1. 1 EXPORT CONTROLS & SANCTIONS COMPLIANCE David Brady Director and Facilities Security Officer Office of Export and Secure Research Compliance Virginia Tech Erica Kropp Office of Research Administration & Advancement University of Maryland Center for Environmental Science June 22, 2009

2. 2 What are Export Controls? US laws that regulate the distribution to foreign nationals and foreign countries of strategically important technology, services and information for reasons of foreign policy and national security. Export control laws apply to all activities – not just sponsored research projects.

3. 3 What is an Export?  Transfer of controlled technology, information, equipment, software, source code or services (ITAR) to a foreign person in the US or abroad by any means; e.g., actual shipment outside the US visual inspection in or outside US written or oral disclosure

4. 4 What is a “Deemed” Export?  Any release of technology or source code subject to the EAR to a foreign national within the U.S. Technology: specific information required for the development, production, or “use” of a controlled item Such release shall be “deemed” to be an export to the country or countries of origin of the foreign national.

5. 5 Who are U.S. Persons? U.S. citizens U.S. citizens Aliens who are “Lawful Permanent Residents” (Green Card holders) Other “Protected Individuals” designated an asylee or refugee a temporary resident under amnesty provision Any entity incorporated to do business in the U.S.

6. 6 Who are Foreign Persons? “Foreign Person” means everyone else:  Any foreign interest and any US Person effectively owned or controlled by a foreign interest Includes foreign businesses not incorporated in the U.S., persons representing other Foreign Persons, any foreign government Includes: H1B Work Visa, F1 Study Visa, J1 Training Visa, E1 Investors Visa, TN Work Visa, L1 Intra-Company Transfer Visa, K and V Fiancée Visas EAR does not use the term foreign person instead refers to “foreign national”- they mean the same thing

7. 7 Definition: License  Formal written permission (with conditions and time limits) from the Department of State or the Department of Commerce which grants permission to export a controlled item or technology to a foreign national, or in the case of the Department of Treasury, grants permission to travel to and/or perform certain activities in/for sanctioned countries.

8. 8 Use of terms  Exclusion – Outside the regulations requiring a license; not subject to the regulations  Exemption (ITAR/OFAC) or Exception (EAR) - License not required for item or activity as defined within the regulations.

9. 9 Who Controls Exports & Sanctions?  U.S. Dept of Commerce*  Bureau of Industry and Security  Patent and Trademark Office  Bureau of the Census  U.S. Dept of Energy  Nuclear Regulatory Commission  U.S. Dept of Homeland Security  Customs and Border Protection  U.S. Department of Justice  Bureau of Alcohol, Tobacco, Firearms, and Explosives  U.S. Dept of State*  Directorate of Defense Trade Controls  U.S. Dept of Treasury*  Office of Foreign Assets Control *Focus of this presentation

10. 10 Responsible US Agencies  State Department : Inherently military technologies--International Traffic in Arms Regulations (ITAR)  Examples usually clearly military: - Firearms and Armaments -Tanks and Military Vehicles -Developmental Military Aircraft and Vessels -Experimental Military Electronics -Military Training Equipment -Protective Personnel Equipment  But also spacecraft/satellites & related equipment

11. 11 Responsible US Agencies  Commerce Department : “Dual-Use” technologies (primary civil use) -- Export Administration Regulations (EAR)  Examples not as clearly subject to controls: Computers Marine Materials, Chemicals, Micro-Organisms, Toxins Sensors and Lasers Nuclear Materials

12. 12 Responsible US Agencies  Treasury Department, Office of Foreign Assets Control (OFAC): Prohibits transactions with countries subject to boycotts, trade sanctions, embargoes  Examples: Balkans, Belarus, Cuba, Iran, Iraq, Liberia, Sudan, Syria, North Korea http://www.treas.gov/offices/enforcement/ofac/programs/ind ex.shtml

13. 13 Export Controls or Sanctions  Export controls are placed based on commodities and technologies (EAR/ITAR)  Sanction programs are country specific and controls may cover any and all technologies and activities-including financial transactions (OFAC)

14. 14 Restricted Access Parties Lists In addition to export and sanctioned countries, there are also restricted entities and individuals: Department of Commerce Denied Persons [EAR] Department of Commerce Entity List [EAR] Department of Commerce "Unverified" List [EAR] U.S. Treasury Department Specially Designated Nationals and Blocked Persons, including Cuba and Merchant Vessels, Iran, Iraq and Merchant Vessels, Sudan Blocked Vessels [OFAC] Department of State Designated Terrorist Organizations Department of State Terrorist Exclusion List (TEL)

