Transcript Faculty Orientation - Virginia Institute of Marine Science

EXPORT CONTROLS &
SANCTIONS COMPLIANCE
David Brady
Director and Facilities Security Officer
Office of Export and Secure Research Compliance
Virginia Tech
Erica Kropp
Office of Research Administration & Advancement
University of Maryland Center for Environmental Science
June 22, 2009
1
What are Export Controls?
US laws that regulate the distribution to
foreign nationals and foreign countries of
strategically important technology, services
and information for reasons of foreign
policy and national security.
Export control laws apply to all activities –
not just sponsored research projects.
2
What is an Export?

Transfer of controlled technology,
information, equipment, software,
source code or services (ITAR) to a
foreign person in the US or abroad by
any means; e.g.,
 actual shipment outside the US
 visual inspection in or outside US

written or oral disclosure
3
What is a “Deemed” Export?

Any release of technology or source
code subject to the EAR to a foreign
national within the U.S.


Technology: specific information
required for the development,
production, or “use” of a controlled
item
Such release shall be “deemed” to be
an export to the country or countries of
origin of the foreign national.
4
Who are U.S. Persons?
U.S. citizens
 Aliens who are “Lawful Permanent
Residents”
(Green Card holders)
 Other “Protected Individuals”
 designated an asylee or
refugee
 a temporary resident under
amnesty provision
Any entity incorporated to do
business in the U.S.

5
Who are Foreign Persons?
“Foreign Person” means everyone else:
 Any
foreign interest and any US
Person effectively owned or controlled
by a foreign interest


Includes foreign businesses not incorporated in
the U.S., persons representing other Foreign
Persons, any foreign government
Includes: H1B Work Visa, F1 Study Visa, J1
Training Visa, E1 Investors Visa, TN Work Visa,
L1 Intra-Company Transfer Visa, K and V Fiancée
Visas
EAR does not use the term foreign person
instead refers to “foreign national”they mean the same thing
6
Definition: License

Formal written permission (with
conditions and time limits) from the
Department of State or the Department
of Commerce which grants permission to
export a controlled item or technology to
a foreign national, or in the case of the
Department of Treasury, grants
permission to travel to and/or perform
certain activities in/for sanctioned
countries.
7
Use of terms

Exclusion – Outside the regulations requiring
a license; not subject to the regulations

Exemption (ITAR/OFAC) or Exception (EAR) License not required for item or activity as
defined within the regulations.
8
Who Controls Exports & Sanctions?

U.S. Dept of Commerce*




U.S. Dept of Energy


Bureau of Alcohol, Tobacco, Firearms, and Explosives
U.S. Dept of State*


Customs and Border Protection
U.S. Department of Justice


Nuclear Regulatory Commission
U.S. Dept of Homeland Security


Bureau of Industry and Security
Patent and Trademark Office
Bureau of the Census
Directorate of Defense Trade Controls
U.S. Dept of Treasury*
 Office of Foreign Assets Control
*Focus of this presentation
9
Responsible US Agencies


State Department: Inherently military
technologies--International Traffic in Arms
Regulations (ITAR)
Examples usually clearly military:
-Firearms and Armaments
-Tanks and Military Vehicles
-Developmental Military Aircraft and Vessels
-Experimental Military Electronics
-Military Training Equipment
-Protective Personnel Equipment

But also spacecraft/satellites & related
equipment
10
Responsible US Agencies


Commerce Department: “Dual-Use”
technologies (primary civil use) -- Export
Administration Regulations (EAR)
Examples not as clearly subject to controls:





Computers
Marine
Materials, Chemicals, Micro-Organisms, Toxins
Sensors and Lasers
Nuclear Materials
11
Responsible US Agencies

Treasury Department, Office of Foreign
Assets Control (OFAC): Prohibits transactions
with countries subject to boycotts, trade
sanctions, embargoes

Examples: Balkans, Belarus, Cuba, Iran, Iraq,
Liberia, Sudan, Syria, North Korea
http://www.treas.gov/offices/enforcement/ofac/programs/ind
ex.shtml
12
Export Controls or Sanctions


Export controls are placed based on
commodities and technologies
(EAR/ITAR)
Sanction programs are country specific
and controls may cover any and all
technologies and activities-including
financial transactions (OFAC)
13
Restricted Access Parties Lists
In addition to export and sanctioned
countries, there are also restricted entities
and individuals:
•
Department of Commerce Denied Persons [EAR]
•
Department of Commerce Entity List [EAR]
•
Department of Commerce "Unverified" List [EAR]
•
U.S. Treasury Department Specially Designated Nationals
and Blocked Persons, including Cuba and Merchant
Vessels, Iran,
Iraq and Merchant Vessels, Sudan Blocked Vessels [OFAC]
•
Department of State Designated Terrorist Organizations
•
Department of State Terrorist Exclusion List (TEL)
14
Why Do We Need to Worry & Act?




