EXPORT CONTROLS: Why Do We Care?

1. EXPORT CONTROLS: Why Do We Care? Dave Dunbar, Maryland Bob Hardy, COGR Catholic University March 29, 2011 Provided as a general source of information on U.S. export controls. This presentation is not provided as legal advice or opinion.

2. 2

3. EXPORT CONTROLS: Here’s Why We Care? The U.S. government has stepped up enforcement in the area of exports and Universities are particularly vulnerable Relatively easy target for the government Many schools don’t have the robust export control management of the private sector The Reece Roth case supports this increased activity, particularly since the appeals court has upheld the 4 year prison sentence 3

4. Do I need to be concerned about export controls in this research? • Public domain, and • No equipment, encrypted software, listed-controlled chemicals, bio-agents or toxins, or other restricted technologies are involved, and • Information/software is already published, and • There is no contractual restriction on export, or • Fundamental Research • (note definitions and caveats associated with this exemption) • Equipment, software, chemical, bio-agent, or technology is on the US Munitions List (ITAR), or • Equipment, software, chemical, bio-agent or technology is designed or modified for military use, use in outer space, or there is reason to know it will be used for or in weapons of mass destruction, or • Chemicals, bio-agents or toxins on the Commerce Control List are involved, or • The contract contains a restriction on export or access by foreign nationals • Equipment or encrypted software is involved, or • Technology is not in the public domain, and • Technology may be exposed to foreign nations (even on campus) or foreign travel is involved, and • The equipment, software or technology is on the Commerce Control List, or • Information or instruction is provided about software, technology, or equipment on the CCL, or • The foreign nationals are from or the travel is to an embargoed country • The contract has terms e.g. a publication restriction that effect the Fundamental Research Exemption Probably (further review is required) License May Be Required YES License Will Be Required NO 4 Federal Export Control Laws 4

5. What is an export? An export is any oral, written, electronic or visual disclosure, shipment, transfer, or transmission of commodities, technology, information, technical data, assistance, or software codes to Anyone outside the U.S. including a U.S. citizen A “foreign national” whether in the U.S. (a “deemed” export) or abroad A foreign embassy or affiliate 5

6. What is a “deemed” export? Export controls also cover transfer of goods and technology within the U.S. (transfer outside the U.S. is deemed to apply when a non-qualified foreign national receives the information in the U.S.) Applies to technology transfers under EAR Applies to technical data and defense services under ITAR Unless the fundamental research exclusion applies, a university’s transfer of controlled technology to a non-permanent resident foreign national in the U.S. may be controlled or prohibited (your students!) 6

7. What is a “deemed” export? Situations that can trigger a deemed export problem include: Employees who are foreign nationals involved in specific research, development, and manufacturing activities subject to controls Foreign students or scholars conducting research Laboratory tours Face-to-face Telephone Email Fax Sharing of computer files Visual inspections 7

8. Who is a foreign national? A foreign national is any person who is NOT a: U.S. citizen U.S. lawful permanent resident (“a green card holder”) Person granted asylum Person granted refugee status 8

9. What types of projects raise export control concerns? Projects that involve the actual export or “deemed” export of any goods, technology, or related technical data that is either: “Dual use” (commercial in nature with possible military applications) Inherently military in nature 9

10. What types of projects raise export control concerns? Research in the following areas frequently require export controls: engineering, space sciences, computer sciences, biomedical research (especially with lasers), research with encrypted software, research with controlled chemicals, biological agents, toxins Research conducted in certain foreign countries or where “defense services” (e.g., “how to” activities) are provided 10

11. Scenarios that might require export licenses Physical transfer of items of equipment outside the U.S. Participation of foreign national faculty, students or staff in restricted research Presentations of previously unpublished research at conferences or meetings where foreign national scholars might be in attendance Visits to your laboratory by foreign national scholars Non-disclosure agreements Material transfer agreements 11

12. Export controls cover U.S. Export controls (ITAR, EAR) Cover any item in U.S. trade (goods, technology, information) U.S. origin items, wherever located Exclude patents and patent applications, artistic or nontechnical publications Exclude technology in the public domain Exports of most high technology and military items, as well as associated technologies and certain items of commercial importance require U.S. export authorization (either license or applicable exemption) 12

