Attorney Advertising. Prior results do not guarantee a similar outcome. Technology Transfer Controls: Restrictions on Exchanges of Technical Information Barry J. Hurewitz Waltham, MA May 31, 2012

WilmerHale 2 Attorney Advertising. Prior results do not guarantee a similar outcome. Overview 1 Foundations for control 2Identifying controlled technology 3Defining exports of technology 4 Determining technology controls 5Technology control plans 6Technology control challenges

WilmerHale 3 Attorney Advertising. Prior results do not guarantee a similar outcome. Foundations for control Unique nature of technology Control regimes attempt to reflect the special character of technology Intangible Dynamic Collaborative Derivative Foundational

WilmerHale 4 Attorney Advertising. Prior results do not guarantee a similar outcome. Foundations for control Regulatory objective Controls for same reasons for export control as for commodities, equipment, materials and software Deny access to adversaries Maintain qualitative technical superiority Heightened concern for technologies conveying development or production capabilities, as opposed to only operation/use

WilmerHale 5 Attorney Advertising. Prior results do not guarantee a similar outcome. Foundations for control Sources of technology controls Classified information: National Industrial Security Program Operating Manual Defense trade: International Traffic in Arms Regulations Dual-use technologies: Export Administration Regulations

WilmerHale 6 Attorney Advertising. Prior results do not guarantee a similar outcome. Identifying controlled technology Technology under the ITAR Technical data (1) Information required for the design, development, production, manufacture, assembly, operation, repair, testing, maintenance or modification of defense articles E.g., Information in the form of blueprints, drawings, photographs, plans, instructions or documentation (2) Classified information (3) Invention secrecy order (4) Software directly related to defense articles

WilmerHale 7 Attorney Advertising. Prior results do not guarantee a similar outcome. Identifying controlled technology Technology under the ITAR Technical data does not include General scientific, mathematical or engineering principles commonly taught in schools, colleges and universities Information in the public domain (e.g., published and which is generally accessible or available to the public) Basic marketing information on function or purpose General system descriptions of defense articles

WilmerHale 8 Attorney Advertising. Prior results do not guarantee a similar outcome. Identifying controlled technology ITAR defense services Defense service (1) Assistance (including training) to foreign persons, in the design, development, engineering, manufacture, production, assembly, testing, repair, maintenance, modification, operation, demilitarization, destruction, processing or use of defense articles (2) Furnishing controlled technical data (3) Military training of foreign units and forces Even if services involve public domain data Subject to licenses or agreements (TAA/MLA)

WilmerHale 9 Attorney Advertising. Prior results do not guarantee a similar outcome. Identifying controlled technology ITAR defense services Proposed revised definition (4/13/11) Exclude: –Services based solely on public domain data –Mere hiring of foreign nationals Include: –Integration of items into defense articles –Training, but only with respect to employment of defense articles

WilmerHale 10 Attorney Advertising. Prior results do not guarantee a similar outcome. Identifying controlled technology Technology under the EAR Technology: Specific information necessary for the development, production, or use of a product Technical data may take forms such as blueprints, plans, diagrams, models, formulae, tables, engineering designs and specifications, manuals and instructions written or recorded on other media or devices such as disk, tape, read-only memories Technical assistance may take forms such as instruction, skills training, working knowledge, consulting services; may involve transfer of technical data

WilmerHale 11 Attorney Advertising. Prior results do not guarantee a similar outcome. Identifying controlled technology Technology under the EAR Development: All stages prior to serial production, such as: design, design research, design analyses, design concepts, assembly and testing of prototypes, pilot production schemes, design data, process of transforming design data into a product, configuration design, integration design, layouts Production: All production stages, such as: product engineering, manufacture, integration, assembly (mounting), inspection, testing, quality assurance

WilmerHale 12 Attorney Advertising. Prior results do not guarantee a similar outcome. Identifying controlled technology Technology under the EAR Use: Operation, installation (including on-site installation), maintenance (checking), repair, overhaul and refurbishing All six activities in the definition of use must be present to trigger a license requirement 71 Fed. Reg (5/31/2006)

WilmerHale 13 Attorney Advertising. Prior results do not guarantee a similar outcome. Defining exports of technology Technology export under the ITAR Export (1)Sending or taking defense article out of the U.S. (except mere travel by a person with personal knowledge that includes technical data (2)Transfer of controlled aircraft, vessel, or satellite (3)Disclosure via oral or visual disclosure -- To foreign government, embassy or mission -- To a foreign person (4) Performing a defense service on behalf of, or for the benefit of, a foreign person

WilmerHale 14 Attorney Advertising. Prior results do not guarantee a similar outcome. Defining exports of technology EAR tech transfer & deemed export Export of technology or (non-encryption) software: Release of technology or software in a foreign country Release of technology or source code to a foreign national (deemed export) Release occurs via: Visual inspection Oral exchanges Application abroad of personal knowledge or technical experience acquired in the U.S.

