Overview of Export Control Laws
Topics Covered Below
- Compliance with export control regulations
- Penalties for noncompliance
- Applicability of regulations
- The Office of Foreign Assets Control
- Do these rules and regulations apply to your project?
Export Controls and Embargoes, What You Never Wanted to Know, by Jamie Lewis Keith, Senior Counsel, Massachusetts Institute of Technology (PowerPoint presentation)
U.S. Export Controls: The Challenge for Research Institutions, by Richard Johnson, Partner, Arnold & Porter LLP (PowerPoint presentation)
Export control laws (ECLs) represent a comprehensive set of federal regulations that control and restrict the release of critical technologies, technical data, software code, equipment, chemical and biological materials, and other materials, information, and services to foreign nationals or foreign countries for reasons of foreign policy and national security. Any transfer to a citizen or permanent resident of a foreign country, irregardless of where the transfer occurs, is deemed by the United States government to be an export to that country. Exceptions of who can receive a transfer are permanent United States citizens, i.e., foreign nationals with "green cards, or "protected individuals," i.e., foreign nationals granted political asylum in the United States. Export controls apply to all activities — not just sponsored research projects.
ECLs involve a number of different regulations. The three major regulatory schemes in place governing ECLs are the Export Administration Regulations (EAR) administered by the U.S. Department of Commerce; the International Traffic in Arms Regulations (ITAR) administered by the U.S. Department of State; and the Office of Foreign Asset Control (OFAC) administered by the U.S. Department of Treasury.
Although these regulations do contain exclusion criteria for fundamental research, universities are not exempt from these laws since the exclusion clause applies only under certain conditions. It is not always obvious what is export-sensitive and therefore impacted by export controls. Export controls serve multiple purposes from guarding our national security, to protecting our national economy, to supporting our national foreign policy. As a result, different government agencies have different rules and lists specifying who or what is considered export sensitive, or even where export controls apply. Furthermore, these rules and lists are updated constantly, and in a given situation any or none may apply. Most U.S. exports, however, take place under expressly defined exceptions or waivers and do not require a specific export license or other special authorization.
Nonetheless, as a University with important international collaborations, it is imperative that UMass Boston be a responsible exporter. This means adhering to all applicable U.S. export rules and regulations and obtaining any necessary licenses or waivers. Export controls apply to activities ranging from discussions with foreign nationals to the transfer of equipment.
Some of the work conducted by University faculty, staff and students falls under U.S. export controls. It is therefore each employee's responsibility to understand any export control requirements related to his or her work and to ensure that no exports are made contrary to any of these laws and regulations. This means making sure that any required licenses or approvals are in place prior to exporting anything that is export controlled. Program and project managers are responsible for taking export controls into consideration during the planning and implementation of their programs or projects, as well as whenever those activities change in scope or direction.
The great majority of work and products qualify as fundamental research and are not subject to export controls. Fundamental research consists of basic and applied research in science and engineering for which the resulting information is ordinarily published and shared broadly within the scientific community. Basic research is distinguished from proprietary research or industrial development.
Compling with Export Control Regulations
While laws controlling exports have existed for decades, the Federal government has become increasingly concerned about protecting both information and technologies for reasons of foreign policy and national security. In this context, an"export" is defined very broadly to include oral or written disclosure of information, visual inspection, or actual shipment outside the U.S. of technology, software/code or equipment to a foreign person. Laws and federal regulations limit the distribution of technical products, services, and information to foreign nationals and foreign countries and apply to all activities. These laws are complicated and apply to a wide range of activities at academic institutions, including research, international programs, technology transfer, foreign travel, and site visits in the U.S. by foreign nationals.
What is an Export?
Generally speaking, any delivery or exposure of U.S. hardware, software, or technical data or assistance outside of the U.S. is considered an export and is potentially subject to being controlled. In addition, certain deliveries or exposure occurring entirely within the U.S. may be considered "Deemed Exports," as discussed below. More specifically, the U.S. Department of Commerce in its export control regulations provides the following definitions.
Any shipment, transfer, or transmission out of the United States by any means (including hand-carrying) of any
- Goods (equipment, hardware, or materials)
- Technology (technical data, information, or assistance)
- Software/Codes (commercial or custom)
- Any transfer to any person or entity of goods, technology, or software by physical, electronic, oral, or visual means with the knowledge or intent that the item(s) will be shipped, transferred, or transmitted to a non-U.S. entity or individual.
- Any disclosure of technical data or information to a foreign entity or individual, by any means, inside or outside of the U.S. This includes interactions with foreign persons visiting or on assignment to Berkeley Lab or while Laboratory personnel are on foreign travel.
