When is a defense service, product, or data subject to ITAR?

What constitutes a defense service, product, data, et. al. subject to the International Traffic In Arms Regulation (ITAR)?

Question:
Missile Defense Agency faithfully stamps all ITAR controlled data; and, if said data is not stamped, it’s not subject to or controlled by the ITAR. Is this correct ?

Answer:
No, it is the character and content of the information, not a stamp, which determines export requirements and its requirements. MDA may stamp certain information as controlled but we can not rely on this for export control. The bottom line is that the determining factor, as to whether an item is controlled, is if it is designed and/or built for a military purpose. If the answer is yes, then it is controlled unless its data that has passed into the public domain or has been determined to be dual-use technology. Lack of any specific marking as export controlled by MDA or any other agency does not negate the ITAR requirements.

Anything that is within the parameters of a defense service or technical data is ITAR controlled. Anything that is within the parameters of the public domain is not. Said another way, if our work is a defense service or generates technical data it is export-controlled. If our work falls within the public domain, prior approval to export is not required.

Your bottom line – Anything that could be reasonably construed as a defense product or service must be reviewed closely for export control.

Exporting Defense Services

Although most export applications submitted to the State Department are for hardware, the most important and complex cases are for defense services.

“Defense service” and “technical assistance agreement” are terms the ITAR extends beyond the normal meaning of the words “service” and “assistance.” For example, if a U.S. defense company provides controlled technical data to its foreign supplier so the latter can manufacture a component to certain specifications, the U.S. company is performing a “defense service” for which it will require a “technical assistance agreement” – despite the fact that it would seem that it is the foreign company that is providing a “service” or “assistance” to the U.S. company.

The export of defense services is authorized under a Technical Assistance Agreement or Manufacturing License Agreement. The value of defense services provided in accordance with such agreements is roughly equal to or greater than the value of hardware exports. Almost all agreements are referred to DTSA for national security and technical review. The vast majority are only approved subject to specific conditions on technology release (“provisos”).

Even if there is a government-to-government agreement applicable to the defense service (e.g., a Memorandum of Understanding between the US and a foreign government ), approval is still required to cover the activities of SPARTA. Furthermore, it is necessary for all parties to sign the agreement, even if the same parties have signed an MOU. This is to ensure that each party (U.S. or foreign) involved in activities covered by the agreement understands and accepts its responsibilities, including the requirement for prior written consent from the Department of State for any retransfer or change in end use.

Export Compliance Legends and Markings

Notice anything missing?

Legends and Markings

If you have been in the business of exporting for any length of time, no doubt you have noticed that folks don’t pay much attention to marking their documents. Now I have seen a marked increase in the Company Proprietary legend, but the words Export Controlled seem to evade the Header and Footer comment box. While noting that the information contained in the export legally belongs to the company you work for, not correctly marking it with the proper export legend can invite unwanted trouble to your front door.

One instance I was involved in over my tenure as an Empowered Official caused me weeks of anguish. Despite my efforts, the company I was working for at the time was not all that good at paying attention to proper legend etiquette. Well, a drawing of a product listed on the United States Munitions List was sent to a vendor incorporated in the U.S. Unfortunately, no one asked if that vendor had a manufacturing facility abroad. You guessed it, they did! So the innocent forwarding of an ITAR-controlled drawing sent between two U.S.-incorporated companies ended up on a fax machine overseas.

During a casual conversation with the U.S. facility, they happened to mention the faxing incident and my red flag indicator went straight up. I asked the obvious question, “Do you have an export authorization to send our drawing to your foreign manufacturer?” You guess it again, the answer was, “Huh?” Yes, I spent the next several weeks on the phone with their corporate lawyers and my corporate lawyers gently coaxing them into a “voluntary” disclosure.

You may have asked yourself how does this relate to putting the proper restrictive legend on a document. Well, the other company tried to draw mine into the disclosure based on the fact that the drawing was not properly marked as ITAR-controlled. We responded by confirming this fact and that we would be stepping up our compliance in this area, but as a registered defense contractor in the United States, they had to abide by all the same laws and regulations under the Arms Export Control Act as we did. While marking a fax, email or document may not be the law, it is smart business practice.

No, we did not commit an export violation, but how much angst, time and money do you think would have been saved by simply adding the words ITAR-CONTROLLED?

