U.S. Regulation of Exports by Academic Institutions: An Overview Presented at Carnegie Mellon University

1. U.S. Regulation of Exports by Academic Institutions: An OverviewPresented at Carnegie Mellon University June 2009

2. The Legal Landscape • U.S. Sanctions and Economic Embargoes • U.S. Export Control Laws • Export Administration Regulations (“EAR”) • International Traffic in Arms Regulations (“ITAR”)

3. The Legal Landscape How U.S. Restrictions Apply To Carnegie Mellon • United States embargoes against specified countries (Burma, Cuba, Iran, Sudan, Syria, North Korea) and against listed individuals and entities. • Exports—including "deemed exports"—of United States-origin goods and technology. • Activities (e.g., services) of "United States persons."

4. U.S. Economic Sanctions and Trade Embargoes

5. Sanctions and Embargoes U.S. Economic Sanctions and Trade Embargoes • Regulations administered by Treasury Department's Office of Foreign Assets Control ("OFAC") • Near-total embargoes, covering most business dealings, against Cuba, Iran, Sudan, North Korea, and Syria. • Partial embargo against Burma, limited to investment and provision of financial services. • Exception for "information and informational materials," but not if the information is subject to export controls and not for "services."

6. Sanctions and Embargoes Specially Designated Nationals (“SDNs”) • In addition to sanctions against named countries, OFAC maintains a list of “Specially Designated Nationals” and other blocked parties • These individuals are either deemed to be agents of sanctioned governments or are sanctioned parties themselves (e.g., Specially Designated Terrorists, or Specially Designated Narcotics Traffickers)

7. Sanctions and Embargoes Penalties International Emergency Economic Powers Act (“IEEPA”) Civil • For each violation, any or all of the following are possible: (1) denial of export privileges; (2) fines of up to the greater of $250,000 or twice the value of the export transaction; and/or (3) civil forfeiture • Strict liability Criminal • Criminal (i.e., willful) violations of IEEPA are punishable by fines of up to $1 million, imprisonment for not more that 20 years, or both

8. Sanctions and Embargoes Penalties Trading with the Enemy Act (“TWEA”) (Applicable to the Cuban Assets Control Regulations) Civil • For each violation: (1) denial of export privileges; (2) fines of up to $65,000 for each violation; and/or (3) civil forfeiture • Strict liability Criminal • Criminal (i.e., willful) violations of TWEA by organizations are punishable by fines of up to $1 million • In addition, officers, directors, or agents of a corporation who knowingly participate in such a TWEA violation are subject to a $100,000 maximum fine, imprisonment for not more that twelve years, or both

9. U.S. Export Control Laws

10. U.S. Export Controls There are two primary U.S. export control regimes: • Export Administration Regulations (“EAR”) • International Traffic in Arms Regulations (“ITAR”)

11. EAR Export Administration Regulations (Dual Use Items and Technology) • The Commerce Department's Bureau of Industry and Security (“BIS”) regulates exports of U.S. products, materials, technology, and software that have commercial and military applications (“dual use”). Examples: computers, electronics, chemicals. • An item is “subject to the EAR” if it has been produced in the United States or is being exported from the United States. In addition, certain foreign-made products may be deemed “subject to the EAR” on the basis of U.S.-origin content or technology

12. EAR Scope In general, the EAR govern: • Exports • Reexports • "Deemed" exports • Non-U.S.-manufactured products using more than a small proportion of controlled U.S.-origin parts and components • Some non-U.S.-manufactured products using United States-origin technology

13. EAR What is a "Deemed Export"? • Disclosure of technical data to a foreign national (i.e., not a United States citizen, permanent resident, or asylum admittee) occurring within the United States is "deemed" to be an export of those data to the individual's home country. • "Home country" for EAR purposes is the country of most recent citizenship or permanent residence. (The ITAR use a different standard.) • Can be visual or oral as well as written. • Need not occur in a formal setting to come within the restriction. Can be as informal as an e-mail or a chat over a cup of coffee.

14. EAR Key Exemptions from the EAR • Fundamental research: "Basic and applied research in science and engineering, where the resulting information is ordinarily published and shared broadly within the scientific community." • Does not include proprietary research, industrial development information, and information subject to specific contractual controls. • Incoming information (e.g., from corporate sponsor or corporate prime contractor) may be subject to controls, even where resulting information constitutes fundamental research, if researcher isn't free to publish that incoming information.