- Any transfer of goods, technology, or software, by any means, to a foreign embassy or affiliate.
Only exports defined by the U.S. government to be sensitive are actually impacted by export controls. Such export control sensitivity usually arises for any or all of the following reasons.
- The nature of the export itself
- Concerns about the destination country, organization, or individual
- Concerns about the declared or suspected end use and/or end user of the export (e.g., an individual, an entity such as a laboratory or other organization, or a country)
Non-fundamental Research and Export Control at UMass Boston
The following materials and range of activities might pose potential export control concerns. Exporting is not limited to transferring a document or a piece of equipment.
- Direct exports; Cooperative Research and Development Agreements (CRADAs); certain contracts; and donations, sales, or transfers of surplus equipment
- International and domestic collaborations and technical exchange programs, including lab-to-lab programs
- Publications, such as conference papers, abstracts, and journal articles
- Written materials in general, ranging from memos and letters to trip reports and work notes
- Presentations at conferences and other public meetings, both domestic and foreign
- Visits and assignments by foreign nationals
- Foreign travel by UMass Boston employees or UMass-Boston contractor employees
- Specifications included in proposals or requests for quotations
- Other types of communication such as telephone calls, faxes, emails, and the placement of UMass Boston proprietary materials on the World Wide Web
The Principal Investigator has the Following Responsibilities Related to Export Controls
- Prior to commencing any research, the PI must review and cooperate with ORSP to determine whether any technical information or technology involved in the research is subject to the export control law or regulations and if so, whether any exclusion is available under the export control regulations.
- The PI must in cooperation with the ORSP re-evaluate that determination before changing the scope or adding new staff to the project to determine if such changes alter the initial determination.
- The PI must ensure that export determinations are made far enough in advance to obtain an export license from appropriate agencies, when required and if available.
- The PI must ensure that foreign nationals are excluded from access to restricted data or technology until the availability of an exclusion has been determined, or an export license has been obtained.
The University will assist the PI in assessing the application of such regulations, but primary compliance responsibility rests with the PI of the research.
A project subject to export controls must have a Technology Control Plan (TPC) in place that outlines the procedures to be taken to handle and safeguard the Export-Controlled Information. It is the responsibility of the Principal Investigator (PI) to develop a written TCP which then must be approved and signed by the UMass Boston Vice Provost for Research.
Know Your Customer
U.S. export control policy places considerable responsibility on the exporter for ensuring that the end-use and end-user of an export complies with U.S. export laws. Even uncontrolled items (i.e., items that normally do not require an export license) may require a license or other special approval if the transaction raises proliferation concerns (e.g., weapons of mass destruction, missile technology, nuclear propulsion, and encryption). In fact, exporters can lose their export privileges and be fined or criminally prosecuted if they ship, without prior authorization, normally uncontrolled items to destinations that violate end-use or end-user policy.
In other words, it is your responsibility to "know your customer." As the person most knowledgeable about your work, you must stay alert for any irregularities or abnormal circumstances that might indicate an export is destined for an inappropriate end use, end user, or destination.
If you notice something suspicious, inquire further. You are responsible for making sure that any suspicious circumstances are properly checked out. In any case, do not "self-blind" yourself. That is, do not go out of your way to not learn something for fear that the knowledge might jeopardize your project. If there is a problem, such avoidance will not insulate you or the Laboratory from liability, and could be considered an aggravating factor in enforcement proceedings.
If you ever have a doubt or suspicion about an export or export-control situation, contact the UMass Boston Export Control Officer for assistance. The BIS web site (http://www.bis.doc.gov) also provides some helpful guidelines to follow and red flags to watch out for in "knowing your customer".
- Property Manager: Focuses on export control matters related to export of goods.
- Information Technology Representative: Focuses on export controls related to high performance computing and software.
- Topical/Functional Experts: Provides technical expertise on an as-needed basis.
- Export Control Officer (from ORSP): Focuses on export control issues related to research and technology.
Other Export Control Functions and Responsibilities
While all UMass Boston employees have export control responsibility for their own work, certain employees have special roles in the University's export control efforts. Program and project managers, for example, must consider the need for export licenses or other authorizations in their program/project planning and, if needed, make sure any export control requirements are addressed well in advance of prospective shipping or transfer dates.
Purchasing agents also play a key role in export control. They are responsible for seeing that all the right forms are filled out and proper procedures followed when processing requisitions for commodities or services that are subject to export control. When an export license is required, they are responsible for notifying the parties involved of the specific terms and conditions of that license.
