Page 1 U.S. Export Controls -- The Challenge for Research Universities U.S. Export Controls -- The Challenge for Research Universities Richard A. Johnson NCURA November 2003

Page 2 U.S. Export Controls and Trade Sanctions n Purposes and Overview n The basic export control framework -- ITAR, EAR and OFAC n Why export controls have become an “A-list” concern for top research universities n Application to university or non-profit research n Compliance, enforcement and penalties -- institutional and individual n Emerging trends and issues for research universities

Page 3 U.S. Export Controls and Trade Sanctions Purposes n U.S. export controls have multiple goals that sometimes conflict n Advance Foreign Policy Goals n Restrict Exports of Goods and Technology That Could Contribute to the Military Potential of Adversaries n Prevent Proliferation of Weapons of Mass Destruction (nuclear, biological, chemical) n Prevent Terrorism n Fulfill International Obligations

Page 4 U.S. Export Controls and Trade Sanctions Overview U.S. Export controls -- some basic points — Cover Any Item in U.S. Trade (goods, technology, information) — Extend to U.S.-Origin Items Wherever Located, including U.S. (Jurisdiction Follows the Item or Technology Worldwide) — Under U.S. law, exporting is a privilege and not a right — Controls have broad coverage and limited exclusions -- exs., — Published Patents — Technology in the Public Domain n Exports of most high-technology and military items, and associated technology, are subject to U.S. export controls (require either a license or an applicable exemption) -- an increasing amount of university research is covered n Limited transparency, objectivity and procedural protections compared to other U.S. government regulations

Page 5 U.S. Export Controls and Trade Sanctions Agency Responsibilities n State Department: “Munitions” (the International Traffic in Arms Regulations or “ITAR”) n Under Secretary for International Security (Bolton) n Asst. Sec’y for Political-Military Affairs (Bloomfield) n Licensing: Directorate of Defense Trade Controls (“DTC”) n Commerce Department: “Dual-Use” Items (the Export Administration Regulations or “EAR”) n Under Secretary for Industry and Security (Juster) n Licensing: Bureau of Industry and Security (“BIS”), formerly BXA n Treasury Department, Office of Foreign Assets Control (OFAC): Trade Sanctions, Embargoes, Restrictions on Transfers to Certain End-Users, Terrorism, Anti-Narcotics

Page 6 U.S. Export Controls and Trade Sanctions Differences Between ITAR and EAR n International Traffic in Arms Regulations (ITAR) — Covers military items (“munitions” or “defense articles”) — Regulates goods and technology designed to kill people or defend against death in a military setting (e.g., tank, fighter aircraft, nerve agent defensive equipment) — Includes space-related technology and research; increasing applicability to other university research areas such as nanotechnology/new materials and sensors and life sciences — Creates “defense articles” (includes tech data which encompasses software unlike EAR) and “defense services” (certain information to be exported may be controlled as a “defense service” even if in the public domain) — Includes technical data related to defense articles and defense services (furnishing assistance including design, engineering, and use of defense articles)

Page 7 U.S. Export Controls and Trade Sanctions Differences Between ITAR and EAR n Export Administration Regulations (EAR) — Covers dual-use items: 10 CCL categories of different technologies covering equipment, tests, materials, software and technology — Regulates items designed for commercial purpose but that can have military or security applications (e.g., computers, pathogens, civilian aircraft) — Covers goods, test equipment, materials, technology (tech data and technical assistance) and software — Also covers “re-export” of “U.S.-origin” items outside the United States

Page 8 U.S. Export Controls and Trade Sanctions Economic Sanctions n U.S. economic sanctions focus on the end-user or country rather than the technology n Embargoes administered by Office of Foreign Assets Control, U.S. Department of Treasury (“OFAC”) — Prohibitions on trade with countries such as Iran, Cuba — Limitations on activities in certain areas of countries or with certain non-state actors n OFAC prohibits payments or providing “value” to nationals of sanctioned countries and to specified entities even if the country is not subject to sanctions (ex. Baathists in Iraq) n Separate prohibitions under the ITAR and EAR — ITAR proscribed list/sanctions (e.g., Syria or requirement for presidential waiver for China) — EAR restricts exchanges with some entities and universities in India, Israel, Russia, etc. because of proliferation concerns

Page 9 U.S. Export Controls -- Why the growing concern with universities? n 9/11 changed everything -- including how the government looks at export controls n the emergence of top research universities as a focal point for U.S. government export control compliance n the growing intersection of cutting-edge science, technology and engineering research with national security, foreign policy and homeland security n the evolving role of the research university (global in scope, multidisciplinary, changing innovation role)

Page 10 U.S. Export Controls -- The Post 9/11 Regulatory Framework n Increasing intersection of export controls with post-9/11 regulatory framework ( and growing disconnects) n Life sciences as a major security concern -- biological agents, toxins and chemical precursors n Increasing focus on material transfers and use of a wide range of select agents, chemicals and reagents n Select agents: growing export control issues beyond compliance with the Patriot Act and the Biopreparedness Act regulations n Increasing interest not only in the material but also in controlling the underlying technology, information and data n “Sensitive but unclassified” information n Reconsideration of NSDD-189 n Card memo (March 2002) and other Executive directives