Public Laws - law of the land
Element of university compliance
Government attention and expectations
Violations can bring:


Administrative Penalties
Civil & Criminal Penalties
 For both individuals and university
 Criminal (willful) violations include prison
15
Exports, Sanctions & Higher Ed








Export Laws on the books since the 1940’s
NSDD 189
1985-1993 ITAR/EAR Fundamental research
exclusions
1999 Satellites and related technology moved from
Commerce Dept to State Dept
9/11
2002 GAO report faults Commerce/State for lax
regulation
2004 Commerce/State IG Reports
2004 OFAC allows some academic collaborations
with sanctioned countries
16
Exports, Sanctions & Higher Ed





2005 Commerce/State tighten regs/controls
2007 ITT Nightvision convicted on ITAR export
felonies, fined $100M
2008 Young Memo DoD 6.1, 6.2 funded university
research should not be restricted- 6.3+ should be
restricted
2008 U Tenn professor convicted of 17 ITAR export
felonies involving Chinese & Iranian graduate
students
2008 Lloyds of London fined $800M to settle OFAC
sanction violations
17
Implications of Export & Sanctions Laws


No effect on most university research
Potential impact on



Ability of foreign students or researchers to
participate in research involving a
controlled technology (mostly under ITAR)
Ability to provide services (including
training in the use of controlled equipment)
to foreign persons (ITAR, EAR, OFAC)
Ability to send controlled equipment to
foreign countries (ITAR, EAR, and OFAC)
18
Implications of Export & Sanctions Laws





Factor that can extend award negotiation
time – may involve institutional decisions
Factor to be considered if/when accepting
another parties information
Likely to require additional internal review
processes
Time and resources – can effect project
schedules – even after the award
PI’s need to be involved
19
Disseminating Information
aka “Deemed Exports”


In the absence of an exclusion, a license or
other government approval must be obtained
from Commerce or State to share controlled
technical information with a foreign person in
the U.S. or abroad.
Methods of disclosure include:







Physical release of technical data
Telephone discussions or fax
E-mail communications
Computer data disclosure
Face-to-face discussions
Training sessions
Tours which involve visual inspections
20
Exclusions
Dissemination of information may fall
outside the export regulations if one of
three exclusions applies:



Public Domain Exclusion (ITAR,EAR,OFAC)
Fundamental Research Exclusion (ITAR,
EAR)
Education Exclusion (ITAR, EAR)
21
Public Domain Exclusion
(22 CFR 120.11, 125.1; 15 CFR 734.7)

You stay outside the regulations when
you share technical data or information
with foreign person inside or outside of
US if:



It has already been published;
Available in libraries or through newsstands,
bookstores, subscriptions, or free websites;
or
Disclosed in published patent applications
22
Fundamental Research Exclusion (FRE)
 You stay outside the regulations when
disclosing to foreign persons information that
is “published and which is generally
accessible or available to the public [through,
for example,] fundamental research in science
and engineering at universities where the
resulting information is ordinarily published
and shared broadly in the scientific
community.”
23
Fundamental Research
NSDD 189, 22 CFR 120.11 (a)(8), 125.1; 15 CFR 734.8, 734.11)
 Basic
or applied research at an accredited U.S.
institution of higher learning
 No publication restrictions
 If federally funded, no access and dissemination
restrictions on results
 No national security restrictions
As long as the above conditions are met, the results
of your research are not subject to ITAR/EAR license
restrictions even if the subject area of the research is
export restricted.
24
Fundamental Research
The FRE does not apply to:
•
•
Technology, software, or items that are
already designated or identified as
subject to export controls
Defense articles or defense services
 Department of State guidance
requires that an export license be
obtained for a foreign person… who is
to have access to a defense article in
the United States.
 DoS considers all such access to be a
“defense service”.
25
Fundamental Research
The FRE may not apply to:

Outside the U.S. if ITAR

Some research subject areas, i.e.,
Weapons of Mass Destruction
(WMDs)
 Encryption software or source code
 Items or technologies controlled
specifically by another agency (i.e.,
Nuclear Regulatory Agency)

