1. 1 EMBARGOES AND EXPORT CONTROLS The Challenge for U.S. Universities: A Focus for Faculty Julie T. Norris (ret.) Office of Sponsored Programs Massachusetts Institute of Technology

2. 2 The Ground Rules Don’t shoot the messenger The regulations sometimes don’t seem to make sense, so ask questions

3. 3 What is an export? An export is any oral, written, electronic or visual disclosure, shipment, transfer, or transmission of commodities, technology, information, technical data, assistance, or software codes to – Anyone outside the U.S. including a U.S. citizen – A “foreign national” whether in the U.S. (a “deemed” export) or abroad – A foreign embassy or affiliate

4. 4 What are export control laws? U.S. laws that regulate the distribution to foreign nationals and foreign countries of strategically important technology, services, and information for reasons of foreign policy and national security. Export control laws apply to all activities—not just sponsored research projects.

5. 5 What are the purposes of export control laws? Advance foreign policy goals Restrict goods and technologies that could contribute to military potential and/or economic superiority of adversaries Prevent proliferation of weapons of mass destruction Prevent terrorism Fulfill international obligations

6. 6 What is a “deemed” export? Export controls also cover transfer of goods and technology within the U.S. (transfer outside the U.S. is deemed to apply when a non-qualified foreign national receives the information in the U.S.) – Applies to technology transfers under EAR – Applies to technical data and defense services under ITAR – Unless the fundamental research exclusion applies, a university’s transfer of controlled technology to a non- permanent resident foreign national in the U.S. may be controlled or prohibited (your students!)

7. 7 What is a “deemed” export? Situations that can trigger a deemed export problem include: – Employees who are foreign nationals involved in specific research, development, and manufacturing activities subject to controls – Foreign students or scholars conducting research – Laboratory tours – Face-to-face – Telephone – Email – Fax – Sharing of computer files – Visual inspections

8. 8 Who is a foreign national? A foreign national is any person who is NOT a: U.S. citizen U.S. lawful permanent resident (“a green card holder”) Person granted asylum Person granted refugee status

9. 9 What types of projects raise export control concerns? Projects that involve the actual export or “deemed” export of any goods, technology, or related technical data that is either: – “Dual use” (commercial in nature with possible military applications) – Inherently military in nature

10. 10 What types of projects raise export control concerns? Research in the following areas frequently require export controls: engineering, space sciences, computer sciences, biomedical research (especially with lasers), research with encrypted software, research with controlled chemicals, biological agents, toxins Research conducted in certain foreign countries or where “defense services” (e.g., “how to” activities) are provided

11. 11 What types of projects raise export control concerns? Sponsor restrictions on foreign nationals or on publications Research involving the physical export of controlled goods or technology

12. 12 Scenarios that might require export licenses Physical transfer of items of equipment outside the U.S. Participation of foreign national faculty, students or staff in restricted research Presentations of previously unpublished research at conferences or meetings where foreign national scholars might be in attendance Visits to your laboratory by foreign national scholars

13. 13 Focus today is on Embargoes – managed by the Department of the Treasury under the Office of Foreign Assets Control (OFAC) Exports – managed by either the Department of State under the International Traffic in Arms Regulations (ITAR) or the Department of Commerce under the Export Administration Regulations (EAR)

14. 14 EMBARGOES [31 CFR 500-599] Department of the Treasury Office of Foreign Assets Control (OFAC) Regulates the transfer of items/services of value to embargoed nations Imposes Trade Sanctions, and Trade and Travel Embargoes Aimed at Controlling Terrorism, Drug Trafficking and Other Illicit Activities

15. 15 OFAC Sanctioned Countries Balkans Burma Code d’Ivoire Cuba Iran Iraq Liberia Libya North Korea Sudan Syria Zimbabwe

16. 16 What OFAC controls  OFAC prohibits:  Payments or providing anything of value to sanctioned countries, nationals of some countries and specified entities/individuals  Travel to and other activities with embargoed countries and individuals/entities even when exclusions/exemptions to EAR/ITAR apply  In general OFAC “trumps” export controls