Fundamental Research and Export Control at UMass Boston
The Export Administration Regulations (EAR) have certain exemptions that apply to "Fundamental Research," i.e., research that is ordinarily published in the open literature. These exceptions are formulated below.
- publicly available technologies and software (except for certain software that is controlled for other reasons under the EAR)
- research that is already published or will be published in a journal or presented at an open conference , which is defined as "a conference open to all qualified scientists."; it may be by invitation only, although it may not be a meeting where attendees may not take notes
- technology and software arising from Fundamental Research, which is defined as "basic and applied research that can be distinguished from proprietary research or industrial development"
- educational information, which is defined as information released in the course of instruction at an academic institution. However, encryption software, hardware, firmware and source code is specifically excluded from this exemption
Research conducted at a university (university is defined as "any accredited institution of higher education located in the U.S.") is usually considered to be Fundamental Research. Certain corporate-sponsored research may not qualify. In a CRADA or Work For Others agreement, the sponsor may have rights to the results of the research. This would make the research proprietary, and thus not within the definition of fundamental research. In all cases, contact the UMass Boston Office of Research and Sponsored Programs to determine if exclusion criteria apply.
Penalties for Noncompliance
Export control issues may arise on many fronts, and non-compliance with the statutory and regulatory requirements carry heavy penalties, both civil and criminal. It is incumbent upon everyone that makes up the UMass Boston community to learn how to recognize export control issues when they arise in our daily work and to be knowledgeable of the resources available on campus to deal with them.
Important Note: Unlike other situations in which the University might accept liability and protect its employees, in this case individuals are criminally liable for personally violating the ITAR/EAR/OFAC export controls or embargoes.
- Criminal: up to $1 million per violation and up to 10 years in prison
- Civil: seizure and forfeiture of articles, revocation of exporting privileges, fines up to $500,000 per violation
- Criminal: $50,000 to $1 million or five times the value of export, whichever is greater, per violation, up to 10 years in prison
- Civil: loss of export privileges, fines of $10,000 to $120,000 per violation
- Criminal: up to $1 million and 10 years in prison
- Civil: $12,000 to $55,000 per violation
Applicability of Regulations
For projects that include the use of Export-Controlled Information, the projects falls under the Commerce Department's Export Administration Regulations (EAR) or the State Department's International Traffic in Arms Regulations (ITAR).
Export Administration Regulations
EAR bases its regulations on the Commerce Control List maintained by the Bureau of Industry and Security (BIS). The export control provisions of EAR are intended to serve the national security, foreign policy, nonproliferation, and short supply interests of the U.S. and, in some cases, to carry out its international obligations. Some controls are designed to restrict access to dual use items by countries or persons that might apply such items to uses inimical to U.S. interests. The EAR also include some export controls to protect the United States from the adverse impact of unrestricted export of commodities in short supply.
EAR offers authoritative guidance on the following issues.
- When is an export license necessary and when is it not?
- How do you obtain an export license?
- What policies are followed in considering license applications?
- How do you know when the policies change?
- What are the latest restrictions on exports to certain countries and certain types of goods and services?
- Where are the restrictive trade practices and boycotts prohibited?
- If necessary, where can you obtain further help?
International Traffic in Arms Regulations
The U.S. Department of State controls the export of "defense articles and defense services" under the International Traffic in Arms Regulations (ITAR). Items in this category to be export-controlled are placed on the U.S. Munitions List, which is maintained by the Department of State in conjunction with the U.S. Department of Defense.
The U.S. Munitions List includes such obvious things as firearms, ammunition, and explosives. It also includes all military vehicles (land, air, and sea); spacecraft (including nonmilitary); military and space electronics; protective personnel equipment; guidance and control equipment; and components, auxiliary equipment, and miscellaneous articles related to military equipment. Export of any item or technology on the U.S. Munitions List requires specific authorization from the Department of State.
ITAR regulations focus on the export of defense articles and defense services. These regulations also apply to items that could have military applications, even when those are not explicitly planned. For example, ITAR and EAR rules apply to the following commonly used items: computers; equipment; chemicals; micro-organisms; materials; biological substances; and software codes. An export license may be required if the project involves these and other items in a foreign county and could take 3 to 6 months to acquire.
For practical purposes, ITAR regulations dictate that information and material pertaining to defense and military related technologies may only be shared with U.S. persons unless approval from the U.S. Department of Defense is received or special exemption is used.
It is unlawful under the ITAR to send or take Export-Controlled Information out of the U.S.; disclose orally or visually, or transfer Export-Controlled Information to a foreign person inside or outside the U.S. without proper authorization. Under the ITAR or the EAR, a license may be required for foreign nationals to access Export-Controlled Information.
