Export Controls: An Introduction Gene Stein Director, Sponsored Research Development

2 What Are ITAR and EAR? ITAR : International Traffic in Arms Regulations EAR: Export Administration Regulations These regulations apply to all of SDSU’s activities, not just sponsored projects.

3 Why Do They Exist? The U.S. government wants to make sure that strategically important technology, services, and information don’t get into the hands of foreign nationals and foreign countries. Some of the regulations have been around for decades, but there is more concern since Sept. 11, 2001.

4 Three Government Agencies Involved Department of State: Controls defense articles and services; technical data; most space-related articles (ITAR) Department of Commerce (Bureau of Industry and Security): Controls “dual-use” items—goods and technology with both civilian and military uses (EAR) Department of the Treasury: Controls trade embargoes and the Customs Service

5 What if SDSU Doesn’t Do Sensitive Defense Work? We’re not building tanks or missiles. Why worry? Some research that faculty members do can be defense-related or have a dual use (toxins/micro- organisms, lasers, computer design) If we’re going to engage in this work we may need to get a license, which can take months and $$

6 Why Must We Comply? Possible fines and imprisonment for violators Possible civil and criminal penalties for individuals, SDSU, and SDSURF Loss of export privileges Loss of research grants and contracts Bad publicity

7 How Is “Export” Defined? An actual shipment of items (equipment, data, software, information) subject to ITAR or EAR out of the U.S. Performing technical assistance for, or on behalf of, a foreign person or company, whether in the U.S. or abroad Re-exporting or shipping U.S.-origin goods or technology from one foreign country to another foreign country.

8 Defining “Export” (cont’d) Releasing (including oral or visual disclosure) technical data or technology to a foreign person, whether in the U.S. (“deemed export”) or abroad. Important If a foreign student sees or discusses sensitive data in a faculty member’s lab, it is considered a deemed export and is the same as sending the data or technology to that student’s home country.

9 What Is A Deemed Export? In the absence of an exclusion, a license must be obtained from the U.S. Dept of State or Commerce to disclose controlled technical information to a foreign person in the U.S. or abroad. Methods of disclosure include: Fax; telephone conversations; communications; computer data disclosure; face-to-face discussion; training sessions; tours with visual inspection.

10 Who Is A “Foreign Person”? A foreign person is everyone other than a: U.S. citizen; permanent resident alien; legal immigrant with a green card; or “protected individual” (refugee/someone with asylum) A business that is not incorporated in the U.S. is a considered a foreign person.

11 “Foreign Person” Problem/Solution Problem: How can a university check the nationality of every student who goes into a lab? It’s not realistic, impairs education, and restricts the free flow of information. Solution? Say that the visas and scrutiny students got before coming to the U.S. are sufficient.

12 Categories of Items under ITAR ITAR covers military items (listed I–XXI) such as: I.Firearms, assault weapons, shotguns II.Guns and armament III.Ammunition/ordnance IV.Guided missiles, bombs, torpedoes (It goes down to Item XXI.) Item XIV is Toxicological, Biological, Chemicals Aside from Item XIV, this won’t affect SDSU.

13 EAR (Military & Civilian Use) 0. Nuclear materials, facilities, equipment 1. Chemicals, microorganisms, toxins 2. Materials processing 3. Electronics design, development, production 4. Computers 5. Telecomm. and information security 6. Sensors and lasers 7. Navigation and avionics 8. Marine 9. Propulsion systems, space vehicles We MAY need a license on these

14 Implications of Export Laws There will be no effect on most university research, at SDSU and elsewhere. But there will be a potential impact on: Ability of foreign researchers or students to participate in research involving controlled technology SDSU’s ability to provide some training (mainly in controlled equip.) to foreign persons Ability to send controlled equipment to foreign countries

15 Exemptions (Some Good News) A license is not required to disseminate information if one of three exemptions applies: Fundamental Research Exemption (ITAR, EAR) Employment Exemption (ITAR only) Education Exemption (ITAR, EAR)

16 Fundamental Research Exemption This is important: No license is required to disclose to foreign persons information that is in the public domain, meaning it is published and is generally accessible or available to the public through books, news, libraries open to the public, unrestricted subscriptions, conferences, etc.

17 FRE (cont’d.) Even more importantly for Universities No license is required when the work is fundamental research. Fundamental Research is “basic and applied research in science and engineering at universities where the resulting information is ordinarily published and shared broadly in the scientific community.”

18 Rough translation for implementation: If a faculty member is allowed to publish his/her research findings in the open literature, the Fundamental Research Exemption applies and a license is not needed. If publishing restrictions are accepted, and/or foreigners are not allowed to participate or see the research, it is not fundamental research. These restrictions destroy the exemption. FRE (cont’d.)

19 National Security Decision Directive-189 Reagan Administration issued in 1985 It establishes the following policies: To the maximum extent possible, the products of fundamental research should remain unrestricted Where national security requires control of federally-funded fundamental research in science and engineering at universities and labs, control should be through security classification

20 NSDD-189 (cont’d.) “No restrictions may be placed upon the conduct or reporting of federally-funded fundamental research that has not received security classification, except as provided in applicable statutes.” In 2001, former National Security Advisor Condoleeza Rice reaffirmed NSDD-189. Problem: Many federal contract officials don’t know about NSDD-189.