I have also had the experience of seeing documentation marked incorrectly with an ITAR restriction and the information therein was controlled by the EAR. The comment heard around the world is, better safe than sorry. Not necessarily so, I say! If you claim that the data is controlled by the Department of State and then turn around and export the article it relates to under the jurisdiction of the EAR with a corresponding Export Commodity Classification Number (ECCN), this is obviously contradictory.

Should you have a case (purely hypothetical) whereby you are involved in a Voluntary Disclosure with the State Department and among your mitigating factors includes the fact that you classified the data as commercial and your drawing contains a restriction on the part of the ITAR (again, to be safe), this tends to make you look a little less bright than you should be.

If what you are exporting is under the jurisdiction of the ITAR or the EAR, the moral of the story is proper due diligence and proper legends.

Sue K. MacDonald-Nans
SRCTec, Inc.

Developments Regarding The Deemed Export Rule

Developments Regarding The “Deemed Export” Rule

Within the panoply of governmental strictures encompassing the American export control world, two foundational legislative planks are the Export Administration Regulations (EAR) and the International Traffic in Arms Regulations (ITAR). The ITAR imposes specific requirements and restrictions on how corporations may conduct business in the international marketplace even before a license has been approved. The Department of State’s involvement in regulating export control activity is fundamentally a function of furthering foreign policy and national security interests. As such, all permanent or temporary exports of defense articles; related technical data; and the performance of defense services by a U.S. person to a foreign person, individual, company or government, require the correct usage of licenses or license exceptions. The EAR regulates the export of “dual use” items or inherently non-defense products and data, and is administered and controlled by the Department of Commerce. Exports usually encompass the physical transfers of goods to locations outside of the U.S. However, in addition to goods, the export of technology or software source code (exception being encryption source code) is “Deemed” to take place when it is released to a foreign national within the United States. (See §734.2(b)(2)(ii) of the EAR). Deemed exports refer to the transfer of sensitive dual-used technologies to foreign nationals working or studying in the United States.

Any foreign national is subject to the “deemed export” rule except a foreign national who (1) is granted permanent residence, as demonstrated by the issuance of a permanent resident visa (i.e., “Green Card”); or (2) is granted U.S. citizenship; or (3) is granted status as a “protected person” under 8 U.S.C. 1324b(a)(3). This includes all persons in the U.S. as tourists, students, businesspeople, scholars, researchers, technical experts, sailors, airline personnel, salespeople, military personnel, and diplomats. As noted, one exception to this general statement is a “protected person.” “Protected persons” include political refugees and political asylum holders. Be aware that individuals seeking “protected person” status must satisfy all of the terms and conditions that are fully set forth in 8 U.S.C. 1324b(a)(3). It should be emphasized that although the deemed export rule may be triggered; this does not necessarily mean that a license is required. For example, the technology may be EAR99 or license exception eligible. Technology may be “released” for export when it is available to foreign nationals for visual inspection (for example, reading technical specifications, plans, blueprints, etc.); when technology is exchanged orally; or when technology is made available by practice or application under the guidance of persons with knowledge of the technology. Per Part 772 of the Export Administration Regulations (EAR), “technology” is specific information necessary for the “development,” “production,” or “use” of a product.

Several developments in the field of deemed exports have occurred recently. The Commerce Department has now formed an Advisory Committee to help it revise rules on deemed exports of sensitive dual-use technologies. The government would like to revise the current rules because foreign researchers are playing a growing role in technology research and development. Norman Augustine, former CEO of Lockheed Martin Corp. and chairman of an advisory committee on deemed exports, delivered the panel’s report three months ago. It has been under review since then by the Bureau of Industry and Secretary (BIS). “U.S. deemed export policy must account for the variety of risks we face,” Mario Mancuso, Undersecretary of Commerce for industry and security, said in a statement on Feb. 6, 2008. “While our rules should not permit the transfer of sensitive U.S. technology to a real or potential adversary, they must ensure the United States remains the most innovative and competitive economy in the world.” But critics of the report said it doesn’t reflect the many adverse comments the advisory committee received about proposed changes to U.S. deemed export rules. Last June, the agency dropped plans to tighten restrictions on foreign researchers working in the U.S. The restrictions were being pushed by the Defense Department. At the time, universities and research groups vigorously opposed the plan. Mancuso said the Commerce Department is now working with Pentagon officials along with bureaucrats at the departments of State and Energy on how to reform U.S. deemed export rules.

