1. PRI Export Control System
General Training for PRI Registrar Staff and Independent Contractors
Updated April 2018

2. PRI’s Export Control System
PRI has maintained an Export Control system since April 2005 to ensure compliance with U.S. Export Control Regulations
It is important for all PRI employees and Independent Contractors to be aware of PRI’s EC system, and their specific responsibilities within the system, to ensure PRI remains compliant with U.S. Export Control Regulations
The following presentation will outline key aspects of U.S. Export Control Regulations, the impact on PRI, and PRI’s system to ensure compliance with regulations

3. PRI and U.S. Export Regulations
Why does the U.S. have these regulations?
What are the regulations?
What is technical data?
What is an export?
What is a foreign person?
How is PRI impacted?
PRI’s EC system

4. Why does the U.S. have export regulations?
There are a number of countries who wish to do harm to the United States
The government wants to assure that certain products, technologies, software and know-how do not fall into the wrong hands
The U.S. protects information and products from other countries as they deem is in their best interest
The interests of the United States are protected through export regulations, in the same way companies protect their information through proprietary restrictions (e.g., Non-Disclosure Agreements)

5. Top three reasons for U.S. export regulations:
National Security
Foreign Policy
Non Proliferation

6. What are the regulations?
Two major regulations:
International Traffic in Arms Regulations (ITAR) protect military products, items, technology, and know how
Export Administration Regulations (EAR) protect commercial or dual-use products, items, technology, know how
The regulations define the items and technical data that must be protected, and the persons allowed to access the protected items/data.

7. The ITAR
Administered by U.S. Department of State (Directorate of Defense Trade Controls)
Broadly defined and tightly controlled
Includes all items on United States Munitions List
If an item was designed, developed or modified for a military application; and is found on the United States Munitions List, then it is subject to the ITAR

8. The EAR
Administered by U.S. Department of Commerce (Bureau of Industry and Security)
Detailed item descriptions and varying levels of control
Includes all items on Commerce Control List
If an item was designed for commercial or dual-use (commercial and military), and it is found on the Commerce Control List, then it is controlled by the EAR

9. What is technical data? Technical data …
helps a person design, develop or manufacture an item
can exist on paper or digitally
can be stored in your mind and exported through face-to-face or other communication with a Foreign Person
includes all types of information which is not in the public domain

10. Technical data defined in ITAR
“Technical data is:
Information, other than software, which is required for the design, development, production, manufacture, assembly, operation, repair, testing, maintenance or modification of defense articles
This includes information in the form of blueprints, drawings, photographs, plans, instructions or documentation.

11. Technical data defined in ITAR
“Technical data also includes:
Classified information relating to defense articles and defense services
Information covered by an invention secrecy order
Software directly related to defense articles

12. Technical data defined in EAR
May take forms such as blueprints, plans, diagrams, models, formulae, tables, engineering designs and specifications, manuals and instructions written or recorded on other media or devices such as disk, tape, read-only memories.

13. What is an export?
Any item sent from the United States to a foreign destination (company or person) is an export
The U.S. government controls exports based upon the item and foreign destination. For example,
An X-box listed as a dual use item on the commerce control list under EAR cannot be exported to countries like North Korea, Cuba, Iran, etc.
A drawing of a landing gear listed on the munitions list under ITAR cannot be exported to any foreign person without a license
Exports can be …
physical (sending an item to a foreign country or person)
aural or verbal (telling a Foreign Person information about an item)
visual (a Foreign Person sees information about an item … even if they see it on your laptop in a public place)

14. U.S. Persons and Foreign Persons
U.S. Persons are U.S. citizens or Permanent Resident Aliens (green card holders)
Foreign Persons are everyone else
The term “Person” in this context also applies to companies
Generally, U.S. Persons are allowed access to items, technical data, and know how listed in U.S. ITAR and EAR regulations

15. How is PRI impacted? ITAR and EAR are the law
The U.S. Government takes these laws very seriously
PRI activities create the opportunity for technical data controlled under ITAR and EAR to be exported to Foreign Persons
PRI can be penalized for non-compliance