13. PENALTIES FOR VIOLATION OF EXPORT REGULATIONS Violations of Arms Export Control Act (AECA) or ITAR: -- Civil Penalties of Up to $500,000 per violation -- Criminal fines of up to $1 million and/or 20 years imprisonment -- AECA Debarment Denial of export privileges 13

14. NSDD-189 Provides definition: “Fundamental research” means basic and applied research in science and engineering, the results of which ordinarily are published and shared broadly within the scientific community. Where national security requires control, the mechanism for control at universities is classification No restrictions may be placed on conduct or reporting of federally-funded fundamental research that has not received national security classification except as provided in statutes 14

15. NSDD-189 (continued) University research will not be deemed to qualify as fundamental research if … the university or research institution accepts any restrictions on publications resulting from the research, other than limited prepublication reviews by research sponsors to prevent inadvertent divulging of the sponsor’s proprietary information or for filing of patent applications. 15

16. The Fundamental Research Exclusion from Export Controls Applies to: Unrestricted publicly available technology and software arising during or resulting from – or NSDD 189 says the “conduct” of -- fundamental research undertaken in the U.S. at accredited academic institutions. Where the resulting information is ordinarily published and shared broadly (EAR 734.3, ITAR 120.11). Protects most campus-based research at U.S. universities from export controls. 16

17. What does this mean for a university? Allows U.S. universities to include foreign faculty, students, visitors in research involving creation of controlled information on campus in the U.S. without a license Once created in fundamental research, the information may be transferred abroad without restriction once it is in the public domain Fundamental research information is public in nature and is excluded (not just exempted) from controls 17

18. When May the FRE Not Protect You? Contract Terms, Prime or Sub, that contain restrictions on project access or dissemination of results. Off-campus activities, whether or not associated with on-campus FRE research. Transition phase(s) when fundamental research evolves into something else. Faculty Entrepreneurial activities. 18

19. Exclusions/Exemptions from Export Controls Fundamental Research Public Domain Educational Institution activities Full-time employment (ITAR only) 19

20. FRE applies to information Resulting from or arising during basic and applied research in science and engineering Conducted at an accredited institution of higher education (EAR) or higher learning (ITAR) Located in the U.S. Ordinarily published and shared broadly in the scientific community (note that ITAR says “is published”) Not subject to proprietary or U.S. government publication or access dissemination controls 20

21. Issues surrounding the FRE Does not apply to items or materials Publication approval requirements by sponsor invalidate the FRE “side deals” are dangerous! Some technologies (advanced encryption) always ineligible for fundamental research exclusion It is an open question whether the FRE exclusion applies to controlled information that is already existing and then used during research that otherwise meets the criteria for a fundamental research exclusion 21

22. Exemptions from controls: publicly available and public domain Publicly available (EAR) and public domain (ITAR) information exclusion: Applies to information that is already published through specified means and found in Libraries open to the public, including most university libraries Unrestricted subscriptions, newsstands, or bookstores for a cost not exceeding reproduction and distribution costs (including a reasonable profit) Published patent information (does not apply to proprietary information not publicly disclosed) 22

23. Exemptions from controls: publicly available and public domain Conferences, meetings, seminars, trade shows, or exhibits held in the U.S. (ITAR) or anywhere (EAR), which are generally accessible by the public for a fee reasonably related to the cost and where attendees may take notes and leave with their notes, or Websites accessible to the public for free and without the host’s knowledge of or control of who visits or downloads software/information (clearly acceptable under EAR, and likely acceptable under ITAR) 23

24. Exemption from controls: educational institutions ITAR: General science, math, and engineering commonly taught at schools and universities ITAR is focused on subject matter EAR: Information conveyed in courses listed in course catalogues and in their associated teaching labs or any accredited academic institution EAR is focused on venue EAR’s exemption does not cover encryption software 24

25. Exemption from controls: full-time employment (ITAR only) Employment of a foreign national but only if: A bona fide full time with benefits employee of the institution Not from an ITAR embargoed country (Belarus, Cuba, Iran, Libya, North Korea, Syria, Vietnam, Burma, China, Haiti, Liberia, Somalia, Sudan, Iraq, Afghanistan, Rwanda, D.R. Congo) Resides at a permanent address in the U.S. while employed Is advised in writing not to share covered technical data with any other foreign nationals without government approval Rarely used. Note: does not apply to graduate students 25