The Office of Foreign Assets Control
In addition to ITAR and EAR, the Office of Foreign Assets Control (OFAC) of the U.S. Department of the Treasury administers and enforces economic and trade sanctions based on United States foreign policy and national security goals. OFAC prohibits payments or providing anything of value to sanctioned countries, nationals of some countries, and specified entities. OFAC also prohibits travel and other activities to and from embargoed countries and entities.
Generally, OFAC rules override other restrictions and regulations promulgated by ITAR and EAR on export controls. Although the list of sanctioned countries changes, United States policy is to normally deny licenses for Afghanistan, Belarus, Cuba, Iran, Iraq, Libya, North Korea, Syria, Vietnam, and to countries where the U.S. has an arms embargo.
Do these Rules and Regulations Apply to Your Project?
To determine if any of these rules and regulations applies to a project, think broadly about what the activities will be, who will be involved and what equipment and/or supplies will be used. Then screen all projects in foreign countries or with foreign nationals by asking the following general questions.
Does the project involve…
- Shipping equipment or computers to a foreign country?
- Technologies or devices which might have a substantial or dual-use application to military, security or intelligence?
- Collaborating with a foreign colleague as a research or commercial partner even if the PI and the project activities remain in the U.S.?
- Training foreign nationals to use software or equipment or involving foreign nationals as research assistants in the U.S. or abroad?
- Using proprietary information?
- Sending research results or information to a foreign country or to foreign citizens?
- Travel to a foreign country?
- Restrictions by sponsor on publication of results or approval rights?
Put differently, consider whether a UMass Boston employee will...
- Carry a laptop computer into one of the OFAC/embargoed countries?
- Carry a cell phone with a GPS system into a restricted country?
- Accept a grant or contract funding with propriety restrictions on the release of data?
- Ship computers or encrypted software to a foreign country?
- Collaborate with a foreign national or releases information to a foreign national?
If the answer is a possible yes to any of these questions, export control rules may apply. Individuals should consult with the ORSP to determine if export controls pertain and if a license is required.
Commerce Control List: A list of commodities and related technical data that are principally commercial in nature and deemed not appropriate for inclusion on the U.S. Munitions List. Some of these controlled commodities are referred to as “dual-use.” That is, they have an actual or potential military as well as civilian, commercial application. Export of these articles is implemented in the Export Administration Regulation (EAR).
Deemed Export: Any transfer to a citizen or permanent resident of a foreign country, irregardless of where the transfer occurs, is deemed by the U.S. government to be an export to that country. Exceptions of who can receive a transfer are permanent U.S. citizens, i.e., foreign nationals with "green cards, or "protected individuals," i.e., foreign nationals granted political asylum in the U.S.
Defense Service: (1) The furnishing of assistance (including training) to foreign persons, whether in the U.S. or abroad in the design, development, engineering, manufacture, production, assembly, testing, repair, maintenance, modification, operation, demilitarization, destruction, processing or use of defense articles; or (2) The furnishing to foreign persons of any technical data controlled under the ITAR, whether in the U.S. or abroad.
Dual Use: Goods and technology that are not inherently military in nature, and are primarily and inherently commercial or potentially commercial in nature, but that the government has decided may have a dual use for a military purpose, when received or obtained by particular individuals, or for particular purposes, or within particular countries. Dual use is a concept underlying the government's rationale for what items and information, and what individuals and what uses, may require a license. In addition, there are some "purely commercial" items and information that require a license under the EAR.
Educational Information: Information released through instruction in catalog courses and associated teaching laboratories of academic institutions (15 CFR 734.9).
Export: The definition of Export is determined by the appropriate references as indicated by EAR and ITAR.
- EAR: Actual transport or shipment of items out of the U.S. or release of technology or software subject to EAR to a foreign national in the U.S. as described in EAR.
- ITAR: 1) Sending or taking a defense article out of the U.S. in any manner except by mere travel outside of the U.S. by a person whose personal knowledge includes technical data. 2) Transferring registration, control, or ownership to any foreign person of any aircraft, vessel or satellite covered by the U.S. Munitions List whether in the U.S. or abroad. 3) Disclosing (including oral or visual disclosure) or transferring in the United States any defense article to an embassy, any agency or subdivision of a foreign government (e.g., diplomatic missions). 4) Disclosing (including oral or visual disclosure) or transferring technical data to a foreign person, whether in the U.S. or abroad. 5) Performing a defense service on behalf of, or for the benefit of, a foreign person, whether in the U.S. or abroad. 6) A launch vehicle or payload shall not, by reason of the launching of such vehicle, be considered an export. (See 22CFR 120.17 for details.)