16. Penalties Fines Imprisonment Government oversight
Penalties can be civil or criminal
Penalties can be imposed against both companies and individuals
Violations are public record

17. Maximum Penalties
EAR
Civil penalties may be the greater of $250,000 or twice the value of the transaction.
Criminal penalties may be up to $1,000,000 and/or years imprisonment.
ITAR
Civil penalties up to $500,000 per violation
Criminal penalties up to $1,000,000 per violation and/or 10 years imprisonment

18. PRI’s Export Control System
PRI developed an Export Control system to ensure compliance with U.S. Export Control Regulations
PRI’s EC system is defined in PRI-AD-POL-03 that is maintained on PRI’s internal network (SharePoint)
The policy:
Requires Staff to disclose their nationality
Requires Staff to be knowledgeable of EC requirements and to follow the policy
Includes stakeholder responsibilities for identifying and controlling technical data
Defines control of technical data in RMS or OASIS

19. Restricted technical data
The PRI EC system and associated procedures use the term restricted technical data
Restricted technical data is a general term used by PRI to indicate items, technical data, and know how which are subject to U.S. export regulations
Restricted technical data must be controlled and cannot be exported to foreign persons
Restricted technical data requires authorization from the U.S. government prior to export (license), or have some other type of restriction or consideration required prior to export
PRI’s system is based upon controlling access to restricted technical data as opposed to obtaining licenses to export restricted technical data

20. Control of restricted technical data
PRI’s EC system is designed to
Control access to restricted technical data during the audit
Prevent restricted technical data from being stored in RMS or OASIS, or within PRI computers, networks or systems
Prevent restricted technical data from being disclosed/shared during PRI sponsored meetings or events

21. Control during the audit
Auditors are classified as U.S. Persons (Unrestricted) or Foreign Persons (Restricted)
The Auditee communicates that restricted technical data is part of their audit by answering the ITAR/EAR question in RMS or OASIS
Restricted auditors are not scheduled on ITAR/EAR audits
Unrestricted auditors are not allowed to remove restricted technical data from the Auditee’s facility or retain on personal computers
Restricted auditors that suspect restricted technical data is part of the audit are to stop the audit and contact PRI

22. Control of databases, computers, network and email systems
Audit Report Reviewers are classified as U.S. Persons (Unrestricted) or Foreign Persons (Restricted)
All submitted audits are quarantined until they are reviewed by an Unrestricted reviewer and any restricted technical data removed prior to the audit being released into the system
Auditees are not permitted to post restricted technical data into RMS or OASIS or send restricted technical data to the reviewer via
Restricted technical data that is posted in RMS or OASIS is removed by an Unrestricted reviewer
Restricted technical data that is ed to a reviewer is deleted immediately
Restricted technical data that must be reviewed as part of the audit is sent to a secure system, reviewed by an Unrestricted reviewer, and discarded

23. Stakeholder Responsibilities
Auditees:
Recognize restricted technical data associated with the audit
Communicate the ITAR/EAR status of the audit
Safeguard restricted technical data during the audit
Must not post restricted technical data in RMS or OASIS
Are not to disclose restricted technical data at meetings and events

24. Auditor Responsibilities
Provide proof of citizenship to PRI and notify PRI of any changes
Communicate their EC status to the Auditee during the Opening Meeting
Unrestricted auditors must safeguard restricted technical data during the audit
Unrestricted auditors must not post restricted technical data in RMS or OASIS
Restricted auditors are to stop the audit and contact PRI if they suspect that restricted technical data is part of the audit
Report any potential EC issues to PRI immediately

25. Staff Responsibilities
Provide proof of citizenship to PRI and notify PRI of any changes
Know your EC status (Unrestricted or Restricted)
Understand PRI’s EC policy
Know the EC requirements for your specific job duties
If your status is “Restricted”, do not access restricted technical data
If you know or suspect an EC violation or issue, contact your supervisor immediately
If you are unsure how to proceed, ask questions before you act.

26. If you have questions about this information, contact:
Pete Kucan