15. 15 Why Do We Need to Worry & Act?  Public Laws - law of the land  Element of university compliance  Government attention and expectations  Violations can bring: Administrative Penalties  Civil & Criminal Penalties  For both individuals and university  Criminal (willful) violations include prison

16. 16 Exports, Sanctions & Higher Ed  Export Laws on the books since the 1940’s  NSDD 189  1985-1993 ITAR/EAR Fundamental research exclusions  1999 Satellites and related technology moved from Commerce Dept to State Dept  9/11  2002 GAO report faults Commerce/State for lax regulation  2004 Commerce/State IG Reports  2004 OFAC allows some academic collaborations with sanctioned countries

17. 17 Exports, Sanctions & Higher Ed  2005 Commerce/State tighten regs/controls  2007 ITT Nightvision convicted on ITAR export felonies, fined $100M  2008 Young Memo DoD 6.1, 6.2 funded university research should not be restricted- 6.3+ should be restricted  2008 U Tenn professor convicted of 17 ITAR export felonies involving Chinese & Iranian graduate students  2008 Lloyds of London fined $800M to settle OFAC sanction violations

18. 18 Implications of Export & Sanctions Laws  No effect on most university research  Potential impact on Ability of foreign students or researchers to participate in research involving a controlled technology (mostly under ITAR) Ability to provide services (including training in the use of controlled equipment) to foreign persons (ITAR, EAR, OFAC) Ability to send controlled equipment to foreign countries (ITAR, EAR, and OFAC)

19. 19 Implications of Export & Sanctions Laws  Factor that can extend award negotiation time – may involve institutional decisions  Factor to be considered if/when accepting another parties information  Likely to require additional internal review processes  Time and resources – can effect project schedules – even after the award  PI’s need to be involved

20. 20 Disseminating Information aka “Deemed Exports”  In the absence of an exclusion, a license or other government approval must be obtained from Commerce or State to share controlled technical information with a foreign person in the U.S. or abroad.  Methods of disclosure include: Physical release of technical data Telephone discussions or fax E-mail communications Computer data disclosure Face-to-face discussions Training sessions Tours which involve visual inspections

21. 21 Exclusions Dissemination of information may fall outside the export regulations if one of three exclusions applies:  Public Domain Exclusion (ITAR,EAR,OFAC)  Fundamental Research Exclusion (ITAR, EAR)  Education Exclusion (ITAR, EAR)

22. 22 Public Domain Exclusion (22 CFR 120.11, 125.1; 15 CFR 734.7)  You stay outside the regulations when you share technical data or information with foreign person inside or outside of US if: It has already been published; Available in libraries or through newsstands, bookstores, subscriptions, or free websites; or Disclosed in published patent applications

23. 23 Fundamental Research Exclusion (FRE)  You stay outside the regulations when disclosing to foreign persons information that is “published and which is generally accessible or available to the public [through, for example,] fundamental research in science and engineering at universities where the resulting information is ordinarily published and shared broadly in the scientific community.”

24. 24 Fundamental Research NSDD 189, 22 CFR 120.11 (a)(8), 125.1; 15 CFR 734.8, 734.11)  Basic or applied research at an accredited U.S. institution of higher learning  No publication restrictions  If federally funded, no access and dissemination restrictions on results  No national security restrictions As long as the above conditions are met, the results of your research are not subject to ITAR/EAR license restrictions even if the subject area of the research is export restricted.

25. 25 Fundamental Research The FRE does not apply to: Technology, software, or items that are already designated or identified as subject to export controls Defense articles or defense services  Department of State guidance requires that an export license be obtained for a foreign person… who is to have access to a defense article in the United States.  DoS considers all such access to be a “defense service”.