21 More on FRE Forbids participation by foreign persons; Gives the sponsor the right to approve publications resulting from the research; or Restricts participation in research and/or access to, and disclosure of, research results. The FRE is destroyed if SDSU accepts any contract clause that:

22 FRE (cont’d.) A “side deal” between the PI and sponsor (not to publish) can destroy the FRE and may also violate university policies. NOTE: Sponsors are allowed to request temporary delays in publication (30-90 days) to allow time to review for patentable or confidential information without destroying the FRE.

23 FRE (cont’d) If the sponsor requires the PI to delete certain information, or if the PI is required to get the sponsor’s consent before publishing, the FRE is destroyed. NOTE: Accepting a restriction on one project does not destroy the FRE on others. Even a restriction on one part of a project doesn’t destroy the FRE on the total project.

24 Strategies Protect the FRE by negotiating the elimination of all contract clauses or language that restrict university control over publications, or limit access to, or participation by, foreigners in research. Do not accept any research projects that restrict the ability to publish or share information with everyone.

25 Strategies (cont’d.) DoD Clause (Disclosure of Information) FAR Clause (Rights in Data, Special Works) Army Clause (Release of Information) Also, AR and AR DFARS Air Force Clause (Export Controlled Data Restrictions) Army Corps of Engineers, On federal projects or on subcontracts from industry, do not accept these clauses:

26 Strategies (cont’d.) With industry, it may be necessary to see the company’s prime contract to make sure about flow- down clauses With industry, we may only be able to accept a portion of the workscope, so that the export-controlled part is done by the company, with SDSU’s part being fully publishable

27 Strategies (cont’d.) If SDSURF and SDSU decide to accept an award that requires the PI to receive export- controlled information, we must consider whether the information is: Central to the project (probably making the whole project export-controlled); or Tangential, in that the PI needs the information but others on the project don’t.

28 Strategies (cont’d.) If we decide the information is tangential: Execute a nondisclosure agreement Require that the information be clearly marked “export controlled” Work with the PI to make sure he/she safeguards the information Ask PI sign a statement accepting responsibility for protecting the information Why?

29 Penalties Liability is personal as well as institutional Penalties are severe: Fines up to $1 million Significant prison time OPINION: Except in rare and unusual cases, SDSU should not accept awards where export-controlled information is central to the project.

30 II. Employment Exemption No license is required to share technical information with a foreign person who: Is a full-time, bona fide SDSU employee Has a permanent US address while employed, provided that he/she is: (a) not a national of certain countries (b) is advised in writing not to share controlled information with other foreign persons

31 Employment Exemption (cont’d.) The employment exemption does not apply to students. They are not employees. This means that certain foreign students cannot have access to, or participate in, research involving controlled information or technology. How can a PI know what country every student is from? PIs won’t check visas of their students This is another reason not to accept awards with export-controlled material, information, or data

32 III. Education Exemption Another exemption…. If the controlled information concerns “general scientific, mathematical, or engineering principles commonly taught at universities, or is information in the public domain,” no license is required to share it with foreign persons Foreign students using controlled equipment to conduct research should be registered for a credit- bearing research class.

33 Equipment Exemption? ITAR and EAR prohibit training foreign persons in the design, development, use, or testing of controlled equipment without a license. BUT… Most universities rely on: the FRE because equipment is part of doing research; or the education exemption when instruction requires use of equipment … and faculty won’t check students’ visas.

34 Laptop Exemption Excluding countries under sanction (Iran, Iraq, Myanmar, Cuba, Libya, Liberia, Syria, North Korea), faculty can take a laptop out of the U.S. to use on a project that qualifies as fundamental research. There’s a license exemption for temporary export (TMP) if the laptop can be considered a “tool of the trade” and the PI retains control of it at all times. Microsoft’s Web site tells which of their software is controlled and needs a license.

35 It Gets Confusing – Example I SDSU faculty wants to take GPS systems to France to train colleagues. GPS is covered under EAR, category 7 (Navigation and Avionics). Maybe also under ITAR. Is a license needed? From which agency? PI and SDSU need to figure it out. A license may be needed. Some colleagues may not be French. Are some on list of denied people?

36 Example II Physics Dept. wants to hire a foreign national as a tech assistant. Is an export license required? Maybe yes. If a foreign national is hired in a technical, non-clerical position, his/her hire is considered a deemed export. Transferring technology or data to the person is the same as transferring the technology to the person’s home country. If an export license is not required because of the person’s nationality, he/she should sign a document agreeing to comply with US export regulations. Licenses can take up to a year to obtain.

37 What Can Hurt Us? Research sponsored by corporations: Is the corporation in violation? Is our research subcontract part of a larger agreement that contains export controls? Also…. Increasing federal scrutiny of university research and deemed exports Troublesome FAR clauses restricting publication Material transfer agreements Interpreting national security vs. “openness”

38 What Do We Have to Do? Educate SDSURF and key SDSU administrators (including deans and chairs) about export control issues and penalties Create an export control awareness program for faculty and other researchers Designate someone in Graduate Division and/or SDSURF to be point-person for information on export control issues Be sure questions on routing form concerning export control are answered by PI

39 What Do We Have to Do? (cont’d) Train SDSURF staff to look for export control issues in the contract review process. Does an exemption apply? Are there hidden publishing restrictions, etc? Select a person (VP for Research?) who has authority to decide whether SDSU will accept projects that require a license. Option: Decide that research projects without one of the exemptions (esp. FRE) will not be accepted.