria, North Korea

http://www.treas.gov/offices/enforcement/ofac/programs/index.shtml

13

Export Controls or Sanctions

Export controls are placed based on commodities and technologies (EAR/ITAR)

Sanction programs are country specific and controls may cover any and all technologies and activities-including financial transactions (OFAC)

14

Restricted Access Parties Lists

In addition to export and sanctionedcountries, there are also restricted entitiesand individuals:

• Department of Commerce Denied Persons [EAR]

• Department of Commerce Entity List [EAR]

• Department of Commerce "Unverified" List [EAR]

• U.S. Treasury Department Specially Designated Nationals and Blocked Persons, including Cuba and Merchant Vessels, Iran, Iraq and Merchant Vessels, Sudan Blocked Vessels [OFAC]

• Department of State Designated Terrorist Organizations

• Department of State Terrorist Exclusion List (TEL)

15

Why Do We Need to Worry & Act?

Public Laws - law of the land Element of university compliance Government attention and expectations Violations can bring:

Administrative Penalties Civil & Criminal Penalties

For both individuals and university Criminal (willful) violations include prison

16

Exports, Sanctions & Higher Ed

Export Laws on the books since the 1940’s NSDD 189 1985-1993 ITAR/EAR Fundamental research

exclusions 1999 Satellites and related technology moved from

Commerce Dept to State Dept 9/11 2002 GAO report faults Commerce/State for lax

regulation 2004 Commerce/State IG Reports 2004 OFAC allows some academic collaborations

with sanctioned countries

17

Exports, Sanctions & Higher Ed

2005 Commerce/State tighten regs/controls 2007 ITT Nightvision convicted on ITAR export

felonies, fined $100M 2008 Young Memo DoD 6.1, 6.2 funded university

research should not be restricted- 6.3+ should be restricted

2008 U Tenn professor convicted of 17 ITAR export felonies involving Chinese & Iranian graduate students

2008 Lloyds of London fined $800M to settle OFAC sanction violations

18

Implications of Export & Sanctions Laws

No effect on most university research Potential impact on

Ability of foreign students or researchers to participate in research involving a controlled technology (mostly under ITAR)

Ability to provide services (including training in the use of controlled equipment) to foreign persons (ITAR, EAR, OFAC)

Ability to send controlled equipment to foreign countries (ITAR, EAR, and OFAC)

19

Implications of Export & Sanctions Laws

Factor that can extend award negotiation time – may involve institutional decisions

Factor to be considered if/when accepting another parties information

Likely to require additional internal review processes

Time and resources – can effect project schedules – even after the award

PI’s need to be involved

20

Disseminating Informationaka “Deemed Exports”

In the absence of an exclusion, a license or other government approval must be obtained from Commerce or State to share controlled technical information with a foreign person in the U.S. or abroad.

Methods of disclosure include: Physical release of technical data Telephone discussions or fax E-mail communications Computer data disclosure Face-to-face discussions Training sessions Tours which involve visual inspections

21

Exclusions

Dissemination of information may fall outside the export regulations if one of three exclusions applies:

Public Domain Exclusion (ITAR,EAR,OFAC) Fundamental Research Exclusion (ITAR,

EAR) Education Exclusion (ITAR, EAR)

22

Public Domain Exclusion(22 CFR 120.11, 125.1; 15 CFR 734.7)

You stay outside the regulations when you share technical data or information with foreign person inside or outside of US if: It has already been published; Available in libraries or through newsstands,

bookstores, subscriptions, or free websites; or

Disclosed in published patent applications

23

Fundamental Research Exclusion (FRE)

You stay outside the regulations when disclosing to foreign persons information that is “published and which is generally accessible or available to the public [through, for example,] fundamental research in science and engineering at universities where the resulting information is ordinarily published and shared broadly in the scientific community.”

24

Fundamental Research NSDD 189, 22 CFR 120.11 (a)(8), 125.1; 15 CFR 734.8, 734.11)

Basic or applied research at an accredited U.S. institution of higher learning

No publication restrictions If federally funded, no access and dissemination

restrictions on results No national security restrictions

As long as the above conditions are met, the results of your research are not subject to ITAR/EAR license restrictions even if the subject area of the research is export restricted.

25

Fundamental Research

The FRE does not apply to:

• Technology, software, or items that are already designated or identified as subject to export controls

• Defense articles or defense services Department of State guidance

requires that an export license be obtained for a foreign person… who is to have access to a defense article in the United States.

DoS considers all such access to be a “defense service”.

