1. ITAR Information Management
Export Control Program
Level 3 Training
ITAR Information Management
University of Wisconsin - Madison
Tom Demke
Export Control Compliance Officer
SSEC Quality & Safety Manager
Rev. -, 11/17/10, TAD

2. Export Control - Level 3 Training
Agenda
What Is ITAR?
Why Do We Care About ITAR?
Definitions
Fundamental Research Exemption
Public Domain
Deemed Export
US Persons
Compliance
Meetings w/ ITAR Information
Means of Transferring Information
Verbal Information
Managing ITAR Paper Documents
Managing ITAR Electronic Information
Non-Disclosure Agreements
Helpful Hints
Rev. -, 11/17/10, TAD

3. Export Control - Level 3 Training
WHAT IS ITAR?
International Traffic in Arms Regulations - 22CFR 120
Regulated by the US State Department
Purpose - Control the export of military equipment & information regarding military equipment
US Munitions List describes the equipment included under ITAR
Rev. -, 11/17/10, TAD

4. Export Control - Level 3 Training
WHY DO WE CARE ABOUT ITAR?
Controls exportation of arms to non-US persons
Exportation is defined as the transfer of equipment, goods, information or data
Exportation can occur within the US - conferences, seminars
Arms includes items such as:
Guidance systems for missiles - Category IV
IR focal plane arrays (detectors) - Category XII
Weaponized biological agents - Category XIV
Satellites & equipment on satellites - Category XV
Can include H/W, S/W, info, data, services, chemicals, biologicals
Responsibility to comply lies with individual, not UW
It is the individual’s responsibility to ensure they are not transferring ITAR-sensitive goods or data to non-US persons
Rev. -, 11/17/10, TAD

5. Export Control - Level 3 Training
Definitions
Rev. -, 11/17/10, TAD

6. Export Control - Level 3 Training
FUNDAMENTAL RESEARCH EXEMPTION
Fundamental Research Exemption
Because of the multi-national nature of institutions like the UW, universities have been given an exemption from ITAR to conduct fundamental research that is in the public domain
PI or PM needs to assess export control beginning of project
Rev. -, 11/17/10, TAD

7. Export Control - Level 3 Training
PUBLIC DOMAIN
Public Domain
Articles in trade journals, talks at seminars, poster sessions
Public Domain: Information which is published & generally accessible or available to the public
Publishing information to the library or a publicly-accessible website is considered acceptable
Items/information in the public domain are not subject to export control
Publish “early & often”
Rev. -, 11/17/10, TAD

8. Export Control - Level 3 Training
PUBLIC DOMAIN (cont.)
DO NOT accept limitations to publishing in the project contract
Public domain status cannot be claimed for information subject to a non-disclosure agreement (NDA)
Pay particular attention when working with industry partners
Rev. -, 11/17/10, TAD

9. Export Control - Level 3 Training
DEEMED EXPORT
Transfer of technology, including use of equipment, that has certain export restrictions to a foreign national in the US
This can include controlled information transferred to a foreign national at a conference within the US
Rev. -, 11/17/10, TAD

10. Export Control - Level 3 Training
US PERSON
Status
US Person
U.S. citizen
Yes
U.S. national
Alien w/ green card (lawful permanent resident)
Alien lawfully admitted for temporary residence
Yes (protected individual)
Alien w/ work/study visa No
Foreign visitors attending conferences/workshops
Alien admitted as a refugee
Alien granted asylum
Illegal alien
Corporations, business associations, partnerships or other organizations incorporated to do business in US
Governmental entities
Rev. -, 11/17/10, TAD

11. Export Control - Level 3 Training
Compliance
Rev. -, 11/17/10, TAD

12. Export Control - Level 3 Training
PURPOSE (of the following measures)
Assure compliance with regulations
Prevent need for getting an export license
Prevent inadvertent transfer of controlled information to a foreign national
Rev. -, 11/17/10, TAD

13. Export Control - Level 3 Training
MEETINGS w/ ITAR INFORMATION
Meetings Held Here
Reasonable notice to participants prior to meeting that ITAR-sensitive information will be discussed
Advise participants at beginning of meeting & just before ITAR-sensitive information is discussed
Only US Persons attend the ITAR session
Record of ITAR session
Who attended
What ITAR material was discussed
Forward record to your organization’s export control POC
Rev. -, 11/17/10, TAD

14. Meetings Held Elsewhere
Export Control - Level 3 Training
MEETINGS w/ ITAR INFORMATION (cont.)
Meetings Held Elsewhere
Only US Persons attend the ITAR session
Contact organizational POC or UW ECCO if you have ITAR-related concerns before or after attending a meeting
Rev. -, 11/17/10, TAD