15. EAR Key Exemptions from the EAR (Cont'd) Fundamental Research (Cont'd) • University research is presumed to be fundamental research, so long as any prepublication review is "temporary" and is limited to ensuring that publication will not disclose proprietary information or compromise intellectual property rights. • The presence of other prepublication restrictions will deprive the results of "fundamental research" status, until and unless the restrictions are removed. • Research at FFRDCs and other non-academic locations may qualify as fundamental research but there is no presumption to that effect.

16. EAR Key Exemptions from the EAR (Cont'd) Fundamental Research (Cont'd) Examples that are NOT fundamental research • The researcher or university accepts a restriction on publication of the scientific or technical information resulting from the research. • The research is funded by the U.S. Government and specific access & dissemination controls are applicable: (252.204-7000 Disclosure of Information) • The research restricts access by foreign nationals.

17. EAR Key Exemptions from the EAR (Cont'd) Fundamental Research (Cont'd) More examples that are NOT fundamental research • The researcher uses/incorporates/develops controlled data in the research. (The results may be "fundamental research" but the incoming information is not.) • The researcher makes a “side deal” with a sponsor. • Anything arising in the context of consulting, board membership, advisory roles, etc. outside of your university capacity (e.g., Prof. Roth, University of Tennessee).

18. EAR Key Exemptions from the EAR (Cont'd) • Educational information: Information "released by instruction in catalog courses and associated teaching laboratories of academic institutions," whether domestic or foreign. • Contract provisions: Government-funded research is not excluded from the EAR insofar as subject to "specific national security controls" (e.g., publication veto for other than proprietary or I.P. reasons; limits on prepublication disclosure to non-citizens or other categories of individuals). General references to export controls don't remove a project from the fundamental research category, however.

19. EAR Key Exemptions from the EAR (Cont'd) • Published information: Information "generally accessible to the interested public in any form." • Includes: publication in domestic or foreign media available for general distribution, without charge or at nominal cost; submission for publication in such media; ready public availability at libraries; inclusion in publicly available patents or patent applications; release, or submission for release, at an open conference (i.e., one at which notes may be taken). • Special restrictions for encryption software.

20. EAR Penalties The current penalties for violations of the EAR are as follows: Civil • For each violation: (1) denial of export privileges; (2) fines of up to the greater of $250,000 or twice the value of the export transaction; and/or (3) civil forfeiture • Strict liability Criminal • Criminal (i.e., willful) violations are punishable by fines of up to $1 million, imprisonment for not more that 20 years, or both

21. ITAR ITAR International Traffic In Arms Regulations • Administered by the Department of State’s Directorate of Defense Trade Controls ("DDTC") • Registration and licensing requirements. University is registered. • Covered Items/Activities: • Export, reexport, and manufacture of defense articles • Export and reexport—including deemed export and reexport--of technical data • Performance of defense services for foreign persons • Brokering activities • Temporary Imports of defense articles

22. ITAR Defense Articles: • Items designated on the U.S. Munitions List • Technical data

23. ITAR Technical Data: • Information required for the design, development, production, manufacture, assembly, operation, repair, testing, maintenance or modification of defense articles. The definition includes information in the form of blueprints, drawings, photographs, plans, instructions and documentation • Classified information relating to defense articles and defense services • Information covered by an invention secrecy order • Software directly related to defense articles • Does not include: (1) general scientific, mathematical or engineering principles; (2) information in the public domain; or (3) basic marketing information on function or purpose or general system description of defense article

24. ITAR Defense Services: • The furnishing of assistance (including training) to foreign persons in the design, development, engineering, manufacture, production, assembly, testing, repair, maintenance, modification, operation, demilitarization, destruction, processing or use of defense articles. This includes situations where the assistance involves no controlled technical data. • The furnishing to foreign persons of controlled technical data • Military training of foreign units and forces, regular and irregular, including formal or informal instruction of foreign persons by correspondence courses, technical, educational, or information publications and media of all kinds, training aid, orientation, training exercises, and military advice