26

Fundamental Research

The FRE may not apply to:

Outside the U.S. if ITAR

Some research subject areas, i.e.,Weapons of Mass Destruction

(WMDs)Encryption software or source codeItems or technologies controlled

specifically by another agency (i.e., Nuclear Regulatory Agency)

27

Fundamental Research

The FRE does not apply to:

Development: no longer basic or applied research Design, development, testing, or evaluation of a

potential new product or service (or of an improvement in an existing product or service) to meet specific performance requirements or objectives

28

The Fundamental Research Exclusion is Destroyed if

The university accepts any contract clause that:

Restricts the access and dissemination of results to foreign persons

Gives the sponsor a right to approve publications resulting from the research

Otherwise operates to restrict participation in research and/or access to and disclosure of research results

29

Fundamental Research Exclusion Vulnerability

“Side deals” between a PI and sponsor destroy the fundamental research exclusion and may also violate institutional policies on openness in research These could take place via a nondisclosure or

confidentiality agreement signed by PI or through acceptance of export-controlled information from others

30

Many Universities Work to

Protect fundamental research exclusion by eliminating through negotiations all contractual clauses that restrict university control over publications or limit access to or participation in research.

31

Educational Exclusion

General science, math, and engineering commonly taught at schools and universities (ITAR (22 CFR § 120.11))

Information conveyed in courses listed in course catalogues and in their associated teaching labs of any academic institution (EAR (15 CFR § 734.9) )

32

Providing Services Under OFAC

In general, OFAC programs prohibit the provision of services to or from countries, entities, and individuals subject to US sanctions and embargoes w/o a license.

Services include: Carrying out field research in sanctioned

countries Conducting surveys and interviews in

boycotted countries

33

Providing Services cont’d

Providing educational, marketing & business services to persons in sanctioned countries

Creating new information materials at the behest of persons in a sanctioned country

Engaging the services of persons in a sanctioned country to develop new information materials

Some exemptions apply for academic collaborations

***Note: Restrictions vary by country***

34

Countries Under Embargoes

Ex: Belarus, Burma (Myanmar), Cuba, Iran, Iraq*, Liberia, Sudan, Syria, North Korea

*Iraq’s sanctions have changed since Iraq war

Embargoes/Sanctions Subject to Change, always check OFAC Website : http://www.treas.gov/offices/eotffc/ofac/sanctions/index.html

35

Equipment Use

Generally, use of EAR export controlled equipment is not a deemed export. Deemed export occurs only if controlled technology is transferred.

It is understood by the Commerce Department that there is no distinction between product of research and knowledge of equipment used in research.

36

Equipment Use

However – There are no exclusions that allow

foreign persons to use equipment controlled for use technology which requires the access to company/manufacturer proprietary manual or instructions for the use.

Should be treated as using another parties export controlled material.

37

Equipment Use

ITAR Use: Design, development, production,

manufacture, assembly, operation, repair, testing, maintenance or modification of defense articles

EAR Use: Operation, installation (including on-

site installation), maintenance (checking), repair, overhaul and refurbishing

38

Shipping Controlled Equipment Abroad

A license is required to ship equipment controlled by ITAR to any foreign country (few exemptions).

A license may be required to ship equipment controlled under the EAR out of the US depending on what the equipment is, where it is being sent, who will be using it for what purpose (many exceptions).

39

Shipping Equipment cont’d

The process to classify equipment under the EAR is detailed and time consuming.

It may take monthsmonths to obtain a license from State or Commerce.

Note: A license may be required to shipsoftware out of the US.

40

Shipping Equipment cont’d

There is a presumption under OFAC sanction programs that any and all shipments of equipment and provision of services to countries under sanction or persons in those countries are ILLEGAL.

41

Examples of Application to University Research

Export of research products— Underwater research vehicle could require ITAR license if designed

for military applications; would require Commerce Department authorization if designed for civilian purposes

— Specially designed electronic components could be controlled

Temporary transfer of research equipment abroad— Carrying scientific equipment to certain destinations for research

may require authorization (e.g., Iran, Syria, China, etc.)

Software development— Software that is provided to the public for free (including the source

code) may not require licenses, but proprietary software of controlled technology could require licensing

— Encryption technology could require licenses or could be prohibited for transfers to certain foreign nationals/countries

42

License Example

University archeologists desire to take GPSsystems to France to use in research project

with foreign colleagues: GPS equipment is covered by EAR Category 7,

Navigation and Avionics, under ECCN nos. 7A005, 7A105, and 7A994. Two of those entries redirect the exporter to ITAR.