15. Export Control - Level 3 Training
MEETINGS w/ ITAR INFORMATION (cont.)
What Can Be Presented
Information in the Public Domain
Released materials (previously cleared for presentation)
New materials (exhaust 1st two bullets before presenting new materials)
Can Be Discussed
Cannot Be Discussed
“What”
“How” - defense service
Specs & requirements
Design trade studies
Schedule, cost, status
Procurement sensitive issues
General drawings
Design decisions
Data expected (type, rate, timeliness)
Technical problems & solutions
Review Team - Each organization should have a review team, if you have questions about what you can present
Rev. -, 11/17/10, TAD

16. Export Control - Level 3 Training
MEANS OF TRANSFERRING INFORMATION
Means of Information Transfer
Verbal (or somehow exposed to it)
Printed (paper) Documents
Electronic Information
Be aware of export requirements
Use again?
Encrypt or place in a password-protected folder
Send to
librarian
Shred
Rev. -, 11/17/10, TAD

17. Export Control - Level 3 Training
VERBAL INFORMATION
Person transferring the information is responsible for ensuring that his/her audience can receive the information
Make sure the receivers are US Persons
Rev. -, 11/17/10, TAD

18. Export Control - Level 3 Training
MANAGING ITAR PAPER DOCUMENTS
ITAR
Sensitive
Authorized individuals may check out documents
US Persons
Exempted persons
Maintain in a locked cabinet w/ a designated librarian
Documents to be returned when no longer needed
Log of documents kept
Name of document, when received & from whom
Documents are stamped
While in use, documents need to be maintained in a manner to prevent inadvertent export
Rev. -, 11/17/10, TAD

19. Type Of Electronic Information
Export Control - Level 3 Training
MANAGING ITAR ELECTRONIC INFORMATION
Documents, data, software
Files, folders or repositories should be marked ITAR-sensitive
Verify with source if unsure whether information is ITAR
Type Of Electronic Information
Means Of Control
Downloaded Documents / Presentations
If printed, maintain paper copy in library as noted for paper documents
Reviewed Information / Documents / Presentations
Not downloaded; not printed
Only US Persons or exempt persons shall use this information
Downloaded Electronic Files (data, software for evaluation, software for modification, restricted information)
Maintain files locally (on user’s computer) as encrypted files
Delete all non-encrypted files (temporary files, trash, s)
Issues
Large datasets or multiple users - contact IT
Protection during data processing runs requiring computer clusters - contact IT
Configuration management (i.e., CVS) needed for software - contact IT
Rev. -, 11/17/10, TAD
Take special care when using wireless to transfer files

20. Export Control - Level 3 Training
MANAGING ELECTRONIC INFO - PERSONNEL GUIDELINES
Recipient is responsible for destroying (delete & empty trash or temporary files) or encrypting the document
Use proper encryption tool
Password of sufficient complexity; do not use existing passwords
After use, either properly delete or re-encrypt them
Remove temporary files created by the application
Unencrypted Files Containing ITAR Information
DO NOT leave unencrypted files unattended on your computer
DO NOT leave unencrypted files in public areas or areas where other users may have access (i.e., shared machines, ftp server, My Documents directory if synced to the Windows server)
DO NOT leave unencrypted files where they may be backed up
DO NOT unencrypted files
Rev. -, 11/17/10, TAD

21. Export Control - Level 3 Training
NON-DISCLOSURE AGREEMENTS (NDAs)
NDAs may be used in an ITAR-related project
However, because you have a NDA does not mean you have an ITAR
Public domain status cannot be claimed for information subject to a NDA
Talk to your PI or PM whether the subject information is really needed
Individuals do not sign NDAs, the UW does
Forward requests for NDAs to department administration
Department administration forwards the NDA to UW Legal for review & signature
Rev. -, 11/17/10, TAD

22. Export Control - Level 3 Training
HELPFUL HINTS
Ensure ITAR-sensitive paper & electronic information are secure
ITAR-sensitive information should be labeled
However, verify if you are unsure
All ITAR-sensitive information that we have contact with should have its origin outside of the UW
We should not be the original source for any ITAR-related data
Notify management of issues
Publication restrictions
NDA’s
ITAR sessions at meetings
Limit contact with ITAR-sensitive information
DO NOT supply ITAR-sensitive information to a person unless you know they are a US Person or exempt person
Rev. -, 11/17/10, TAD