WilmerHale 15 Attorney Advertising. Prior results do not guarantee a similar outcome. Determining technology controls Limitations on technology controls Public availability/public domain Operation and sales technology Required to achieve or exceed regulatory threshold Intra-organizational disclosures Limited-purpose disclosures Disclosures with assurances

WilmerHale 16 Attorney Advertising. Prior results do not guarantee a similar outcome. Determining technology controls Public domain/publicly available ITAR EAR Retail salePublished for general distribution Subscription without restrictionDe minimis controlled U.S. origin content Second class U.S. mail Libraries open to the publicPublic or university libraries PatentsPatents and published patent applications Open conference, meeting, seminar, trade show Public release with government approval Educational information (catalog courses & associated teaching laboratories) Fundamental research

WilmerHale 17 Attorney Advertising. Prior results do not guarantee a similar outcome. Determining technology controls EAR operation technology Operation technology is the minimum technology necessary for the installation, operation, maintenance (checking), and repair Minimum necessary does not include technology for development or production and includes use technology only to the extent required to ensure safe and efficient use Subject to further restrictions under specific ECCNs

WilmerHale 18 Attorney Advertising. Prior results do not guarantee a similar outcome. Determining technology controls EAR sales technology Sales technology means data supporting a prospective or actual quotation, bid, or offer to sell, lease, or otherwise supply an item Of a type customarily transmitted with a prospective or actual quotation, bid, or offer in accordance with established business practice Excluding detailed design, production, or manufacture technology, or the means of reconstruction, of either the quoted item or its product that the consignee could employ to reduce the technology to production Subject to further restrictions under specific ECCNs

WilmerHale 19 Attorney Advertising. Prior results do not guarantee a similar outcome. Determining technology controls Types of EAR technology controls Unqualified: Technology for the development, production, or use of items controlled by [ECCN] Qualified: Technology, according to the General Technology Note, for the development, production, or use of items in [ECCN] –Also: Technology exclusively for the development or production of [item] Catchall: ECCN 0E521 will cover [a]ny technology subject to the EAR that is not listed elsewhere in the CCL, but which is controlled for export because it provides at least a significant military or intelligence advantage to the U.S. or for foreign policy reasons

WilmerHale 20 Attorney Advertising. Prior results do not guarantee a similar outcome. Determining technology controls EAR General Technology Note The export of technology that is required for the development, production, or use of items on the Commerce Control List is controlled according to the provisions in each Category Technology required for the development, production, or use of a controlled product remains controlled even when applicable to a product controlled at a lower level

WilmerHale 21 Attorney Advertising. Prior results do not guarantee a similar outcome. Determining technology controls EAR General Technology Note Required: …that portion of technology or software which is peculiarly responsible for achieving or exceeding the controlled performance levels, characteristics or functions Example: Product X is controlled if it operates at or above 400 MHz and is not controlled if it operates below 400 MHz. –If production technologies A, B, and C allow production at no more than 399 MHz, then technologies A, B, and C are not required to produce the controlled product X –If technologies A, B, C, D, and E are used together, a manufacturer can produce product X that operates at or above 400 MHz –In this example, technologies D and E are required…

WilmerHale 22 Attorney Advertising. Prior results do not guarantee a similar outcome. Determining technology controls EAR General Technology Note Required technology refers only to that portion of technology which is peculiarly responsible for achieving or exceeding controlled performance levels, characteristics or functions In classifying technology, granularity matters!