26. 26 Fundamental Research The FRE may not apply to:  Outside the U.S. if ITAR  Some research subject areas, i.e., Weapons of Mass Destruction (WMDs) Encryption software or source code Items or technologies controlled specifically by another agency (i.e., Nuclear Regulatory Agency)

27. 27 Fundamental Research The FRE does not apply to: Development: no longer basic or applied research Design, development, testing, or evaluation of a potential new product or service (or of an improvement in an existing product or service) to meet specific performance requirements or objectives

28. 28 The Fundamental Research Exclusion is Destroyed if The university accepts any contract clause that:  Restricts the access and dissemination of results to foreign persons  Gives the sponsor a right to approve publications resulting from the research  Otherwise operates to restrict participation in research and/or access to and disclosure of research results

29. 29 Fundamental Research Exclusion Vulnerability  “Side deals” between a PI and sponsor destroy the fundamental research exclusion and may also violate institutional policies on openness in research These could take place via a nondisclosure or confidentiality agreement signed by PI or through acceptance of export-controlled information from others

30. 30 Many Universities Work to Protect fundamental research exclusion by eliminating through negotiations all contractual clauses that restrict university control over publications or limit access to or participation in research.

31. 31 Educational Exclusion  General science, math, and engineering commonly taught at schools and universities (ITAR (22 CFR § 120.11))  Information conveyed in courses listed in course catalogues and in their associated teaching labs of any academic institution (EAR (15 CFR § 734.9) )

32. 32 Providing Services Under OFAC  In general, OFAC programs prohibit the provision of services to or from countries, entities, and individuals subject to US sanctions and embargoes w/o a license.  Services include: Carrying out field research in sanctioned countries Conducting surveys and interviews in boycotted countries

33. 33 Providing Services cont’d Providing educational, marketing & business services to persons in sanctioned countries Creating new information materials at the behest of persons in a sanctioned country Engaging the services of persons in a sanctioned country to develop new information materials Some exemptions apply for academic collaborations ***Note: Restrictions vary by country***

34. 34 Countries Under Embargoes Ex: Belarus, Burma (Myanmar), Cuba, Iran, Iraq*, Liberia, Sudan, Syria, North Korea * Iraq’s sanctions have changed since Iraq war Embargoes/Sanctions Subject to Change, always check OFAC Website : http://www.treas.gov/offices/eotffc/ofac/san ctions/index.html http://www.treas.gov/offices/eotffc/ofac/san ctions/index.html

35. 35 Equipment Use  Generally, use of EAR export controlled equipment is not a deemed export. Deemed export occurs only if controlled technology is transferred.  It is understood by the Commerce Department that there is no distinction between product of research and knowledge of equipment used in research.

36. 36 Equipment Use However –  There are no exclusions that allow foreign persons to use equipment controlled for use technology which requires the access to company/manufacturer proprietary manual or instructions for the use.  Should be treated as using another parties export controlled material.

37. 37 Equipment Use  ITAR Use: Design, development, production, manufacture, assembly, operation, repair, testing, maintenance or modification of defense articles  EAR Use: Operation, installation (including on- site installation), maintenance (checking), repair, overhaul and refurbishing

38. 38 Shipping Controlled Equipment Abroad  A license is required to ship equipment controlled by ITAR to any foreign country (few exemptions).  A license may be required to ship equipment controlled under the EAR out of the US depending on what the equipment is, where it is being sent, who will be using it for what purpose (many exceptions).

39. 39 Shipping Equipment cont’d  The process to classify equipment under the EAR is detailed and time consuming. months  It may take months to obtain a license from State or Commerce. Note: A license may be required to ship software out of the US.

40. 40 Shipping Equipment cont’d There is a presumption under OFAC sanction programs that any and all shipments of equipment and provision of services to countries under sanction or persons in those countries are ILLEGAL.

41. 41 Examples of Application to University Research  Export of research products — Underwater research vehicle could require ITAR license if designed for military applications; would require Commerce Department authorization if designed for civilian purposes — Specially designed electronic components could be controlled  Temporary transfer of research equipment abroad — Carrying scientific equipment to certain destinations for research may require authorization (e.g., Iran, Syria, China, etc.)  Software development — Software that is provided to the public for free (including the source code) may not require licenses, but proprietary software of controlled technology could require licensing — Encryption technology could require licenses or could be prohibited for transfers to certain foreign nationals/countries

42. 42 License Example University archeologists desire to take GPS systems to France to use in research project with foreign colleagues:  GPS equipment is covered by EAR Category 7, Navigation and Avionics, under ECCN nos. 7A005, 7A105, and 7A994. Two of those entries redirect the exporter to ITAR.  The exporter must evaluate the EAR entries and ITAR Category XV, Spacecraft Systems and Associate Equipment, to identify the appropriate licensing authority and classification.