So what are the business implications for your company? Corporate employees have frequent contact with foreign nationals, such as at social or professional interactions; when attending conferences; and through the exchange of written material by email, facsimile transmissions, and reports. Through these contacts, employees are precluded from communicating or transmitting technical data. Your corporation must educate its employees about the risks of unauthorized release of information. Potential risks include: financial penalties; possible prison sentences; and loss of export privileges by the Departments of Commerce and State. The more attention your company pays to the deemed export rule, the stronger your internal export control regime will become and the risk of violation will be significantly reduced.

Contributed by:
Jarred A. Fishman, Export Coordinator ES
Lockheed Martin Corporation
April 2008

Avoiding Deemed Export

That’s not an Export…That’s my laptop!!! Avoiding the curse of the “Deemed Export”.

One of the issues that seems to create great confusion and problems among those exporters of ITAR related products & information is the principle of “Deemed Exports”. With little effort, an unsuspecting USA manufacturer and/or exporter can find him/herself in trouble with the US State Department due to an export of ITAR related information of which they were not aware and did not intend.

As in all ITAR situations, one must always know with whom you are sharing ITAR related information and only share ITAR related information with individuals or corporate entities that can prove they are authorized to receive ITAR related information by verifying their ITAR registration with the US State Department.

First, as we all know, a basic export is the transfer or shipment of a good, technology or information from the customs territory of one country into the customs territory of another country. This definition recognizes the essential act of physically and with purpose sending goods, technology or information across national boundaries.

What then is meant by the term “deemed export”? A “deemed export” involves either the intentional or unintentional transfer of information across national boundaries, except the act of crossing those national boundaries can occur within the territory of the US or in cyber space. In other words, Non US citizens (Foreign Nationals) gaining access to ITAR related information within the US constitutes a “deemed export” of that information even though they are physically domiciled within the US. Under current ITAR regulations, when the Non US citizen (Foreign National) gained access to your ITAR information, you unintentionally exported that information just as if you sent that person your ITAR information in their native country. Thus the US State Department has “deemed” you exported that information. The “deemed export” definition also applies to your very own Non US Citizen (Foreign National) employees.

Another area of great concern for “deemed exports” is in the use of the worldwide web/email/ cyber space. The act of sending and receiving emails, files, PDF’s, etc. from your laptop or any other computer while outside of the territory of the US or sharing said information with a non US citizen (Foreign National) in or outside the US is also “deemed” an export of that information for State Department regulatory purposes. Additionally, the simple act of carrying your laptop outside of the territory of the US with any ITAR related files on the hard drive and/or on any exterior data storage devices is also considered a “deemed export” of that information. Finally the act, by you, to access any ITAR related files from your US domiciled company data base/files or receive any ITAR related electronic information while outside of the territory of the US is also considered a “deemed export” of that information.

To avoid any “deemed export” issues,related to your non US citizen (Foreign National) employees, it is suggested that you or your HR/Employment group/department research the background of all of your non US citizen (Foreign National) employees and determine if they will be in a position to obtain ITAR restricted information in the course of their daily employment. If no, document your workflows and ITAR processes to verify your conclusion and proceed as normal. If yes, then you may be put into a position to either decline ITAR related projects or apply to the US State Department for an individual ITAR export license for each of your non US citizen (Foreign National) employees.

When conducting business within the worldwide web/cyberspace, plan ahead, Do not send ITAR related information/files/PDF’s, etc. through the worldwide web without knowing, for certain, the recipient has the proper authorization to receive ITAR information. Always know what ITAR information is on your laptop hard drive and/or exterior data storage devices before departing the US and If possible, remove all ITAR information. While out of the country, do not access emails or files pertaining to ITAR projects. One possible solution is have all ITAR related files sent directly to a restricted company controlled ITAR web address, not directly to your company email address. Files noted as ITAR and sent directly to your email should be re-sent to another company restricted ITAR file and deleted without opening, Files not noted as ITAR and opened inadvertently but containing ITAR related information should also be sent directly to another company restricted ITAR file and immediately deleted. NEVER make hard copies or send/forward ITAR related information to any other non authorized ITAR recipients.