26
Fundamental Research
The FRE does not apply to:
Development: no longer basic or applied research
Design, development, testing, or evaluation of a
potential new product or service (or of an
improvement in an existing product or service)
to meet specific performance requirements or
objectives
27
The Fundamental Research
Exclusion is Destroyed if
The university accepts any contract clause that:
 Restricts the access and dissemination of
results to foreign persons
 Gives the sponsor a right to approve
publications resulting from the research
 Otherwise operates to restrict participation in
research and/or access to and disclosure of
research results
28
Fundamental Research Exclusion
Vulnerability

“Side deals” between a PI and sponsor
destroy the fundamental research
exclusion and may also violate
institutional policies on openness in
research

These could take place via a nondisclosure or
confidentiality agreement signed by PI or
through acceptance of export-controlled
information from others
29
Many Universities Work to
Protect fundamental research
exclusion by eliminating through
negotiations all contractual
clauses that restrict university
control over publications or limit
access to or participation in
research.
30
Educational Exclusion


General science, math, and engineering
commonly taught at schools and
universities (ITAR (22 CFR § 120.11))
Information conveyed in courses listed in
course catalogues and in their associated
teaching labs of any academic institution
(EAR (15 CFR § 734.9) )
31
Providing Services Under OFAC


In general, OFAC programs prohibit
the provision of services to or from
countries, entities, and individuals
subject to US sanctions and
embargoes w/o a license.
Services include:


Carrying out field research in sanctioned
countries
Conducting surveys and interviews in
boycotted countries
32
Providing Services cont’d
Providing educational, marketing & business
services to persons in sanctioned countries
 Creating new information materials at the
behest of persons in a sanctioned country
 Engaging the services of persons in a
sanctioned country to develop new
information materials
 Some exemptions apply for academic
collaborations
***Note: Restrictions vary by country***

33
Countries Under Embargoes
Ex: Belarus, Burma (Myanmar), Cuba,
Iran, Iraq*, Liberia, Sudan, Syria,
North Korea
*Iraq’s sanctions have changed since Iraq war
Embargoes/Sanctions Subject to
Change, always check OFAC Website :
http://www.treas.gov/offices/eotffc/ofac/san
ctions/index.html
34
Equipment Use


Generally, use of EAR export
controlled equipment is not a deemed
export. Deemed export occurs only if
controlled technology is transferred.
It is understood by the Commerce
Department that there is no
distinction between product of
research and knowledge of
equipment used in research.
35
Equipment Use
However –
 There are no exclusions that allow
foreign persons to use equipment
controlled for use technology which
requires the access to
company/manufacturer proprietary
manual or instructions for the use.
 Should be treated as using another
parties export controlled material.
36
Equipment Use


ITAR
 Use: Design, development, production,
manufacture, assembly, operation, repair,
testing, maintenance or modification of
defense articles
EAR
 Use: Operation, installation (including onsite installation), maintenance (checking),
repair, overhaul and refurbishing
37
Shipping Controlled Equipment Abroad


A license is required to ship equipment
controlled by ITAR to any foreign
country (few exemptions).
A license may be required to ship
equipment controlled under the EAR
out of the US depending on what the
equipment is, where it is being sent,
who will be using it for what purpose
(many exceptions).
38
Shipping Equipment cont’d


The process to classify equipment
under the EAR is detailed and time
consuming.
It may take months to obtain a license
from State or Commerce.
Note: A license may be required to ship
software out of the US.
39
Shipping Equipment cont’d
There is a presumption under OFAC
sanction programs that any and all
shipments of equipment and provision
of services to countries under sanction
or persons in those countries are
ILLEGAL.
40
Examples of Application to
University Research


Export of research products
—
Underwater research vehicle could require ITAR license if designed
for military applications; would require Commerce Department
authorization if designed for civilian purposes
—
Specially designed electronic components could be controlled
Temporary transfer of research equipment abroad
—

Carrying scientific equipment to certain destinations for research
may require authorization (e.g., Iran, Syria, China, etc.)
Software development
—
Software that is provided to the public for free (including the source
code) may not require licenses, but proprietary software of
controlled technology could require licensing
—
Encryption technology could require licenses or could be prohibited
for transfers to certain foreign nationals/countries
41
License Example
University archeologists desire to take GPS
systems to France to use in research project
with foreign colleagues:


GPS equipment is covered by EAR Category 7,
Navigation and Avionics, under ECCN nos. 7A005,
7A105, and 7A994. Two of those entries redirect
the exporter to ITAR.
The exporter must evaluate the EAR entries and
ITAR Category XV, Spacecraft Systems and
Associate Equipment, to identify the appropriate
licensing authority and classification.
42
Laptop Exception (EAR)