17. 17 Penalties for Violation of Treasury Department (OFAC) regulations Criminal sanctions: – University – a fine of up to $1 million for each violation – Individual – a fine of up to $1 million or up to twenty years in prison, or both, for each violation Civil sanctions: – University – a fine of up to $55,000 for each violation – Individual – a fine of up to $55,000 for each violation

18. 18 Export controls cover U.S. Export controls (ITAR, EAR) – Cover any item in U.S. trade (goods, technology, information) – U.S. origin items, wherever located – Exclude patents and patent applications, artistic or nontechnical publications – Exclude technology in the public domain Exports of most high technology and military items, as well as associated technologies and certain items of commercial importance require U.S. export authorization (either license or applicable exemption)

19. 19 Background to Export Control Regulations Most export control issues fall under the jurisdiction of the following agencies: Department of State, Directorate of Defense Trade Controls (DDTC) [22 CFR 120-130] – International Traffic in Arms Regulations (ITAR) – Military items or defense articles or technical data related thereto; space technology, certain biological agents and toxins or

20. 20 Background to Export Control Regulations Department of Commerce, Bureau of Industry and Security (BIS) [15 CFR 730- 774] – Export Administration Regulations (EAR) – Items having both commercial and potential military use – Items having only commercial value but with international economic importance

21. 21 Commerce Control List Categories 0-Nuclear Materials, Facilities and Equipment 1-Materials, Chemicals, “Microorganisms” and Toxins 2-Materials Processing 3-Electronics * 4-Computers * 5-Telecommunications and Information Security * 6-Lasers and Sensors 7-Navigation and Avionics 8-Marine 9-Propulsion Systems, Space Vehicles and Related Equipment

22. 22 Penalties for Violation of Commerce Department (EAR) regulations Criminal sanctions for “willful violations”: – University – a fine of up to the greater of $1 million or five times the value of the export for each violation – Individual – a fine of up to $250,000 or imprisonment for up to ten years, or both, for each violation Criminal sanctions for “knowing violations”: – University – a fine of up to the greater of 50,000 or five times the value of the exports for each violation – Individual – a fine of up to the greater of $50,000 or five times the value of the exports or imprisonment for up to five years, or both, for each violation

23. 23 Penalties for Violation of Commerce Department (EAR) regulations Civil (Administrative) Sanctions: The imposition of a fine of up to $12,000 for each violation, except that the fine for violations involving items controlled for national security reasons is up to $120,000 for each violation. Additionally, for each violation of the EAR any or all of the following may be imposed: a) the denial of export privileges, b) the exclusion from practice, c) seizure/forfeiture of goods.

24. 24 Penalties for Violation of State Department (ITAR) regulations Criminal sanctions: – University – a fine of up to $1 million for each violation – Individual – a fine of up to $1 million or up to ten years in prison, or both, for each violation Civil sanctions: – University – a fine of up to $500,000 for each violation – Individual – a fine of up to $500,000 for each violation

25. 25 Application of Penalties at Universities EAR: many times; small fines generally; some sanctions to institutions ITAR: J. Reece Roth case at University of Tennessee – Jail time – Fine – Currently under appeal

26. 26 Background and law Early 1980’s export control laws extended to the IHE’s Intense reaction from the university community Four universities wrote to describe the consequences NSDD-189 issued in 1984 and reaffirmed by Condoleezza Rice in 2001 and John Young in 2008

27. 27 NSDD-189 Provides definition: – “Fundamental research” means basic and applied research in science and engineering, the results of which ordinarily are published and shared broadly within the scientific community. Where national security requires control, the mechanism for control at universities is classification – No restrictions may be placed on conduct or reporting of federally-funded fundamental research that has not received national security classification except as provided in statutes

28. 28 NSDD-189 (continued) University research will not be deemed to qualify as fundamental research if … the university or research institution accepts any restrictions on publications resulting from the research, other than limited prepublication reviews by research sponsors to prevent inadvertent divulging of the sponsor’s proprietary information or for filing of patent applications.