If the reason for your trip is to conduct ITAR related business with a Foreign National/Corporate Entity, then verify your hosts are authorized to receive ITAR related information and contact the US State Department to gain permission- license/Manufacturers Agreement to transport said ITAR information.

Planning ahead and understanding the principle of “deemed export” will assist you and your company in maintaining full ITAR compliance and avoiding any unnecessary ITAR audit issues.

Submitted by: Bernard Van Ham

Voluntary Disclosure

Last month we discussed the Chiquita Banana case, the result of a voluntary disclosure and the consequences that resulted, including potential criminal charges by Columbian authorities for both the directors and officers involved—all due to a voluntary disclosure!

The debate on the pro’s and con’s of voluntary disclosures has been argued for years. During my tenure in Corporate America, for every outside firm I consulted on whether or not to make a voluntary disclosure, the split was nearly unanimous—for every firm that said yes, there was a firm that would argue the opposite. In fact, I could have spent my entire career doing just voluntary disclosures! The issue for practitioners, was always whether the situation warranted a disclosure or not. If we look at the “letter of the law”, we could make the following analogy—how many times have you seen someone on the road speeding next to you during rush hour? Daily! The speed limit is statutory—so we obviously have a clear violation of the law. But, say that “speeder” is you, are you going to disclose this voluntarily, by driving to the nearest police station and declaring, “Sir/Madam, on marker 251, I was speeding 15 mph over the limit, and I am here to pay the violation”? I don’t think so! (My apologies to anyone out there who may in fact do this).

Thus, the issue, is always both a joint business and legal decision, that must be weighed, using numerous factors, such as the seriousness of the violation, the time of the violation, the degree of risk involved in disclosing or not disclosing, and the law(s) that may have been violated. (See 15 CFR, Suppl. No.1, Part 766 for general factors BIS takes into consideration). The BIS, U.S. Customs and the EAR clearly state that a voluntary self-disclosure is a mitigating factor in determining what administrative sanctions, if any, will be sought. Yet, both BIS and U.S. Customs (CBP, herein), have clearly made the point that when a company self-discloses, it is within the government’s discretion as to the weight they will give such disclosures! Thus, it is often difficult to discern on whether or not the government will use an “objective” or “subjective” perspective in the amount of mitigating factors they will place on your disclosure. Are you willing to take that risk? Again, it’s both a business and legal decision which could often lead practitioners to sleepless nights. Keep in mind, it will NOT prevent transactions from being referred to the Department of Justice—in which case, you will now have both a civil and criminal investigation!

Obviously, there are some very clear black & white cases, which must be disclosed—these are the easy ones, at least when it comes to making the decision to disclose. An example would be exporting a controlled item, say for Anti-Terrorism purposes, to a country that clearly requires an export license. The failure to disclose, and if discovered, are just too great to ignore. But, exporting an item, and showing “No License Required” (NLR) on the Shipper’s Export Declaration (SED), when in fact a license exception, say “CIV” (for civilian end-use), was available is a different story—do you want the attention of BIS for something that is not so serious? Again, think of the speeding over the limit. Or, say, you discover that instead of declaring $500 for the value on an import shipment, the value shown was $499? The Customs regulations are quite clear on valuation, but what is the chance that CBP will discover this “under-valuation”? Probably slim-to-none! The same scenario can be played out with import quantities declared on an import entry—again, the practitioner needs to weigh the risks involved on whether or not to disclose to authorities.

Commentators have stated, that it is nearly impossible to reduce to zero the frequency of violations, both under the EAR and Customs regulations, especially for those companies that engage in very large numbers of import and export transactions subject to complex regulatory requirements. Rather, by having comprehensive import/export compliance programs and measures in place, and using good faith efforts to comply with the law, when a self-disclosure is required, “great weight” should be given to the violator. The issue remains, should a company the size of General Electric be given more leniency when it comes to a violation and administrative sanctions, over that of a “ma and pa” operation, whereby GE may have thousands of import/export transactions, resulting in 1 or 2 violation, but the “ma/pa” operator has only a handful? CBP and BIS have made it clear that it would be inappropriate to adopt such favorism, but rather, at the government’s discretion, CBP or BIS may use the self-disclosure and other factors as mitigating potential penalties and possibly place “great weight” (again, at their discretion) on both the disclosure and a company’s compliance programs.