25. ITAR Exports: • Sending or taking a defense article out of the United States in any manner, except by mere travel outside the United States, by a person whose personal knowledge includes technical data; • Transferring registration, control, or ownership to a foreign person of any aircraft, vessel or satellite; • Disclosing (including oral or visual disclosure) or transferring in the United States any defense article to an embassy, any agency or subdivision of a foreign government; • Disclosing (including oral or visual disclosure) or transferring technical data to a foreign person, whether in the United States or abroad; or • Performing a defense service on behalf of, or for the benefit of, a foreign person, whether in the United States or abroad

26. ITAR Some relevant exemptions for technical data: • University exemption: "Disclosures of unclassified technical data in the U.S. by U.S. institutions of higher learning to foreign persons who are their bona fide and full time regular employees. This exemption is available only if: • "(i) The employee's permanent abode throughout the period of employment is in the United States; • "(ii) The employee is not a national of a country to which exports are prohibited pursuant to §126.1 of this subchapter; and • "(iii) The institution informs the individual in writing that the technical data may not be transferred to other foreign persons without the prior written approval of the Directorate of Defense Trade Controls.

27. ITAR Some relevant exemptions (cont'd): • Agreement exemption: Technical data, including classified information, in furtherance of a manufacturing license or technical assistance agreement approved by the Department of State . . . and which meet the requirements of §124.3 ." • Contract exemption: "Technical data, including classified information, in furtherance of a contract between the exporter and an agency of the U.S. Government, if the contract provides for the export of the data and such data does not disclose the details of design, development, production, or manufacture of any defense article." • "Return" exemption: "Technical data, including classified information, being returned to the original source of import."

28. ITAR Some relevant exemptions (cont'd): • Public domain exemption: Has eight branches, covering information that "is published and . . . generally accessible or available to the public." • Branches 1 through 7 include availability via newsstands, bookstores, unrestricted subscriptions, 2nd class mailing, public libraries, publically available patents, unlimited distribution at public conferences in the United States, and through public release after U.S. Government approval. • Eighth branch is "fundamental research." Definition is very close to that under the EAR.

29. ITAR Some relevant exemptions (cont'd): Examples that are NOT fundamental research • The researcher or university accepts a restriction on publication of the scientific or technical information resulting from the research. • The research is funded by the U.S. Government and specific access & dissemination controls are applicable: (252.204-7000 Disclosure of Information) • The research restricts access by foreign nationals.

30. ITAR Some relevant exemptions (cont'd): More examples that are NOT fundamental research • The researcher uses/incorporates/develops controlled materials in the research. (Results may be "fundamental research" but incoming information is not.) • The researcher makes a “side deal” with a sponsor. • Anything related to consulting, board, advisory roles outside of capacity at university (e.g., Prof. Roth, University of Tennessee).

31. ITAR Some relevant exemptions (cont'd): There are no relevant exemptions for the provision of assistance that constitutes a "defense service" (other than a very narrow one for certain scientific satellite activities) even if the defense service is to be provided in the context of fundamental research.

32. ITAR Penalties Criminal • $1 million per violation • Individuals may face criminal fines and/or sentences of up to ten years imprisonment Civil • Civil penalties up to $500,000 per violation • Strict liability Collateral Consequences • Loss of certain export privileges and debarment of practicing before DDTC • Forfeiture of property

33. ITAR Penalties—Professor Roth University of Tennessee Prof. J. Reece Roth recently was convicted of releasing ITAR-controlled technology to a Chinese graduate student. The release occurred in connection with an Air Force contract with his off-campus, for-profit business. Sentencing is set for July 1st. The prosecution is seeking a jail term of 6½ to 8 years.

34. Conclusions

35. Conclusions Does CMU Conduct Restricted Research Projects or Projects that Use Export-Controlled Information? • Yes, in several variants: • Projects that use controlled information but generate only uncontrolled information. • Projects that use and generate controlled information. These projects are conducted at semi-autonomous, off-campus CMU units (NREC, SEI), and only by U.S. Persons or persons covered by exemptions. • Projects that have been divided into two parts, with the non-controlled portion being conducted on campus and the controlled portion being conducted at semi-autonomous units off campus.

36. Conclusions When in doubt, ask. Primary OSP Contacts NameE-mailPhone Joanne Kyriacopoulos joannek@andrew.cmu.edu 8-9912 Note: Outside counsel – Eric Hirschhorn and Kevin King – Winston & Strawn LLP, Washington DC

37. Conclusions The Goal: Conduct research and comply with the law.