Office of Research Integrity, Compliance and Security

ITAR and EAR: Notes for faculty and researchers on export regulations

Export control laws, federal laws implemented both by the Department of Commerce through its Export Administration Regulations (EAR) and the Department of State through its International Traffic in Arms Regulations (ITAR), have been in existence for more than twenty years. Institutions of higher education and their employees are required to comply with these laws and regulations. Criminal sanctions (including money and/or prison sentences for individuals) can apply in the case of violations.

Following the events of September 11, the export control regulations have become more prominent and scrutiny concerning the level of compliance with these regulations has heightened. It is important that faculty and other researchers in Kansas State University departments, laboratories and centers understand their obligations under these regulations and adhere to them.

The regulations cover virtually all fields of science and engineering. However, they prohibit the unlicensed export of only certain materials or information for reasons of national security or protection of trade. In the case of academic or research institutions, there is an exclusion for fundamental research, the results of which are or are about to be or, in some cases, ordinarily are publicly available. Understanding three basic concepts related to export controls is essential: (1) the nature of the technology that is export controlled and how it is recognized, (2) the fundamental research exclusion, and (3) what is a deemed export.

The sponsored research project identified below involves the use of Export-Controlled Information (defined below). As a result, the project implicates the International Traffic in Arms Regulations (ITAR) (under the jurisdiction of the State Department) or the Export Administration Regulations (EAR) (under the jurisdiction of the Department of Commerce). It is unlawful under the Export Regulations to send or take export-controlled information out of the U.S., disclose, orally or visually, or transfer export-controlled information to a foreign person inside or outside the U.S without proper authorization. A foreign person is a person who is not a U.S. citizen or permanent resident alien of the U.S. The law makes no exceptions for foreign graduate students.

In general, Export-Controlled Information means activities, items and information related to the design, development, engineering, manufacture, production, assembly, testing, repair, maintenance, operation, modification, demilitarization, destruction, processing or use of items with a capacity for substantial military application utility. Export-controlled information does not include basic marketing information on function or purpose, general system descriptions, or information concerning general scientific, mathematical or engineering principles commonly taught in schools, colleges and universities or information in the public domain. It does not matter if the actual intended use of Export-Controlled Information is military or civil in nature.

Technical information, data, materials, software, or hardware, i.e.; technology generated from this project, must be secured from use and observation by unlicensed non-U.S. citizens. Security measures will be appropriate to the classification involved.

Reasonable Care. Researchers may be held personally liable for violations of the ITAR and the EAR. As a result, they should exercise care in using and sharing Export-Controlled Information with others. For example, PIs should identify whom among proposed research assistants and collaborators are foreign persons. Unless the State Department grants a license authorizing those persons access to export-Controlled Information, a prerequisite to accessing it is a security clearance. In the absence of that clearance, PIs should not leave Export-Controlled Information unattended. They should clearly identify Export-Controlled Information and make only that number of copies of the material as is absolutely necessary. PIs also should store Export-Controlled Information in a locked file cabinet or drawer or under password protected computer files. Finally, PIs should avoid moving the information from one location to another.

Some examples of security measures are as follows:

  • Authorized project personnel must be clearly identified.
  • Project data and/or materials must be physically shielded from observation by unauthorized individuals by operating in secured laboratory spaces, or during secure time blocks when observation by unauthorized persons is prevented. This would pertain to laboratory management of “work-in-progress”
  • Export-Controlled Information must be clearly identified and marked as such.
  • Both soft and hard copy data, notebooks, reports and research materials are stored in locked cabinets; preferably in rooms with key-controlled access.
  • Equipment or internal components and associated operating manuals and schematic diagrams containing “export-controlled” technology are to be physically secured from unauthorized access.
  • Appropriate measures taken to secure controlled electronic information, including User ID’s, password control, SSL or other approved encryption technology. Database access managed via a Virtual Private Network (VPN), allowing only authorized persons to access and transmit data over the internet, using 128-bit Secure Sockets Layer (SSL) or other advanced, federally approved encryption technology.
  • Discussions about the project or work product are limited to the identified contributing investigators and are held only in areas where unauthorized personnel are not present. Discussions with third party subcontractors are only to be conducted under signed agreements that fully respect the non-U.S. citizen limitations for such disclosures.

Penalties. The penalty for unlawful export and disclosure of Export-Controlled Information under the ITAR is up to two (2) years imprisonment and/or a fine of one hundred thousand dollars ($100,000), and unlawful export and disclosure of information controlled under the EAR, the greater of (i) a fine of up to one million dollars ($1,000,000) or (ii) five times the value of the exports for a corporation and imprisonment of up to ten years and/or a fine of up to two hundred fifty thousand dollars ($250,000) for an individual.

United States Export Control Laws

I. Definitions

Export control decisions depend on a correct understanding of the following terms. The official regulatory definition should be consulted in specific applications.