Excluding countries under sanction,
faculty who wish to take their laptops
out of the country to use in a project
that qualifies as fundamental research
may be able to do so under the license
exception for temporary export (TMP)
if the laptop meets the requirement
for "tools of trade" and faculty retain
control of the laptop at all times.(15
CFR Part 740.9).
43
Accepting Export Controlled
Information

In deciding whether to accept an
award that requires the institution to
receive export controlled information,
consider whether the information is


Central to the project (probably rendering
the entire project export controlled) or
Tangential in that the PI needs the
information but not others working on the
project.
44
Accepting Export Controlled
Information cont’d

If you decide the information is
tangential



Execute a nondisclosure agreement
Require that the information be clearly
marked “export controlled,” and
Work with the PI to firewall the
information and have the PI sign a
statement accepting responsibility for
protecting the information
45
Accepting Export Controlled
Information & Material



Check if your libraries have accepted
controlled information or signed DoD form
DD2345 (Militarily Critical Technical Data
Agreement). Acceptance creates compliance
issues for individuals and the university.
Look for Distribution Statement A:
“Approved for Public Release, Unlimited
Distribution”
Material received under Material Transfer
Agreements (MTA) need to be reviewed.
46
Liability and Violations

Liability is personal and institutional
and may take the form of:




Administrative penalties
Monetary fines
Jail time
Voluntary disclosure of violations may
serve as a “mitigating factor” in
deciding penalties.
47
Develop a Compliance Plan
The Federal Government expects every
institution to have a basic compliance
program/plan in place which includes
screening of use of technology by foreign
persons.
(Not to be confused with a Technology Control Plan which
must be in place to safeguard controlled technology
developed or received and is not subject to an exclusion
or exception.)
48
Plan Elements




Inform/educate key university
administrators of legal requirement to
implement a compliance plan.
Designate a responsible (“empowered”)
export compliance person (ECO)
Designate person/office to serve as the point
person for researchers and government
agencies on export control issues (if not
ECO).
ECO should have legal support – internal
counsel and/or possibly outside counsel.
49
Plan Elements cont’d

Conduct a risk review of sponsored projects
for vulnerabilities




The
and
risk
You
greater the intersection of Non U.S. Persons
ITAR/EAR subject research, the greater the
of university export control violations
can’t manage what you don’t know you have
Establish a training program for research,
tech transfer, procurement and shipping
administrators.
Establish an awareness program for faculty
and other researchers.
50
Plan Elements cont’d

Establish written procedures for reviewing
proposals and awards; e.g.,



Add questions to internal proposal routing form.
Develop a check list for contract/grant
administrators.
Develop and implement processes for deciding if a
project is controlled and whether an exclusion
applies.
• Develop an export control information
section on your compliance website
51
Plan Elements cont’d


Decide who has authority to accept
projects that require a license (and may
violate university academic policies) and
under what circumstances the institution
will accept a project that requires a
license.
Document all export control decisions.
52
University Vulnerabilities







How large a foreign national population?
USML or CCL-listed research?
Contracts with DoD, NASA, DHS, Intel
Agencies?
Proprietary technology research with industry
or government?
Accepting another parties proprietary
information?
Select agents? BSL3+ Labs?
International sponsors, subcontractors?
53
University Vulnerabilities







Dedicated secure facilities for export controlled
research?
Shipping equipment to a foreign country?
Collaborating with foreign colleagues in
foreign countries?
Training foreign persons in using equipment?
Working with a country subject to US
sanctions?
Foreign visitors to your labs?
Post data and results on Websites open the
public?
54
Items of Concern for Faculty










Restrictive sponsored research terms &
conditions
Proprietary info & software from others
Keeping own research results/software
proprietary
Non-sponsored research at university
Projects in your garage
Attending “closed” meetings
Faculty start-up companies (no FRE)
Providing services (not research)
Protecting students
Consulting work
55
Managing the Deemed Export Risk
Restricted research & defense articles and defense services
bring unwanted risk of deemed export violations to
campus… two options to contain the risk:
Just Say “No”

Operate within exclusions, or…

Lock up and license:
Accept greater risk of noncompliance and penalties:
 Requires greater allocation of compliance resources
• Manage the process to the risk
• Impose extra security measures
Ensuring University is Export and
Sanctions Compliant






Conduct risk assessment
Identify vulnerabilities
Develop strategy for compliance
Take initial steps
Provide for recurring efforts
Recognize this as long term compliance
area as part of overall university
compliance program
57
Questions?
David Brady
540-231-3801
[email protected]
Erica Kropp
410-221-2015
[email protected]
June 22, 2009
58