43. 43 Laptop Exception ( EAR )  Excluding countries under sanction, faculty who wish to take their laptops out of the country to use in a project that qualifies as fundamental research may be able to do so under the license exception for temporary export (TMP) if the laptop meets the requirement for "tools of trade" and faculty retain control of the laptop at all times.(15 CFR Part 740.9).

44. 44 Accepting Export Controlled Information  In deciding whether to accept an award that requires the institution to receive export controlled information, consider whether the information is Central to the project (probably rendering the entire project export controlled) or Tangential in that the PI needs the information but not others working on the project.

45. 45 Accepting Export Controlled Information cont’d  If you decide the information is tangential Execute a nondisclosure agreement Require that the information be clearly marked “export controlled,” and Work with the PI to firewall the information and have the PI sign a statement accepting responsibility for protecting the information

46. 46 Accepting Export Controlled Information & Material  Check if your libraries have accepted controlled information or signed DoD form DD2345 ( Militarily Critical Technical Data Agreement). Acceptance creates compliance issues for individuals and the university.  Look for Distribution Statement A: “Approved for Public Release, Unlimited Distribution”  Material received under Material Transfer Agreements (MTA) need to be reviewed.

47. 47 Liability and Violations  Liability is personal and institutional and may take the form of: Administrative penalties Monetary fines Jail time  Voluntary disclosure of violations may serve as a “mitigating factor” in deciding penalties.

48. 48 Develop a Compliance Plan The Federal Government expects every institution to have a basic compliance program/plan in place which includes screening of use of technology by foreign persons. (Not to be confused with a Technology Control Plan which must be in place to safeguard controlled technology developed or received and is not subject to an exclusion or exception.)

49. 49 Plan Elements  Inform/educate key university administrators of legal requirement to implement a compliance plan.  Designate a responsible (“empowered”) export compliance person (ECO)  Designate person/office to serve as the point person for researchers and government agencies on export control issues (if not ECO).  ECO should have legal support – internal counsel and/or possibly outside counsel.

50. 50 Plan Elements cont’d  Conduct a risk review of sponsored projects for vulnerabilities The greater the intersection of Non U.S. Persons and ITAR/EAR subject research, the greater the risk of university export control violations You can’t manage what you don’t know you have  Establish a training program for research, tech transfer, procurement and shipping administrators.  Establish an awareness program for faculty and other researchers.

51. 51 Plan Elements cont’d  Establish written procedures for reviewing proposals and awards; e.g., Add questions to internal proposal routing form. Develop a check list for contract/grant administrators. Develop and implement processes for deciding if a project is controlled and whether an exclusion applies. Develop an export control information section on your compliance website

52. 52 Plan Elements cont’d Decide who has authority to accept projects that require a license (and may violate university academic policies) and under what circumstances the institution will accept a project that requires a license. Document all export control decisions.

53. 53 University Vulnerabilities  How large a foreign national population?  USML or CCL-listed research?  Contracts with DoD, NASA, DHS, Intel Agencies?  Proprietary technology research with industry or government?  Accepting another parties proprietary information?  Select agents? BSL3+ Labs?  International sponsors, subcontractors?

54. 54 University Vulnerabilities  Dedicated secure facilities for export controlled research?  Shipping equipment to a foreign country?  Collaborating with foreign colleagues in foreign countries?  Training foreign persons in using equipment?  Working with a country subject to US sanctions?  Foreign visitors to your labs? Post data and results on Websites open the public?

55. 55 Items of Concern for Faculty  Restrictive sponsored research terms & conditions  Proprietary info & software from others  Keeping own research results/software proprietary  Non-sponsored research at university  Projects in your garage  Attending “closed” meetings  Faculty start-up companies (no FRE)  Providing services (not research)  Protecting students  Consulting work

56. Managing the Deemed Export Risk Restricted research & defense articles and defense services bring unwanted risk of deemed export violations to campus… two options to contain the risk: Just Say “No”  Operate within exclusions, or…  Lock up and license: Accept greater risk of noncompliance and penalties: Requires greater allocation of compliance resources Manage the process to the risk Impose extra security measures

57. 57 Ensuring University is Export and Sanctions Compliant  Conduct risk assessment  Identify vulnerabilities  Develop strategy for compliance  Take initial steps  Provide for recurring efforts  Recognize this as long term compliance area as part of overall university compliance program

58. 58 Questions? David Brady 540-231-3801 dbrady@vt.edu Erica Kropp 410-221-2015 ekropp@umces.edu June 22, 2009