The exporter must evaluate the EAR entries and ITAR Category XV, Spacecraft Systems and Associate Equipment, to identify the appropriate licensing authority and classification.

43

Laptop Exception (EAR)

Excluding countries under sanction, faculty who wish to take their laptops out of the country to use in a project that qualifies as fundamental research may be able to do so under the license exception for temporary export (TMP) if the laptop meets the requirement for "tools of trade"  and faculty retain control of the laptop at all times.(15 CFR Part 740.9).

44

Accepting Export Controlled Information

In deciding whether to accept an award that requires the institution to receive export controlled information, consider whether the information is Central to the project (probably rendering

the entire project export controlled) or Tangential in that the PI needs the

information but not others working on the project.

45

Accepting Export Controlled Information cont’d

If you decide the information is tangential Execute a nondisclosure agreement Require that the information be clearly

marked “export controlled,” and Work with the PI to firewall the information

and have the PI sign a statement accepting responsibility for protecting the information

46

Accepting Export Controlled Information & Material

Check if your libraries have accepted controlled information or signed DoD form DD2345 (Militarily Critical Technical Data Agreement). Acceptance creates compliance issues for individuals and the university.

Look for Distribution Statement A: “Approved for Public Release, Unlimited Distribution”

Material received under Material Transfer Agreements (MTA) need to be reviewed.

47

Liability and Violations

Liability is personal and institutional and may take the form of: Administrative penalties Monetary fines Jail time

Voluntary disclosure of violations may serve as a “mitigating factor” in deciding penalties.

48

Develop a Compliance Plan

The Federal Government expects every institution to have a basic compliance program/plan in place which includes screening of use of technology by foreign persons.

(Not to be confused with a Technology Control Plan which must be in place to safeguard controlled technology developed or received and is not subject to an exclusion or exception.)

49

Plan Elements

Inform/educate key university administrators of legal requirement to implement a compliance plan.

Designate a responsible (“empowered”) export compliance person (ECO)

Designate person/office to serve as the point person for researchers and government agencies on export control issues (if not ECO).

ECO should have legal support – internal counsel and/or possibly outside counsel.

50

Plan Elements cont’d

Conduct a risk review of sponsored projects for vulnerabilities The greater the intersection of Non U.S. Persons

and ITAR/EAR subject research, the greater the risk of university export control violations

You can’t manage what you don’t know you have

Establish a training program for research, tech transfer, procurement and shipping administrators.

Establish an awareness program for faculty and other researchers.

51

Plan Elements cont’d

Establish written procedures for reviewing proposals and awards; e.g.,

Add questions to internal proposal routing form. Develop a check list for contract/grant

administrators. Develop and implement processes for deciding if a

project is controlled and whether an exclusion applies.

• Develop an export control information section on your compliance website

52

Plan Elements cont’d

Decide who has authority to accept projects that require a license (and may violate university academic policies) and under what circumstances the institution will accept a project that requires a license.

Document all export control decisions.

53

University Vulnerabilities

How large a foreign national population? USML or CCL-listed research? Contracts with DoD, NASA, DHS, Intel

Agencies? Proprietary technology research with industry

or government? Accepting another parties proprietary

information? Select agents? BSL3+ Labs? International sponsors, subcontractors?

54

University Vulnerabilities

Dedicated secure facilities for export controlled research?

Shipping equipment to a foreign country? Collaborating with foreign colleagues in

foreign countries? Training foreign persons in using equipment? Working with a country subject to US

sanctions? Foreign visitors to your labs? Post data and results on Websites open the

public?

55

Items of Concern for Faculty

Restrictive sponsored research terms & conditions

Proprietary info & software from others Keeping own research results/software

proprietary Non-sponsored research at university Projects in your garage Attending “closed” meetings Faculty start-up companies (no FRE) Providing services (not research) Protecting students Consulting work

Managing the Deemed Export Risk

Restricted research & defense articles and defense services bring unwanted risk of deemed export violations to campus… two options to contain the risk:

Just Say “No” Operate within exclusions, or…

Lock up and license:Accept greater risk of noncompliance and penalties: Requires greater allocation of compliance resources• Manage the process to the risk• Impose extra security measures

57

Ensuring University is Export and Sanctions Compliant

Conduct risk assessment Identify vulnerabilities Develop strategy for compliance Take initial steps Provide for recurring efforts Recognize this as long term compliance

area as part of overall university compliance program

58

Questions?

David Brady540-231-3801 dbrady@vt.edu

Erica Kropp410-221-2015ekropp@umces.edu

June 22, 2009