Export-Controlled Information: Activities, items, and information related to the design, development, engineering, manufacture, production, assembly, testing, repair, maintenance, operation, modification, demilitarization, destruction, processing, or use of items with a capacity for military application. It does not matter if the actual intended use of Export-Controlled Information is military or civil in nature.
Export-controlled information does not include basic marketing information on function or purpose; general system descriptions; or information concerning general scientific, mathematical, or engineering principles commonly taught in schools, colleges, and universities or information in the public domain.
Fundamental Research: Information, including non-encrypted software code, resulting from basic and applied research in science and engineering conducted at the University of Massachusetts Boston that is ordinarily published and shared broadly within the scientific community and that is not restricted for proprietary reasons or specific national security reasons. The complete definition is available at http://w3.access.gpo.gov/bis/ear/pdf/734.pdf.
Limited Access Authorization: Security access authorization to confidential or secret information granted to non-U.S. citizens requiring such limited access in the performance of their duties.
- Foreign Person: Any natural person who is not a lawful permanent resident as defined by 8 U.S.C. 1101(a)(20)1 or who is not a protected individual as defined by 8 U.S.C. 1324b(a)(3)2. It also means any foreign corporation, business association, partnership, trust, society or any other entity or group that is not incorporated or organized to do business in the U.S., as well as international organizations, foreign governments and any agency or subdivision of foreign governments (e.g., diplomatic missions).
- U.S. Person (From the ITAR – for export control purposes): A Person who is lawful permanent resident as defined by 8 U.S.C. 1101(a)(20) or who is a protected individual as defined by 8 U.S.C. 1324b(a)(3); any corporation, business association, partnership, society, trust, or any other entity, organization or group that is incorporated to do business in the U.S.; and/or any governmental (federal, state or local) entity.
- U.S. Person (From the NISPOM – for classified information purposes): Any form of business enterprise or entity organized, chartered or incorporated under the laws of the U.S. or its possessions and trust territories and any person who is a citizen or national of the U.S.
Protected Individuals: 8 U.S.C. 1324b(a)3 defines a Protected Individual as an individual who is
- a citizen or national of the United States, or
- an alien who is lawfully admitted for permanent residence, is granted the status of an alien lawfully admitted for temporary residence under section 1160(a) or 1255a(a)(1) of this title, is admitted as a refugee under section 1157 of this title, or is granted asylum under section 1158 of this title; but does not include (I) an alien who fails to apply for naturalization within six months of the date the alien first becomes eligible (by virtue of period of lawful permanent residence) to apply for naturalization or, if later, within six months after November 6, 1986, and (ii) an alien who has applied on a timely basis, but has not been naturalized as a citizen within 2 years after the date of the application, unless the alien can establish that the alien is actively pursuing naturalization, except that time consumed in the Service’s processing the application shall not be counted toward the 2-year period.
Technical Data: Information of any kind that can be used, or adapted for use, in the design, production, manufacture, utilization, or reconstruction of articles or materials. These data may take a tangible form, such as a model, prototype, blueprint, or an operating manual; or these data may take an intangible for such as technical services. The complete definition of technical data is available at http://w3.access.gpo.gov/bis/ear/pdf/772.pdf.
U.S. Person: can be a
- U.S. citizen
- permanent resident who does not work for a foreign company, a foreign government, or a foreign governmental agency/organization
- political asylee
- part of the U.S. government
- corporation, business, organization, or group that is incorporated in the U.S. under U.S. law
EAR (Export Administration Regulations)/U.S. Department of Commerce
- Introduction to Export Controls: http://www.bis.doc/gov/licensing/exportingbasics.htm
- EAR Control List: http://www.access.gpo.gov/bis/
- EAR, Bureau of Industry and Security: http://www.bis.doc.gov
- EAR Database: http://www.access.gpo.gov/bis/index.html
ITAR (International Traffic in Arms Regulations)/U.S. Department of Commerce and the U.S. Department of State
- ITAR: http://pmdtc.org/reference.htm
- ITAR, Directorate of Defense Trade Controls: http://pmddtc.state.gov/itar_index.htm
OFAC (Office of Foreign Assets Controls) of the U.S. Treasury Department
OFAC, Sanction Programs: http://www.treas.gov/offices/enforcement/ofac
Comprehensive Guidelines for License Applications to Engage in Travel-Related Transactions Involving Cuba