WilmerHale 23 Attorney Advertising. Prior results do not guarantee a similar outcome. Determining technology controls Options for intra-organizational export EAR License Exceptions BAG and TMP License Exception STA Proposed License Exception ICT Internal-use of encryption technology to U.S. subs and favored- country private-sector end users ITAR 125.4(b)(9): Allows technical data export by a U.S. person who is an employee of a U.S. corporation to a U.S. person employed by that corporation outside the United States and : Allows certain exports to dual or third- country nationals who are bona fide regular employees, directly employed by the foreign consignee or end-user

WilmerHale 24 Attorney Advertising. Prior results do not guarantee a similar outcome. Technology Control Plans Topics for technology control planning Define the stakeholders subject to controls Describe the covered information Designate & empower responsible company officials Physical access control (segregated work areas) Technical/IT security control Administrative safeguards (badging, escorts) Compliance certification Training/indoctrination Monitoring and internal reporting Sanctions Corrective action

WilmerHale 25 Attorney Advertising. Prior results do not guarantee a similar outcome. Technology Control Plans TCP origins in the NISPOM NISPOM : A TCP is required to control access by foreign nationals assigned to, or employed by, cleared contractor facilities… The TCP shall contain procedures to control access for all export-controlled information NISPOM 2-307: A TCP shall be implemented by companies cleared under FOCI negation measures

WilmerHale 26 Attorney Advertising. Prior results do not guarantee a similar outcome. Technology Control Plans TCPs in the ITAR (c): TCP required when foreign nationals are employed at or assigned to security-cleared facilities (c)(2): Technology security/clearance plan required as condition of exemption for intra- organizational transfers (a)(1): Technology transfer control plan and encryption technology control plan required to support satellite-related licenses 126.5(c)(4): Technology transfer control plan to support use of Canadian exemption

WilmerHale 27 Attorney Advertising. Prior results do not guarantee a similar outcome. Technology Control Plans TCPs in BIS practice BIS guidance: TCPs required in cases when foreign nationals are employed at or assigned to … facilities that handle export-controlled items or information TCP license condition for technology transfer Establish satisfactory procedures to ensure compliance with the conditions of this license, particularly those regarding limitations on access to controlled technology by consignee and the requirement to obtain U.S. government authorization before divulging controlled technology to other parties. Consignee shall implement their TCP to ensure compliance with the conditions of this license. A copy of the TCP must be delivered to DOC/BIS prior to the export of technology.

WilmerHale 28 Attorney Advertising. Prior results do not guarantee a similar outcome. Technology Control Plans TCPs in BIS practice TCP license condition for deemed exports Applicant will establish procedures to ensure compliance with the conditions of this license, particularly those regarding limitations on access to technology by foreign nationals. The Applicants key export control management officials will ensure that the foreign national complies with [these license conditions]. A copy of such procedures will be provided to DOC/BIS. Minimum necessary disclosures Non-disclosure notice and certification

WilmerHale 29 Attorney Advertising. Prior results do not guarantee a similar outcome. Technology Control Plans BIS required TCP contents Statement of corporate commitment Identification of key export management officials Training program Security procedures for preventing access to controlled technology by unauthorized personnel (e.g., badges, access codes) including procedures for visitors and unauthorized employees Pre-employment screening and non-disclosure agreement Access restrictions to ensure employees do not received controlled technology until authorized Distribution restrictions to ensure that controlled technology is not disseminated in an unauthorized manner

WilmerHale 30 Attorney Advertising. Prior results do not guarantee a similar outcome. Technology control challenges Managing access to changing intangible information Classifying nascent technologies Incorporating export classification into patent process Controlled technologies developed by foreign nationals Actual vs. potential access to controlled technology Access to global corporate networks

WilmerHale 31 Attorney Advertising. Prior results do not guarantee a similar outcome. Technology Control Plans Special technology transfer challenges Applying de minimis standards Reexports of foreign technology commingled with or drawn from controlled U.S.-origin technology (EAR 734.4) Valuation of foreign and controlled U.S. origin technology One-time report for government verification Technical assistance relating to encryption items … technical assistance, when rendered with the intent to aid in the development or production of encryption commodities or software …, may require authorization under the EAR even if the underlying encryption algorithm to be implemented is from the public domain or is not of U.S. origin. EAR 774 Supp. No. 1, ECCN 5E002 License Req. Note

WilmerHale 32 Attorney Advertising. Prior results do not guarantee a similar outcome. Technology Control Plans Special technology transfer challenges Discerning the purpose(s) of technical assistance pertaining to non-controlled items Employee travel policies and practices Technology control in international joint ventures Appointment and reporting by compliance personnel Contractual safeguards to ensure compliance Managing deemed export compliance Managing technology transfer in the cloud

WilmerHale 33 Attorney Advertising. Prior results do not guarantee a similar outcome. Questions? Barry J. Hurewitz Partner, WilmerHale