29. 29 What does this mean for a university? Allows U.S. universities to include foreign faculty, students, visitors in research involving creation of controlled information on campus in the U.S. without a license Once created in fundamental research, the information may be transferred abroad without restriction once it is in the public domain Fundamental research information is public in nature and is excluded (not just exempted) from controls

30. 30 Exclusions/Exemptions from Export Controls Fundamental Research Public Domain Educational Institution activities Full-time employment (ITAR only)

31. 31 The Fundamental Research Exclusion (FRE) applies to information Resulting from or arising during basic and applied research in science and engineering Conducted at an accredited institution of higher education (EAR) or higher learning (ITAR) Located in the U.S. Ordinarily published and shared broadly in the scientific community (note that ITAR says “is published”) Not subject to proprietary or U.S. government publication or access dissemination controls

32. 32 Issues surrounding the FRE Does not apply to items or materials Publication approval requirements by sponsor invalidate the FRE – “side deals” are dangerous! Some technologies (advanced encryption) always ineligible for fundamental research exclusion It is an open question whether the FRE exclusion applies to controlled information that is already existing and then used during research that otherwise meets the criteria for a fundamental research exclusion

33. 33 Exclusions from controls: publicly available and public domain Publicly available (EAR) and public domain (ITAR) information exclusion: – Applies to information that is already published through specified means and found in Libraries open to the public, including most university libraries Unrestricted subscriptions, newsstands, or bookstores for a cost not exceeding reproduction and distribution costs (including a reasonable profit) Published patent information (does not apply to proprietary information not publicly disclosed)

34. 34 Exclusions from controls: publicly available and public domain – Conferences, meetings, seminars, trade shows, or exhibits held in the U.S. (ITAR) or anywhere (EAR), which are generally accessible by the public for a fee reasonably related to the cost and where attendees may take notes and leave with their notes, or – Websites accessible to the public for free and without the host’s knowledge of or control of who visits or downloads software/information (clearly acceptable under EAR, and likely acceptable under ITAR)

35. 35 Exclusions from controls: educational institutions ITAR: General science, math, and engineering commonly taught at schools and universities – ITAR is focused on subject matter EAR: Information conveyed in courses listed in course catalogues and in their associated teaching labs or any accredited academic institution – EAR is focused on venue – EAR’s exemption does not cover encrypted software

36. 36 Exemption from controls: full-time employment (ITAR only) – Employment of a foreign national but only if: A bona fide full time with benefits employee of the institution Not from an ITAR embargoed country (Belarus, Cuba, Iran, Libya, North Korea, Syria, Vietnam, Burma, China, Haiti, Liberia, Somalia, Sudan, Iraq, Afghanistan, Rwanda, D.R. Congo) Resides at a permanent address in the U.S. while employed Is advised in writing not to share covered technical data with any other foreign nationals without government approval

37. 37 Repetition for Emphasis: FRE Fundamental research exclusion applies to information when the research is: Basic or applied (in DoD terms, 6.1 or 6.2) At an institution of higher education (EAR) or learning (ITAR) In the U.S., and No publication restrictions or access controls exist for the activity

38. 38 Licensing: Questions to Ask to Start Does the award contain any terms or conditions that would restrict the disclosure or dissemination of the research results? Are there any restrictions on access to or dissemination of information the sponsor or others will use on this project? If the answer to 1 or 2 is yes, does the research project fall under one of the export controlled technologies?

39. 39 Licensing: Questions to Ask to Start Does the project involve training specific personnel for a special purpose? If so, could it be considered a defense service? Will the university need to apply for an export license?

40. 40 ONE EXAMPLE ONLY…. DFAR 352-204-9014 “Notification of Non-U.S. citizen participation” states that a university shall notify the government 30 days in advance of the employment of a non-U.S. citizen on [this] contract and the government may restrict the individual from participation on some or all of the project. Issues: is this an access restriction? Is it notification or approval? Is the contract classified? Are there publication restrictions? Is it funded with 6.1 or 6.2 money?