  1. The term export, as used in export control regulations has an expansive meaning. Generally, an export includes any: (2) actual shipment of any covered goods or items; (2) the electronic or digital transmission of any covered goods, items, or related goods or items; (3) any release or disclosure, including verbal disclosures or visual inspections, of any technology, software or technical data to any foreign national wherever located; or (4) actual use or application of covered technology on behalf of or for the benefit of any foreign entity or person anywhere. The official definition of export under the EAR and ITAR should be consulted when determining whether a specific act constitutes an export. As is evident in many instances, export is defined so as to preclude the participation of foreign graduate students in research that involves covered technology without first obtaining license from the appropriate government agency.
  2. The Export Administration Regulations (EAR), Title 15, sections 730-774 of the Code of Federal Regulations (CFR) are promulgated and implemented by the Department of Commerce. The EAR regulate the export of goods and services identified on the Commodity Control List (CCL), Title 15 CFR 774, Supp. 1. The complete text of the EAR and CCL are available online at http://www.access.gpo.gov/nara/cfr. Printed versions of the EAR and CCL are available for review at the Office of Research and Sponsored Programs, or the University Research Compliance Office.
  3. The International Traffic in Arms Regulations (ITAR), 22 CFR §§ 120-130 are promulgated and implemented by the Department of State and regulate defense articles and services and related technical data that are identified on the Munitions Control List (MCL), 22 CFR § 121. Complete, on-line versions of ITAR and MCL are available online at http://www.access.gpo.gov/nara/cfr (Gov’t Printing Office site) and at http://www.fas.org/spp/starwars/offdocs/itar (Website for the Federation of American Scientists).
  4. Commodity Jurisdiction Ruling: Where an article is arguably covered by both the EAR and ITAR, a request can be made to the State Department to determine which agency will have jurisdiction over the export of the article.
  5. Fundamental Research, as used in the export control regulations, includes basic or applied research in science and/or engineering at an accredited institution of higher learning in the United States where the resulting information is ordinarily published and shared broadly in the scientific community. Fundamental research is distinguished from research which results in information which is restricted for proprietary reasons or pursuant to specific U.S. Government access and dissemination controls. University research will not be deemed to qualify as Fundamental Research if: (1) the University or researcher accepts any restrictions on the publication of the information resulting from the research, other than limited prepublication reviews by research sponsors to prevent inadvertent divulging of proprietary information provided to the researcher by sponsor or to insure that publication will not compromise patent rights of the sponsor; (2) if the University or researcher has accepted an initial transfer of information from another entity (sponsor or information provider) and the parties have agreed that the “sponsor”, or “information provider” may withhold from University publication some or all of the information so provided; or (3) the research is federally funded and specific access and dissemination controls regarding the resulting information have been accepted by University or the researcher. The citation for the official definition of Fundamental Research under the EAR is 15 CFR § 734.8 [http://www.access.gpo.gov/nara/cfr/waisidx_01/15cfr734_01.html]. The ITAR citation is 22 CFR § 120.11 [http://www.access.gpo.gov/nara/cfr/waisidx_01/22cfr120_01.html].
  6. Public Domain (22 CFR § 120.11) means information that is published and that is generally accessible or available to the public: (1) through sales at newsstands and bookstores; (2) through subscriptions which are available without restriction to any individual who desires to obtain or purchase the published information; (3) through second class mailing privileges granted by the U.S. Government; (4) at libraries open to the public or from which the public can obtain documents; (5) through patents available at any patent office; (6) through unlimited distribution at a conference, meeting, seminar, trade show or exhibition, generally accessible to the public, in the United States; (7) through public release (i.e., unlimited distribution) in any form (e.g., not necessarily in published form) after approval by the cognizant U.S. government department or agency; and (8) through fundamental research.
  7. Foreign person means any natural person who is not a lawful permanent resident as defined by 8 U.S.C. 1101(a)(20) [http://www4.law.cornell.edu/uscode/8/1101.html] or who is not a protected individual as defined by 8 U.S.C. 1324(a)(3) [http://www4.law.cornell.edu/uscode/8/1324.html]. It also means any foreign corporation, business association, partnership, trust, society or any other entity or group that is not incorporated or organized to do business in the United States, as well as international organizations, foreign governments, and any agency or subdivision of foreign governments (e.g. diplomatic missions).

Questions for PI:

After reviewing the information regarding ITAR and EAR, do you feel that the work that will be performed by you under this Contract is covered by ITAR or EAR? (See overview discussion regarding export-controlled information)

Will any foreign nationals be appointed to perform the work, or have access to the information generated by the work to be performed under this Agreement?

If yes, then in all likelihood, an export license will need to be obtained, and you may be required to obtain security clearances for any foreign nationals.

The exception to these regulations resides in the notion that if we can claim that this activity is fundamental research and public domain procedures (methodologies previously published and results will be published without restriction) exist, then no export license will be required. This is why PreAward Services goes to great lengths to attempt to exclude from sponsored project contracts, restrictions that would deem an activity to be other than “Fundamental Research”.

How does Export Control Regulations affect faculty who submit requests through the Confidential/Sensitive Research Committee (CSRC)?

Requests submitted to the CSRC and the CSRC’s subsequent approvals/decisions could directly affect the faculty and their projects. A positive decision on the part of the CSRC to grant an exception to the “fundamental research” criteria, by definition, automatically classifies the activity in question to be under the auspices of one of the federal export-control oversight agencies. Given this, when a decision is granted by the CSRC to grant an exception to the standard publication procedures, then the faculty must be directed toward guidance and resources regarding their responsibility to comply with the applicable export regulations, including the classification of the technology, determination of appropriate oversight agency, and the subsequent application for export license, or license exception, whatever the case might be.