In conclusion, every trade compliance officer and legal practitioner within a company faced with such situations must perform a “risk assessment” on the degree of the violation, the decision whether or not to disclose, and the corrective actions that should be put in place to avoid repeat violations—whether or not you file a voluntary self-disclosure. I must state that I am not condoning not disclosing violations, but rather, those faced with such a situation, weigh the pro’s and con’s of self-disclosures.

Contributed by http://www.globaltradelaw.net

Bananas and Terrorists Groups

The next time your cutting those banana’s for your morning cereal or having a banana-split at an Oberweis ice-cream shop keep in mind that you may just be indirectly supporting a foreign terrorist organization.

In the world of export compliance, corporate practitioners are constantly faced with issues from deemed exports to foreign nationals, to export licenses for high technology items. But, bananas? You don’t need to be an expert to realize that under 15 CFR, you’re not going to find an ECCN classifying bananas (other than EAR99). So, who would ever think that growing and selling bananas could lead to a multi-million dollar penalty for violating the Export Administration Regulations and OFAC (Treasury Regulations)?

Well, that’s exactly what happened this past couple weeks, when the Department of Justice issued a $25 MUSD—yes, that’s a 25 million dollar penalty! – against Chiquita Brands International, for violating the above regulations. The case began back in 1997, when Chiquita began paying the United Self Defense Forces of Columbia (“AUC”) and Revolutionary Armed Forces of Columbia (“FARC”) payments for “protection” against attacks on its employees and fields where the bananas were grown. Although Chiquita may have had good reason to do so (motivated by their good faith for the safety of their employees), the payments continued for approximately another 7 years, totaling some $1.7MUSD in payments.

Both organizations that received these payments were listed on both U.S. and E.U. regulations as being terrorist organizations. The EAR and OFAC impose restrictions on exports (including financial assistance) to entities and individuals listed a s “Specially Designated Global Terrorists” (SDGTs), “Specially Designated Terrorists” (SDTs), or Foreign Terrorist Organizations (FTOs), under 15 CFT Part 744. Without a license, there are no exception that overcome these prohibitions. In addition to 15 CFR restrictions, there are additional regulations under both 31 CFR Parts 594 thru 597 that govern terrorist sanctions. Restrictions under 31 CFR 595 specifically prohibits “funding to or for the benefit of an SDT”.

To make this area of compliance even more confusing is the fact that an SDT or similar terrorist organization may request the assistance of a U.S. law firm for legal counsel, which court decisions have agreed, that OFAC may not require licenses for provision of legal services, but, may require a license for the law firm, before the law firm may accept payment for its services (31 CFR 595, 746 F.2d 865 (D.C.Cir.1984)).

In the case of Chiquita, one must be sympathetic with the reasons for making such payments—protection of its employees in an area within Colombia that has a strong presence of such terrorist organizations. Again, the decision ultimately is a business decision, on whether or not to continue operating a business or unit that may require violating the law (in this case, Chiquita has since sold that business unit). But, the case does raise another issue, which has been hotly debated for years—Chiquita voluntarily approached the Justice Department in 2003, which eventually led to a nearly 4 year civil and criminal investigation not only against the company, but also against some of its officers and directors within the scope of the investigation.

4 years is a long time for any compliance attorney or officer to undergo such an investigation, not to mention the internal costs to a company, attorney fees (which one can assume were in the millions), and eventually, a $25MUSD penalty—all of this after a voluntary disclosure and plea agreement. Oh yes, let’s not forget front page news coverage of “guilty for sponsoring terrorists”—I think Chiquita’s public relations department have their hands full today! So, where does that leave us as to the pro’s and con’s of voluntary disclosures? Well, you will have to just wait till next month’s newsletter, where this topic will be discussed. But, as of today (3/22/2007), the Chicago Tribune, printed an article on how, now, the Colombian Attorney General, Mr. Mario Iguaran, is not only asking for the information provided to the DOJ, but, Colombia is possibly looking at prosecuting, on a criminal level, the officials/directors in Chiquita, on this subject. Needless to say, extradition treaties exist between the USA and Colombia. In the interim, I’ll take hot fudge with my banana split!

By: Christos Linardakis, attorney
http://www.globaltradelaw.net

What is a Commodity Jurisdiction?