41. 41 What licenses cover Remember the regulations apply to items of U.S. origin, “Items or Materials”, e.g., – Equipment – Chemicals – Biologicals – Other materials – Software code – Computers

42. 42 Licensing may be required When items are located anywhere if any of the following apply: On the U.S. Munitions List (USML), ITAR, 22 CFR 121.1 On the Commerce Control List (CCL), EAR, 15 CFR 774 Are related Defense Services, ITAR, 22 CFR 120.9 Are controlled technologies or technical data (information beyond general marketing materials on use, development, production, repair of controlled items or materials), 15 CFR 772, Supp.1 and 2; 22 CFR 120.10

43. 43 Examples where licenses may be required Presentations/discussions of previously unpublished research at conferences and meetings where foreign national scholars may be in attendance Research collaborations with foreign nationals and technical exchange programs Transfers of research equipment abroad (almost always) Visits to your lab by foreign scholars

44. 44 Examples where licenses will be required EAR Dual Use/Commercial Technologies on the CCL: – Terrorist supporting countries: Cuba, Iran, Libya, North Korea, Sudan, Syria – Countries of concern: Former soviet republics, China, Vietnam – Many other countries require licenses, or are subject to EAR 99 (covered in the CCL but no license required)

45. 45 Examples where licenses will be required ITAR (Military/space technologies) on the MCTL: – Policy of denial State sponsors of terrorism: Cuba, Iran, Libya, North Korean, Sudan, Syria Arms Embargo (Burma, PR China, Haiti, Liberia, Somalia, Sudan) Others (Belarus, Iraq, Vietnam) – Policy of denial (based on item/end-user) Afghanistan, Congo, Rwanda

46. 46 What is a temporary export (TMP)? There is a license exception for temporary export of tools of the trade. Reasonable kinds and quantities of these commodities and software can be taken overseas (even if controlled) but MUST remain under your effective control (physical possession) of the item. It must be with you at all time or locked in a (central) hotel safe deposit; generally hotel room safes are not sufficiently guarded. – TMPs must be returned within one year to the U.S. – No tools of the trade may be taken to embargoed countries

47. 47 Precondition to licensing Registration with the State Department (ITAR requirement only) – Filing of a DSP-9 – 22 CFR 122.2 – Some cost – Multiple year registration – Introduces concept of “empowered official”

48. 48 Getting a license Concept of “empowered official” Registration requirement with State Department Concept of a commodity jurisdictional ruling (CJ) Requirements for formal policies, training, export control dissemination plan, substantial amount of paperwork Licenses generally granted in 6-8 weeks (EAR), somewhat longer for ITAR, but can take months

49. 49 License Process - EAR Licensing process varies depending on type of export license applied for and the government agency involved in the decision making EAR – 748P Form required for all exports (commodity, software, and technology, including deemed exports) and

50. 50 License Process - EAR EAR (continued) – Supporting documents that may be applicable are 748A (item appendix for technology ECCN), and 748 B (end-use appendix) End user certificate BIS 711 statement of ultimate consignee and purchaser A letter of explanation A technology control plan

51. 51 License Process - EAR Required for EAR Deemed Export License 1. 748 P – license application 2. 748 P-A – item appendix for technology ECCN 3. Letter of explanation detailing location of technology transfer, type of technical data, forms in which technical data is to be released, use of technical data, explanation of processes – Note: It helps to show proof of foreign national’s intent to stay in U.S. if individual has filed for a green card

52. 52 License Process - EAR 4. Technology Control Plan – a plan that describes the various safeguards an institution has taken to protect technology without an export license, such as IT access controls, building access restrictions, “clean desk” and data discard procedures 5. Passport/Visa – copies of all relevant information 6. Resume – copy of current resume 7. FBI Checklist information – personal information such as date/country of birth, country of citizenship, U.S. address/foreign address, universities attended (including dates of attendance, degrees received and field of study, and current employer)

53. 53 License Process - ITAR License forms used – DSP-5 (Permanent Export) – DSP-73 (Temporary Export) – DSP-61 (Temporary Import) – DSP-85 Classified Articles (exports and imports)

54. 54 License Process - ITAR Documents Required for ITAR Deemed Export License 1. DSP-5 – license application 2. Current job description or statement of work – a detailed description of the foreign national’s current job duties and the type of technical data to be transferred 3. Professional work background – equivalent to a resume; describes all past work experience

