Strategies for Export Control Compliance in Sponsored and Non-Sponsored Research

1. Strategies for Export Control Compliance in Sponsored and Non-Sponsored Research NCURA Region VI and VII Spring Meeting Park City, Utah April 23rd, 2007

2. Steve Eisner Export Control Officer Stanford University (650) 734-7270 steve.eisner@stanford.edu Bruce A. Morgan Assistant Vice-Chancellor for Research University of California, Riverside (951) 827-3093 bruce.morgan@ucr.edu

3. What Are Export Control Regulations? • Export Control Regulations prohibit the unauthorized “export” of certain controlled ITEMS, INFORMATION OR SOFTWARE to foreign persons or entities in the U.S. and abroad • ITEMS= Tangible things, equipment or hardware • INFORMATION = “Technical Data” such as models, formulae, engineering designs or “Technical Assistance” such as training or instruction • SOFTWARE = Computer programs or microprograms in either “Source Code” (programming statements) or “Object Code” (machine-readable instructions)

4. What is an “Export”? What is a Deemed Export? • An “export” is a tangible shipment of an item, information or software outside of the U.S., OR • A transfer or “release” of information or software code to a foreign person in the U.S. (“deemed export”) • This release of information is “deemed” to be an export to the home country of the foreign person

5. What is a Deemed Export?(Cont.) • Takes place through an oral or written disclosure of information, or through visual inspection* • Examples: Email, telephone, websites, laboratory tours, foreign national research collaboration • This is the PRIMARY export control issue facing research administrators, with the export of tangible items a close 2nd. • Remember!! – The overseas shipment of items or the sharing, transmission or transfer of information or software is considered an “export” and may require authorization if export controlled.

6. Who is a “Foreign Person”? • A “foreign person” is anyone who is not a “U.S. person” • A “U.S. person” is either: • A U.S. citizen, lawful permanent resident alien (“Green Card Holder”), refugee, protected political asylee or someone granted temporary residency under amnesty or Special Agricultural Worker provisions; or • Any juridical person (i.e. organizations under the laws of the United States or any jurisdiction within the U.S., including foreign branches)

7. Who is a Foreign Person?(Cont.) • Examples of foreign persons: • Individuals in the U.S. in Non-Immigrant Status (H-1B, F-1, J-1) • Any branch of a foreign government • Any foreign corporation or group that is not incorporated or organized to do business in the U.S.

8. What Are the Various Export Control Regulations? 1. Export Administration Regulations (EAR) • 15 CFR 730-774 http://www.access.gpo.gov/bis/ear/ear_data.html • Enforced by the Commerce Department’s Bureau of Industry and Security (BIS) • Governs export and reexport of all U.S. origin items, information and/or software • Covers “dual use” items, information and software designed for commercial purposes but having military applications

9. What Are the Various Export Control Regulations? 2. International Traffic in Arms Regulations (ITAR) • 22 CFR 120-130 https://www.pmdtc.org/reference.htm#regs • Enforced by State Department’s Directorate of Defense Trade Controls (DDTC) • Covers “defense articles” (tangible items, information and software) and “defense services” (training, assistance) specifically designed, developed or modified for military applications • Transfers of defense articles and provision of defense services to foreign persons require DDTC approval unless excluded or exempt

10. What Are the Various Export Control Regulations? 3. Office of Foreign Assets Control (OFAC) • Enforced by the Treasury Department’s Office of Foreign Assets Control (OFAC) • Economic sanctions regulations prohibiting trade with and/or the transfer of payments, property or anything of “value” to certain sanctioned or embargoed countries or “Specially Designated Nationals” (SDNs) of those countries • SDNs - terrorists, drug kingpins and persons engaged in WMD proliferation (includes organizations to which SDNs belong)

11. OFAC Sanctioned/Embargoed Countries • Countries and territories currently subject to U.S. economic sanctions: • Comprehensive Embargos: Cuba*, Iran*, Syria*, Sudan* • Limited Sanctions/Embargoes: North Korea*, Myanmar (Burma), Liberia, Iraq, Zimbabwe, Balkans, Cote D'Ivoire (Ivory Coast) and the Palestinian Territories (Palestinian Authority) • * = T-5 (US Designated State Sponsors of Terrorism) • Scope of OFAC sanctions are generally country and fact-specific • “Fundamental Research Exclusion” Does Not Apply! • Examples of Prohibited Activity

12. What is an Export Control Exclusion? • A provision that exempts certain information and software from export licensing requirements • Most export control exclusions share the concept thatinformation or software that is generally in the public domain (ITAR) or publicly available (EAR) is not subject to export control regulations • Export control exclusions in the EAR and ITAR are similar, but differ in important ways.