26. Repetition for Emphasis: FRE Fundamental research exclusion applies to information when the research is: Basic or applied (in DoD terms, 6.1 or 6.2) At an institution of higher education (EAR) or learning (ITAR) In the U.S., and No publication restrictions or access controls exist for the activity 26

27. Licensing: Questions to Ask to Start Does the award contain any terms or conditions that would restrict the disclosure or dissemination of the research results? Are there any restrictions on access to or dissemination of information the sponsor or others will use on this project? If the answer to 1 or 2 is yes, does the research project fall under one of the export controlled technologies? 27

28. Licensing: Questions to Ask to Start Does the project involve training specific personnel for a special purpose? If so, could it be considered a defense service? Will the university need to apply for an export license? 28

29. ONE EXAMPLE ONLY…. DFAR 352-204-9014 “Notification of Non-U.S. citizen participation” states that a university shall notify the government 30 days in advance of the employment of a non-U.S. citizen on [this] contract and the government may restrict the individual from participation on some or all of the project. Issues: is this an access restriction? Is it notification or approval? Is the contract classified? Are there publication restrictions? Is it funded with 6.1 or 6.2 money? 29

30. Examples where licenses will be required EAR Dual Use/Commercial Technologies on the CCL: Terrorist supporting countries: Cuba, Iran, Libya,* North Korea, Sudan, Syria Countries of concern: Former soviet republics, China, Vietnam Many other countries require licenses, or are subject to EAR 99 (covered in the CCL but no license required) *as of March 3, 2011 all exporting privileges to Libya are suspended 30

31. Examples where licenses will be required ITAR (Military/space technologies) on the MCTL: Policy of denial State sponsors of terrorism: Cuba, Iran, Libya,* North Korean, Sudan, Syria Arms Embargo (Burma, PR China, Haiti, Liberia, Somalia, Sudan) Others (Belarus, Iraq, Vietnam) Policy of denial (based on item/end-user) Afghanistan, Congo, Rwanda *as of March 3, 2011 all exporting privileges to Libya are suspended 31

32. What is a temporary export (TMP)? There is a license exception for temporary export of tools of the trade. Reasonable kinds and quantities of these commodities and software can be taken overseas (even if controlled) but MUST remain under your effective control (physical possession) of the item. It must be with you at all time or locked in a (central) hotel safe deposit; generally hotel room safes are not sufficiently guarded. TMPs must be returned within one year to the U.S. No tools of the trade may be taken to embargoed countries 32

33. Current Reform Initiative Aim is to transform USML and CCL control lists into parallel tiered “positive” control lists “Positive” means described by objective criteria; mostly involves revising ITAR/USML to make it more like the EAR/CCL list 3 tiers: 1) “crown jewels” (WMD); 2) “precious metals” (sub. military advantage); 3) sig. contribution to nat. security but more broadly available (“valuable assets?”) 33

34. Reform Initiative--continued Revised USML categories now being rolled out; 1st was Cat. VII military vehicles Single license application, single IT system, Export Enforcement Coordination Ctr. other key aspects of reform Notion is that items will move from USML to CCL and downward through tiers as technology evolves; concern is how dynamic will this process be, especially over time 34

35. Roth Case Complicated fact scenario that involved both actual exports (laptop/flash drive and papers pertaining to a controlled defense project taken by Professor Roth to China) and deemed exports (foreign nationals working on Air Force SBIR subcontract to Professor Roth which involved export controlled plasma technology and contained restrictions on foreign national participation and publication) 35

36. Roth Case--continued Professor Roth convicted of multiple counts of export control violations (and fraud/conspiracy); sentenced to 4 years in prison Conviction upheld on appeal Appeals court ruling raises issues for universities as to scope of FRE and relationship to 6.2 DOD funding 36

37. Roth Circuit Court Decision 6th Circuit opinion (1/11) holds that all stages of research on defense projects that result in defense articles are subject to export controls Seems to conflict with FRE for earlier stage (i.e. 6.1/6.2 funded projects) as well as DoD guidance on fundamental research Also states that willfulness needed for ITAR violations does not require knowledge of specific provisions—just general knowledge of unlawfulness (Roth was warned by university) Binding only in 6th Circuit but troubling precedent 37