55. 55 License Process - ITAR 4. Copy of Work Visa 5. Technology Control Plan (similar to BIS) 6. Non-Disclosure Agreement – not required if agreement already has ITAR-conditional language 7. Other supporting documents – may include equipment list, technology description, DSP-83 for significant military equipment, etc

56. 56 LICENSING PROCESS - OFAC Request license in form of letter describing purpose of travel (who, period of time, interactions with foreign government (if applicable), equipment/resources to be exported Payment to individuals in U.S. – may be required for Iran, Cuba

57. 57 ELEMENTS OF A TECHNOLOGY CONTROL PLAN Element No. 1: Commitment – Shows university commitment to compliance with export controls – Demonstrates export compliance reporting structure Government wants senior management to have export compliance responsibilities

58. 58 ELEMENTS OF A TECHNOLOGY CONTROL PLAN Element No. 2 – Physical Security Plan – Physical security access restrictions to areas where controlled equipment/technology is located Badging Building Access Visitor logs Escorts

59. 59 ELEMENTS OF A TECHNOLOGY CONTROL PLAN Element No. 3: Information Security Plan – IT access controls Server folder access Firewall protection Passwords – Technical discussions control Guidelines on meetings, foreign travel, emails, symposiums, etc. where unlicensed controlled technology will be discussed

60. 60 ELEMENTS OF A TECHNOLOGY CONTROL PLAN – Clean desk policy Guidelines on security (e.g., central storage, locked desk) hard copy controlled technical data – Data discard policy Guidelines on the appropriate method of disposal (e.g., hard drives, CDs, papers) for controlled technical data

61. 61 ELEMENTS OF A TECHNOLOGY CONTROL PLAN Element No. 4 – Personnel Screening Procedures – Guidelines to vet faculty, staff, students, and contractors for possible export control issues Review Denied Persons List, Entity List (work/education affiliations), Special Designated Nationals List and Debarred Parties List Conduct background checks (e.g., criminal, credit, etc) Know screening procedures 3 rd party contractors (e.g., temporary agencies) use

62. 62 ELEMENTS OF A TECHNOLOGY CONTROL PLAN Element No. 5 – Training and Awareness Program – Informing the University’s foreign national employees of any technology access limitations – Training U.S. employees on any technology access limitations for foreign national employees

63. 63 ELEMENTS OF A TECHNOLOGY CONTROL PLAN Element No. 6 – Self-Evaluation Program – Review schedule – Audit module – Audit report with review methodologies (e.g., procedural/transactional analyses), findings, and recommendations – Corrective actions

64. 64 Basic concepts to understand Export regulations cover only certain technologies and, therefore, the great majority of research is not in the covered technology lists of the State or Commerce departments Even if an item is on one of the lists of controlled technologies, there is generally an exclusion for fundamental research (note the need for no restrictions on publications or foreign nationals)

65. 65 Basic concepts to understand Licenses needed not only for the shipment of tangible items but also to the research results themselves “Export” does not necessarily mean out of the country; concept of “deemed export” critical

66. 66 Basic concepts to understand There are many reasons licenses may be denied or impossible to get and the list of countries changes frequently If you need a license it takes (a lot of) time Penalties for noncompliance may be severe

67. 67 Key Issues for Universities Public domain Fundamental research exclusion “Deemed” exports The proposed Gates revisions to the export control system

68. Proposed Gates revisions Three phases Key elements – Single control list – Single Enforcement Coordination Agency – Single I/T system – Single licensing agency Proposed to be completed “end of this year” 68

69. 69 What are the ticking time bombs? Corporate sponsored research – Liability if know, or have reason to know, about corporate sponsor violations Material transfer agreements Increasing scrutiny of all exports, universities in particular – Commerce criticized by GAO for failure to enforce “deemed” exports appropriately “National security vs. openness” Biology, biotech, and bioengineering under increasing threat “Troublesome clauses”

70. 70 What makes some clauses troublesome? Conflicts with institutional policies on openness in research and unfettered transmission of knowledge Most institutions have clear policies on freedom to publish; fewer on use of foreign nationals and there is the issue of granting exceptions to the policies or procedures May require sponsor approval for publications May require sponsor approval of specific individuals assigned to selected research projects Travel and presentations at conferences and programs can become difficult Exceptions can trigger complicated (and expensive) export control requirements

71. 71 Major truths Easier to make it public than keep it proprietary Beware of equipment, encrypted software, listed/controlled chemicals, bio-agents, and toxins Side deals are dangerous Publish or perish! Fear works!