Page 11 U.S. Export Controls --The Post 9/11 Regulatory Framework n Increasing intersection of export controls with post-9/11 regulatory framework ( and growing disconnects) n Foreign student visas and IPASS n Technology Alert List n Immigration Act (212): deny visas “in area of illegal export of U.S. technology” n Sensitivity to fields/countries subject to nonproliferation export controls (ex. India, China and Israel) n “Regulation by contract” -- new federal funding programs increasingly linked to export controls or government security controls (exs.,bioterrorism, homeland security and cybersecurity)

Page 12 U.S. Export Controls -- A Growing Focus on Top Research Universities n Growing government perception that universities “are not serious” about export control compliance and are misusing the fundamental research exemption n Corporate complaints that universities “aren’t playing by the same rules” with competitive implications n GAO Report (2002) severely criticizing Commerce’s oversight of “deemed exports”, especially with foreign nationals from India, Pakistan, China, Russia and Israel n Fall Federal interagency export control investigation/audit of 9 major research universities; OIG Report and likely Congressional hearings in 2004 n “Enhanced” export control enforcement focus on universities and their researchers

Page 13 U.S. Export Controls and Trade Sanctions Key Issues for University and Non-Profit Research n “Deemed” Export n Public Domain Exemption n Fundamental Research Exemption n Full-time employee exemption n Educational Instruction Exemption n Government-sponsored research covered by national security contract controls n ITAR -- “defense articles” and “defense services”, especially in space research and, increasingly, in life sciences and nanotechnology research n The application of OFAC sanctions to university-sponsored or related activities

Page 14 U.S. Export Controls and Trade Sanctions “Deemed” Exports n U.S. export controls cover transfers of goods and technology within the U.S. (the transfer outside the U.S. is deemed to apply when a foreign national receives the information in the U.S.) — Applies to technology transfers under the EAR and the provision of ITAR technical data and defense services — Unless the fundamental research exemption applies, a university’s transfer of controlled technology to a non- permanent resident foreign national who is not a full-time university employee in the U.S. may be controlled and/or prohibited — Visa status important: permanent resident (“green card holder”) has same right to controlled information as U.S. citizen

Page 15 U.S. Export Controls and Trade Sanctions -- Public Domain n Public Domain/Publicly Available n Broadest exclusion under EAR and ITAR -- it allows deemed export or export without controls n Preconditions n no equipment or encrypted software involved n no reason to believe information will be used for WMD n U.S. government has not imposed any access and dissemination controls as a funding condition n No side deals

Page 16 U.S. Export Controls and Trade Sanctions -- Public Domain n Applies to published information through one or more of the following: n libraries open to the public n unrestricted subscriptions for a cost not exceeding reproduction/distribution (including reasonable profit) n published patents n conferences, seminars in the United States accessible to public for a reasonable fee and where notes can be taken (ITAR) --or also abroad only if EAR n Generally accessible free websites w/o knowledge n General science/math principles taught at universities

Page 17 U.S. Export Controls and Trade Sanctions State Dept. (ITAR) Fundamental Research n Fundamental research exemption recognized, but purposely limited, given jurisdiction over goods and technologies designed to kill people n Covers information “which is published and which is generally accessible or available to the public” through a number of mechanisms including: — Unrestricted publications; — Fundamental research in science and engineering at accredited institutions of higher learning in the U.S. where the resulting information is ordinarily published and shared broadly in the scientific community — Excludes information restricted for proprietary reasons or specific U.S. government access and dissemination controls — Excludes research abroad by Americans

Page 18 U.S. Export Controls and Trade Sanctions Commerce (EAR) Fundamental Research n Exemption significantly broader than ITAR n Research conducted by scientists, engineers, or students at a U.S. university normally exempt from licensing — Brief prepublication review solely: (1) to ensure no inadvertent release of proprietary information; or (2) to decide whether to patent generally does not trigger licensing — Prepublication review by a corporate sponsor or other restrictions on the publication of scientific and technical information generally invalidates the exemption — Exemption still available for work under U.S. government grants involving Commerce-controlled technology even if there are access and dissemination controls provided that university follows national security controls in grant proposal n Some technologies ineligible for fundamental research exemption (e.g., advanced encryption)

Page 19 U.S. Export Controls and Trade Sanctions Application to University Research n Export of research products — Certain oceanography or marine biology equipment may be controlled by ITAR — Specially designed electronic components could be controlled n Temporary transfer of research equipment abroad — Carrying scientific equipment to certain destinations for research may require authorization (e.g., Iran, Syria, China, etc.) n Software n Software that is provided to the public for free may not require licenses, but proprietary software of controlled technology could require licensing — Encryption technology could require licenses or could be prohibited for transfers to certain foreign nationals/countries — Source code licenses as “dissemination controls”