38. Resources Commerce Regulations: www.bis.doc.gov/ State Regulations: http://pmddtc.state.gov/index.html Stanford University export control website: http://export.stanford.edu/ University of Tennessee website: http://research.utk.edu/exportcontrol/ COGR: www.cogr.edu (Educational Materials) NACUA: www.nacua.org/ 38

39. Additional Considerations David M. Dunbar Export Compliance Officer Office of Research Administration & Advancement University of Maryland, College Park ddunbar@umd.edu (301) 405-0187 39

40. State & Commerce Considerations • Exclusions from Export Control • New I-129 Certification Requirement • Commerce & State Definitions • Export Administration Regulations (EAR) • International Traffic in Arms Regulations (ITAR) • “Exports” and “Deemed Exports” • Technology and Source Code Definitions • Potential Penalties for Noncompliance 40

41. Items Not Subject to the EAR • With exception of certain encryption software, publicly available technology and software is not controlled under EAR. • Publicly available technology & software: • Published information • Information arising during, or resulting from, fundamental research • Information released by instruction in catalog courses and associated teaching laboratories of academic institutions • Information in patents and in certain patent applications 41

42. ITAR Definition of “Technical Data” Does Not Include: Information concerning general scientific, mathematical or engineering principles commonly taught in schools, colleges and universities; Information in the “public domain”; and Basic marketing information on function or purpose or general system descriptions of defense articles. 42

43. ITAR “Public Domain” Information Includes information which is published and which is generally available to the public through: ─ Sales at newstands & bookstores; ─ Subscriptions available without restriction to any individual desiring to obtain or purchase the published information ─ At libraries open to the public ─ Patents available at any patent office ─ Unlimited distribution at a conference generally accessible to the public in the U.S. ─ Public release (unlimited distribution) in any form after approval by the cognizant U.S. Government agency ─ Through fundamental research in science and engineering at accredited institutions of higher learning in the U.S. 43

44. I-129 Certification Requirement for Certain Visa Petitions The new certification requirement, mandatory as of February 20, 2011, only applies to the following nonimmigrant worker petitions: H-1B, H1B1 Chile/Singapore, L-1 and O-1A. But export license requirements can apply to foreign persons in other visa categories not subject to new certification requirement. N.B.: EAR and ITAR do NOT restrict the release of technology or technical data to naturalized U.S. citizens, lawful U.S. permanent residents (i.e., “green card” holders) and protected individuals (e.g., persons granted refugee or asylum status). 44

46. BIS/DDTC Joint Fact Sheet The EAR and the ITAR do not control, respectively, “technology” or “technical data” the regulations define as “publicly available” or in the “public domain.” Thus, the EAR and the ITAR do not require licenses to export such publicly available or public domain information, regardless of content. (Emphasis added.) If the only technology or technical data the petitioner/ employer would release to the foreign person beneficiary at issue in the petition falls within the scope of these definitions, then the petitioner should check the first box in Part 6 of the I-129 form because a license will not be required from either the BIS or DDTC to release the technology or technical data to the foreign person. 46

47. Definition of “Export” – the EAR • An actual shipment or transmission of items subject to the EAR out of the United States • Any release of technology or software subject to the EAR in a foreign country • Any release of technology or source code subject to the EAR to a foreign national • Deemed to be an export to home country or countries of the foreign national 47

48. What is “Source Code” under EAR? “Source code”. (or source language) (Cat 4, 6, 7, and 9)--A convenient expression of one or more processes that may be turned by a programming system into equipment executable form (“object code” (or object language)). “Object code”. (or object language) (Cat 9)—An equipment executable form of a convenient expression of one or more processes (“source code” (or source language)) that has been converted by a programming system. (See also “source code”) 48

49. Publicly Available Source Code, Software Question: Is the export or reexport of software in machine readable code subject to the EAR when the source code for such software is publicly available? Answer: If the source code of a software program is publicly available, then the machine readable code compiled from the source code is software that is publicly available and therefore not subject to the EAR. ─ EAR Part 734, Supplement No. 1 ─ N.B.: Special rules apply for encryption software 49

50. How is Technology or Software “Released” for Export? Visual inspection by foreign nationals of U.S.-origin equipment and facilities; Oral exchanges of information in the United States or abroad; or The application to situations abroad of personal knowledge or technical experience acquired in the United States. 50