72. 72 Best practices Have and adhere to an institutional policy on publication restrictions and access issues Keep it open! – No side deals!!! Centralize administration/oversight Support responsible office with legal counsel Educate the community Provide threshold guidelines

73. 73 Scenario 1 Giving students and visitors from a foreign country a tour of the research laboratories in your School may constitute an export. __True __False True. The tour may include access to areas containing export controlled materials or technology. Compounding the problem might be the countries represented by the visitors.

74. 74 Scenario 2 You worked with your Empowered Official and received a license last year to ship a piece of export controlled equipment to a foreign country. You are getting ready to ship another identical piece of equipment but, since it is identical and less than a year from the prior license request, you do not need an additional license. __True __False False. Shipping a second item requires a separate license.

75. 75 Scenario 3 You are teaching a course to graduate and undergraduate students on solid-state lasers. The course is listed in the course catalog, but since foreign national students are involved you need a license. __True __False False. Teaching a regular course which is listed in the institution’s course catalog is exempt from license requirements, whether the students are U.S. citizens or foreign nationals.

76. 76 Scenario 4 Same as scenario 3 EXCEPT the course is listed simply as a “special topics” course. __True __False True. The difference is that a “special topics” course is not a regular course listed in the course catalog.

77. 77 Scenario 5 Faculty member is going to Germany to do research at a German university while on sabbatical. Since Germany isn’t a terrorist country or on the Treasury’s embargoed list, he doesn’t need any license or approval. __True __False False. The research itself might be controlled and he might be sharing the results with foreign nationals from controlled countries while in Germany.

78. 78 Scenario 6 Faculty member is doing basic research in the area of remote sensing on a contract from the Department of Defense. The contract includes a clause restricting the release of unclassified information without sponsor approval. I would need approval from the sponsor to publish the information but I would be free to share the research results with all the students in my laboratory, including foreign students, prior to publication. __True __False False. Accepting the clause negated the FRE and thus foreign nationals working on the projects or learning the research details would require a license.

79. 79 Scenario 7 Faculty member is working with company on GEMS (ITAR controlled material). Contract includes a restriction on information “generated under the contract” as well as “provided by the sponsor.” The faculty member is a U.S. citizen and the information is provided directly to him. Foreign nationals cannot work on the contract even if all the ITAR controlled information is restricted to the PI and not shared with the students. __True __False True. The problem has to do with information “generated under the contract”. If that language were out, everything done on campus that did not utilize the proprietary information given to the faculty member would be FRE. Since it is in the contract, the FRE is not available.

80. 80 Scenario 8 Faculty member (U.S. citizen) plans to take his laptop overseas with greater than 56-bit encryption installed on it. He is visiting the U.K, Germany, and Ireland and does not need a license to do so. __True __False True, as long as the laptop remains under the faculty member’s effective control while outside the U.S. This would not be true, however, if he were traveling to or through an embargoed or terrorist country, where a license would be required.

81. 81 Scenario 9 A U.S. citizen/permanent resident may use greater than 56-bit encryption when communicating with someone outside the U.S. __True __False True, since the use of encryption is not regulated. However, the U.S. person cannot ship a U.S. product overseas without a license (which might be necessary for interoperability). Neither can the U.S. person import a product made overseas and then reship it without a license.

82. 82 Scenario 10 A U.S. citizen has been invited to give four lectures at Chinese universities on his current research. He knows that he can only talk about material that has been published and he has developed a talk (with overheads) drawn from several publications he authored over the last 4 years. He complies with all the ITAR regulations and is free to deliver his talk. ___True ___False False. The talk he is preparing to give has not itself been published, although parts appear in several publications. Under the ITAR regulations, the specific talk he is giving must appear in the public literature exactly as he is delivering it. (Remember, posting on a publicly available website qualifies as “published.”)