Page 20 U.S. Export Controls and Trade Sanctions Application to University Research (cont’d) n Restrictions on certain foreign nationals — March 2002 State Department rule expands fundamental research exemption for foreign nations involved in space-related research, but provides no relief for foreign nationals from certain countries (e.g., China) and creates oversight problems (e.g., U.S. entity must be responsible for what its European collaborator does with the information/technology) — IPASS or similar measures could result in foreign nationals from certain countries being prohibited from working on “uniquely available sensitive technology” n Government grants may limit access by foreign nationals — Agencies may preclude or limit access by foreign nationals to research based on the export control laws — Determining whether a restriction is a “specific access and dissemination control” under the ITAR (which would invalidate the fundamental research exemption) particularly problematic

Page 21 U.S. Export Controls and Trade Sanctions Application to University Research (cont’d) n Corporate grants may limit access by foreign nationals — Proprietary restrictions or restrictions on publication by corporate grants may invalidate fundamental research — Could trigger licensing requirements for certain foreign nationals n Conferences — Potential restrictions on participants — Inability to co-sponsor with certain countries or groups (e.g., restrictions on co-sponsoring conference with Iranian government) n Transfer of defense services — Potential license requirements for work with foreign nationals to launch research satellite

Page 22 U.S. Export Controls and Trade Sanctions Application to University Research (cont’d) n No side deals! Any unauthorized “understandings” or side deals can pose serious dangers for the university and for the individual researcher n License processing takes time — Fast approvals in weeks; — Most approvals in months; — The hardest cases can take years

Page 23 U.S. Export Controls and Trade Sanctions Full-Time Employee Exemption n Exemptions for “full-time, regular” bona fide employees who maintain U.S. residency during employment n ITAR -- but university must inform employee/faculty member in writing that Tech Data may not be transferred to foreign nationals without DDTC written, prior approval n Also, exemption limited to Tech Data; some at DDTC believe it does not extend to “defense services” n These exemptions may preclude the need for licenses, but often are unavailable for foreign national researchers — Visa restrictions may preclude regular employment status by requiring the visa holder to maintain a foreign residence (e.g., most students with an F or J visa) — Many researchers, particularly post-docs and students, cannot qualify for the exemption because of long-standing employment policies — Foreign visitors to campus, such as conference or colloquium participants, generally do not qualify for an exemption

Page 24 U.S. Export Controls and Trade Sanctions Penalties for Noncompliance n State Department (ITAR) — Criminal violations: up to $1,000,000 per violation, up to 10 years imprisonment — Civil penalties: seizure and forfeiture of the articles and any vessel, aircraft or vehicle involved in attempted violation, revocation of exporting privileges, fines of up to $500,000 per violation n Commerce Department (EAR) — Criminal violations: $50,000-$1,000,000 or five times the value of the export, whichever is greater per violation (range depends on the applicable law), up to 10 years imprisonment — Civil penalties: loss of export privileges, fines $10,000- $120,000 per violation — Ex: DOC recently levied a $1.76 million fine on a company that exported to W. Europe and Japan routine research reagents without a license

Page 25 U.S. Export Controls and Trade Sanctions Penalties for Noncompliance (cont’d) n Loss of “exporting” privileges (usually for days) could cripple a university’s normal activities n Puts federal funding at risk -- for the university and for the individual n Treasury Department (OFAC) — Criminal violations: up to $1,000,000 per violation, up to 10 years imprisonment — Civil penalties: $12,000 to $55,000 fines (depending on applicable law) per violation. UCLA recently fined for an OFAC violation involving an activity with Iran. — Violation of specific sanctions laws may add additional penalties n Public relations and media attention -- Most settlements with the Commerce, State or Treasury Departments generally become public. Court cases are always public!

Page 26 U.S. Export Controls -- The breadth of export control issues n Some current issues to consider in thinking about the breadth of export controls: n Corporate sponsored research: n Liability if know, or have reason to know, about corporate sponsor violations, EAR General Prohibition Ten, 15 CFR § 736.2(b)(10) n Ex.: corporate documents  university U.S. citizens  release to university foreign researchers  university violations n Even if FR applies to university work, the initial corporate- university transfer may be subject to license requirements n Material transfer agreements: — Do MTA conditions eliminate the FR exemption? — Exports of biological material increasingly will require licenses

Page 27 U.S. Export Controls -- the breadth of export controls n University Patents: n Tech transfer disclosures for potential licensing to foreign entities or foreign nationals before patent issues may export license n Export controlled technology can be exported without license if directly related to foreign patent applications n Increasing government interest in greater use of Invention Secrecy Act of 1951 for sensitive university inventions as de facto export control tool n about 5000 patents currently have Secrecy Orders

Page 28 U.S. Export Controls -- the breadth of e xport control issues n Software license terms -- especially source code; software license terms as “access and dissemination controls” that invalidate the fundamental research exemption n Server access: a demanding compliance challenge because you must be able to prove the negative n Can you show that non-US persons do not have access to export- controlled technical data? n Can you demonstrate that nothing on the open server is export- controlled? n Do you know the export classifications of the technology and software on the university’s servers?