13. Export Control Exclusions • Public Domain Exclusion (ITAR) • Publicly Available Exclusion (EAR) • Educational Information Exclusion • Employment Exclusion (ITAR) • Fundamental Research Exclusion

14. Public Domain Exclusion (ITAR) • USML-listed information and software that is generally accessible and available to the public through/at one or more of the following: • Fundamental research in science and engineering performed at an accredited institution of higher learning in the US; • Libraries open to the public; • Sales at newsstands or bookstores; • Subscriptions available without restriction; • Published patents available at any patent office; • Unlimited distribution at conferences, meetings, seminars, trade shows or exhibitions in the US that are generally available to the public; and/or • Websites that are accessible to all members of the public, free of charge, and where the university does not have knowledge or control over who visits the site or downloads the information or software

15. Publicly Available Exclusion (EAR) • CCL-listed information and software that is generally accessible to the interested public in any form through/at one or more of the following: • Fundamental, unrestricted research in science and engineering performed at an accredited institution of higher learning in the US or abroad; • Publication in periodicals, books, print, electronic, or any other media available for general distribution either free or at a cost not exceeding the cost of reproduction and distribution (allows for a reasonable profit); • Libraries open to the public or from university libraries; • Through subscriptions which are available without restriction either free or at a cost not exceeding the cost of reproduction and distribution (allows for a reasonable profit); • Published patents and open (published) patent applications available at any patent office; and/or • Unlimited distribution at conferences, meetings, seminars, trade shows or exhibitions in the US or abroad that are generally accessible to the public for a fee reasonably related to the cost, and where attendees may take notes.

16. Educational Information Exclusion • ITAR – Export Controls do not apply to information concerning “general scientific, mathematical or engineering principles commonly taught in schools, colleges and universities.” • EAR – Export Controls do not apply to “educational information” released by instruction in catalog courses and associated teaching laboratories. • Includes courses available globally on-line (“distance learning”) • However, not to OFAC embargoed countries!!

17. Employment Exclusion (ITAR) ITAR license not required for colleges and universities to share information in the U.S. with a foreign person if that person: • Is a “bona fide” employee of University – full time w/full benefits • Grad students are EXCLUDED as are most Post-Docs • Not a national from an ITAR embargoed country • Belarus, Cuba, Iran, Libya, North Korea, Syria, Vietnam, Burma, China, Haiti, Liberia, Somalia, Sudan, Iraq, Afghanistan, Rwanda, and D.R. Congo • Resides at a permanent address in the U.S. while employed • Will apply mostly to foreign nationals in H-1B status

18. Fundamental Research Exclusion Covers most basic research at colleges and universities: Definition (NSDD 189) – “Basic or applied research in science and engineering, the results of which ordinarily are published and shared broadly within the scientific community” Per NSDD 189, it is the policy of the U.S. Government “that, to the maximum extent possible, the products of fundamental research remain unrestricted.”

19. Fundamental Research Exclusion (Cont.) • In order to be considered in the public domain, the information or software must have been generated in the course of research performed within the United States. • Information and software resulting from fundamental research outside of the U.S. is not treated by export control law as having entered into the public domain, and is subject to export control, unless it qualifies under other public domain criteria.

20. Fundamental Research Exclusion (Cont.) The fundamental research exemption will not apply if the university accepts any restrictions on the publication of resulting information, other than a brief (~ 90 day) advance review by sponsors to: • Prevent divulging propriety information provided to the investigator by the sponsor • Insure that publication will not compromise patent rights of the sponsor

21. Fundamental Research Exclusion (Cont.) Fundamental Research Exclusion is destroyed by any clause that: • Gives the sponsor the right to approve publications • Restricts participation of foreign nationals in conduct of research by precluding access to research results • Restriction also raises “Openness in Research” policy issues for colleges and universities The Fundamental Research Exclusion is destroyed by such clauses regardless of sponsorship (federal, private or non-profit)

22. How are Research Grants and Contracts Impacted? • Strategic Federal funding opportunities (Homeland Security, NIH, DOD) directly linked to export control regulations • Restrictions on publication and access to research results by foreign nationals invalidate the fundamental research exclusion • Corporate sponsors may not clearly identify “protected technologies” in contract