A commodity jurisdiction (CJ) needs to happen when a company exporting goods is either unsure whether their export is regulated by a government agency (the PMDTC in this case), or is unsure how to classify their good prior to export.

What I know about commodity jurisdictions

  • If you have to ask, your export will probably be considered a military export.
  • PMDTC officers tend to err on the side of caution and apply rule 1 liberally.
  • The process is not a quick one.
  • It is extremely difficult to make changes to a commodity jurisdiction ruling.

In my opinion

You should make every effort to determine your item’s classification on your own. This does not mean you should make stuff up and hopefully slip by, but you know your product better than anyone – including the licensing officer reviewing the CJ. If you take this route, be sure your decisions are responsible and that you carefully document the decisions you made and how you justified them.

If you do have to apply for a commodity jurisdiction, include all of the information requested by the PMDTC as well as a clear, concise overview of the product. If you send in 4000 pages of technical information without a summary, your commodity jurisdiction (which will forever affect the course of your export procedure) might not make any sense

From the PMDTC Web Site

The purpose of a commodity jurisdiction (CJ) request is to determine whether an item or service is covered by the U.S. Munitions List (USML) and therefore subject to export controls administered by the U.S. Department of State pursuant to the Arms Export Control Act and the International Traffic in Arms Regulations (ITAR). If after reviewing the USML and other relevant parts of the ITAR, in particular ITAR §120.3 and §120.4, you are unsure of the export jurisdiction of an item or service, you should request a CJ determination.

Here’s a link to the Commodity Jurisdiction Guidelines from the PMDTC (as of the publication date of this article).

PMDTC Definitions for Beginners

My personal paradox when it comes to import export regulations, is that by the time I’ve familiarized myself enough to talk about things intelligently I’m so engrossed in the field that I assume everyone has the same knowledge base that I do.

This comes into play on web sites like this where we start throwing around terms like DSP-5, end-user, ELLIE, and other industry specific terms without covering the basics. That said, here’s a step in that direction for exporters of true military goods. These definitions are targeted towards people who are exporting (or importing) military grade hardware and technical info for true military applications

Office of the PMDTC – stands for Office of Political Military Defense Trade Controls and is a branch of the Department of State. These are the guys you want to check with before driving a truckload of M-16s across the border.

DDTC – Directorate of Defense Trade Controls, this acronym is generally interchangeable with PMDTC.

Who needs to apply to the PMDTC?

Generally, any person or company who intends to export or to temporarily import a defense article must obtain the approval of DDTC prior to the export or temporary import. The appropriate license form must be submitted for the purpose of seeking approval.

Registration Requirement – In most cases, in order for a license to be considered, you first must be registered with DDTC.

You can register with the DDTC at http://pmddtc.state.gov/registration.htm

There are three ways that you can submit a license:

Through D-Trade (fully electronic system)
Through ELLIE (ONLY to amend licenses, through use of the DSP-119)
By sending in licenses in hard copy (a very limited option).

Most of this information was shamelessly lifted from the PMDTC web site at: http://pmddtc.state.gov/licenses.htm.

If you’re looking for more of this kind of stuff, that’s a good place to start.

ITAR Acknowledgement

So, you export military goods to another country huh? I’m sure you do everything by the rules yourself, but how many people do you have in your organzation? Does your secretary know what ITAR regulations are? What about your warehouse people?

A common failure in many controlled export businesses is to forget to inform all of their employees about the regulations they’re subject to. And trust me, if you don’t make a point to tell them they won’t ask until it’s too late!

Consider having each managing member of your company sign an ITAR Acknowledgement form as part of your human resources routine. This will make sure everyone can be held accountable in case of the unforseen.

Feel free to cut and paste from the below for your ITAR Human Resources form:

Name:
Date:
Program:
Program Description:

I hereby acknowledge that I understand the International Traffic in Arms regulations as they relate to the export of technical data for this program.

I have read the Department of State license provisions relevant to this program and agree to abide by them.

I recognize that as a managing member for this project, it is my responsibility to inform those employees under my supervision of their role in the export of data and products for this program and the regulations that they must adhere to.

In the event that there is a question regarding export policy I will refer it to the regulatory compliance office (phone number) or a member of senior management.

Signed

__________