23. How are Research Grants and Contracts Impacted? (Cont.) • Corporate sponsors may not be aware of the exclusions and exemptions available to Universities • Intellectual Property – involvement of foreign nationals • “Ah Ha” Moment – Once university IP is identified for commercialization AND restricted, it becomes subject to EAR and ITAR • However, if FR on same IP in lab continues during marketing and patent application period, FRE still applies

24. Contracts and Grants: What do I watch for? • Shipments of equipment to a foreign country • Training or collaboration with foreign nationals • Research activities performed in an embargoed country • Reference to export controlled technologies in an award document • Restrictions on publication rights • Restrictions on foreign participation

25. Situations That Raise “Red Flags” • Grant/Contract terms & conditions limiting access to or dissemination of research results, such as: • Confidential/Proprietary Information Clauses • Publication Clauses • Export Control Clauses • Government Clauses that are Problematic • DFARS 252.204-7000 Disclosure of Information • The clause requires Contracting Officer’s prior approval before release of any information (Publication Restriction) • You may see this clause in DOD STTR/SBIR contracts and flowed down to the University..

26. Situations That Raise “Red Flags” (Cont) • Government Clauses that are Problematic (cont.) • ARL 52.004-4400 –Foreign Nationals Performing Under Contract • AFMC 5352-227-9000 – Export-Controlled Data Restrictions

27. Red Flags: FN Restrictions • Third-Party (Commercial/USG) equipment, information or software with FN access restrictions (not subject to FRE) • Commercial Licensing Agreements • Software/Hardware export control clauses • NDAs/Confidentiality Agreements!! • Primary export control compliance risk for universities • “US Person Only” ITAR restrictions • J. Reece Roth – U of Tennessee

28. Red Flags: FN Restrictions Cont. • Receipt may be consistent with Openness in Research Policy but could still contain export controlled technical data • Material Transfer Agreements • Note: Sponsor/Collaborator Pre-Approval of FNs for Facility Access does not invalidate the Fundamental Research Exclusion

29. Red Flags: Tangible Exports • Tangible Exports • Commercial Electronic Equipment/Computers • Lab Fabricated Devices/Prototypes • Equipment/Components used in satellites/spacecraft • Certain “Radiation Hardened” ICs • Ground Control equipment for telemetry, tracking and control of spacecraft and satellites, Null Steering hardware • Laptops, PDAs and research devices taken or shipped abroad that contain university-generated “strong” encryption code • If possible, leave code on campus server and access remotely

30. Red Flags: Encryption & Certain Travel/Transactions • Sharing/Shipping Encryption Source Code Abroad • ITAR: GPS receiving equipment designed for encryption or decryption of Y or P code PPS signals, Null Steering code • PLACE CODE IN PUBLIC DOMAIN VIA INTERNET ASAP!! • EAR: Export of university-generated “strong” encryption code (i.e. "symmetric algorithms" employing a key length in excess of 56-bits) • Government Notification/Review requirements may apply • Travel To or Research/Property Transactions With OFAC Embargoed or Sanctioned Countries • International Research Collaborations/Exchange Programs

31. Contracts and Grants: What can we do? • Assert an exemption within the proposal • A general and qualified statement that the institution agrees to abide by U.S. export control laws may suffice if all else fails. For example: • “Recipient agrees to comply with all U.S. export control laws and regulations of the United States, subject to all exemptions and exclusions thereto.” • Know the project (meet with the PI) • During award negotiation remove terms and conditions that: • Limit rights to publish or present results • Limit foreign national access to research results • Limit foreign national participation in conduct of research

32. Export Control Penalties NOTE OF CAUTION!! Individuals can be held personally responsible for civil and criminal violations of Export Control Regulations – this is in addition to any institutional penalties! ITAR - $1,000,000 per violation and up to 10 yrs. EAR - $50,000 per violation and up to 20 yrs.

33. Useful Resources • UC Riverside Export Control Home Page: http://or.ucr.edu/EX/index.aspx • UC Irvine Export Controls Home Page: http://www.rgs.uci.edu/ora/exportcontrol/ • Stanford University Export Controls Home Page: http://www.stanford.edu/dept/DoR/exp_controls/index.html • Stanford University Export Controls Decision Tree: http://www.stanford.edu/dept/DoR/exp_controls/tree.html • NSDD 189: http://www.aau.edu/research/ITAR-NSDD189.HTML • U.S. Bureau of Industry and Security (Commerce): http://www.bis.doc.gov/ • Directorate of Defense Trade Controls (State): http://www.pmdtc.org/whoweare.htm • Office of Foreign Assets Control (Treasury): http://www.treas.gov/offices/enforcement/ofac/