export control for universities research institutions

1. EXPORT CONTROL FOR UNIVERSITIES & RESEARCH INSTITUTIONS

2. Why Has Export Control Compliance Become So Critical? The State, Defense and Commerce Departments are paying close attention to export compliance within the university research environment: Result of heightened national security concerns around access to sensitive technology, at a time when international exposure and collaboration is increasing. Of concern are transfers of or access to controlled equipment and technologies here and abroad, particularly where the institution�s activities fall outside the coverage of the Fundamental Research Exclusion (FRE) or related exclusions (see below). Universities and research institutions are obligated to comply with all relevant export control regulations: Export Administration Regulations (EAR) International Traffic in Arms Regulations (ITAR) Office of Foreign Assets Control (OFAC) regulations. Recent government enforcement activity has resulted in a number of audit findings with civil liability consequences, including monetary penalties, as well as criminal prosecution: individual and institutional liability.

3. What Triggers the Need for a Compliance Program? Sponsored Research Where publication or other restrictions have been accepted, or NDA terms expanded so as to constitute restrictions, export controls may apply. Even though some research activity may qualify for the FRE, jointly shared laboratory equipment or technology that falls outside of FRE parameters may be governed by dual use export control regulations. While the FRE applies to research activity (including access to hardware) being used in the U.S., it may not apply to activity conducted abroad, and does not apply to equipment being exported abroad. The institution is required to understand whether its equipment and/or technology are subject to dual use destination controls or ITAR controls. Note: ITAR- governed projects and technology will likely require a Technology Control Plan (TCP), even though the activity is being conducted on campus in the U.S. OFAC regulations apply regardless of the type of technology involved, and address the nature of services and transactions with economic embargoed/sanctioned countries and their foreign nationals.

4. Faculty-Sponsored Research Where a faculty member is using internal funding to pursue research, and Office of Sponsored Research does not have the same degree of visibility into the research parameters or consulting relationships deriving from the faculty member�s work as it would otherwise have. The FRE and related exclusions may or may not apply and, as in the case of sponsored research, specific controls may be applicable. International Campuses and Collaborations Depending on the scope and sensitivity of the activity (curriculum vs. research) the FRE may or may not apply. Export controls driven from the U.S. campus (including a TCP) may require extension overseas, as certain foreign national access to technology and exposure to embargoed services/transactions becomes a more likely possibility. Distance Learning When offering on-line curriculum and academic relationships remotely, properly monitoring and flagging registrations from embargoed countries is necessary Institution and individual must avoid participating in other activities (fiscal and non-fiscal) interpreted by OFAC as providing a prohibited service or value.

5. Export Management System A documented set of policies, procedures, desk-top instructions and checklists (distributed and/or posted to website) that address all necessary elements of compliance including, but not limited to the following: Policy statement reflecting commitment to export control Overview of Regulations: EAR, ITAR, OFAC Responsible Parties/Empowered Officials - ITAR Proper Use of Fundamental Research Exclusion � EAR Public Availability Exclusion � EAR Public Domain Exclusion � ITAR Educational Information Exclusion EAR/ITAR Employment Exclusion - ITAR Nondisclosure Agreements EAR/ITAR Prohibited party/entity screening EAR/ITAR Jurisdiction determination � ITAR Defense Services � ITAR Classification for dual use destination controls - EAR Core Elements of a Compliance Program

6. Deemed Exports to controlled foreign nationals � EAR/ITAR Licensing/export authorizations and exemptions � EAR/ITAR Technical Data Transfer � EAR/ITAR Procurement � EAR/ITAR Collaborations: research institutions/corporations � EAR/ITAR International Domestic Technology Control Plan (IT access, physical security, visitor, travel, courier, hand-carried) � EAR/ITAR Re-exports and retransfers- EAR/ITAR Shipping hardware/AES compliance � EAR/ITAR Encryption management � EAR/ITAR Timely problem notification � EAR/ITAR Internal audit � EAR/ITAR Training � EAR/ITAR OFAC prohibitions. Core Elements of a Compliance Program continued�

7. Export Management Infrastructure  Office or Director of Sponsored Research or Programs may not have sufficient visibility. Requires a broader cooperative effort among numerous offices and departments throughout the university: Counsel, IT, Admissions, IP or Material Transfer, Academic Deans, PI�s, Research Directors, Distance Learning, Procurement, International Programs Network of �Export Control Coordinators (ECC)� or �facilitators� is critical: Embedded in the academic and research environment, and trained to identify export control issues and either field them (preliminarily or for resolution) or make sure the issues are routed to the lead export control professional. Compliance payoff: research administrators, PI�s, departmental directors � anyone confronting a potential export control issue - will likely perceive the export compliance program as a passport or enabler toward timely moving the process forward, rather than an impeding factor or unnecessary hindrance to be ignored.

8. Key Questions to Help Identify Issues  Have export control priorities been identified and, if so, addressed? Is institutional leadership sufficiently aware of the compliance obligation and enforcement penalties; if so, are there sufficient tools and resources to meet the compliance obligation? Does Sponsored Research have sufficient visibility into research and academic activities such that export controls issues are proactively managed? Where control procedures exist, are they comprehensive enough to address the proper use and maintenance of the FRE, related exclusions and/or specific export controls? Where there is an overseas campus or collaboration, does the control program protect the university�s activities abroad?

9. Choosing the Right Compliance-Building Tool  The key is to develop a program that is: priority-driven proportionate to the needs of faculty and administrators accomplishable within a reasonable period of time transparent to its users cost effective

10. Export Risk AssessmentIdentifying compliance priorities: areas likely to present the most serious and immediate exposure.  A high-level export risk assessment and resulting report enables the export control administrator to: Methodically evaluate key points of exposure throughout the university Understand who potential process owners might be for remedial purposes Understand how data necessary for compliance is best collected through IT and manual solutions Develop the level of procedural safeguards appropriate to the circumstances

14. Leadership Briefings and Departmental Trainings  Securing the commitment of institutional leadership is critical by providing a cogent, high level briefing on potential exposure and enforcement penalties. Focus on what export control issues and procedures are particularly relevant; how to manage compliance proactively; and internal resources. Train. Train. Train!

16. 16 Export Controls � Enforcement Against Universities and UC Compliance Responses UC Compliance and Audit Symposium February 3, 2009

17. Prior Export Criminal Enforcement Against University Professor Thomas Butler chief of Infectious Disease Division at Texas Tech�s Department of Internal Medicine Select Agent violations, accounting fraud One count for transfer of plague sample to Tanzania

18. J. Reece Roth Professor Emeritus of U. of Tennessee, Knoxville 18-count indictment for technology transfer to foreign nationals

19. UT Not Indicted UT was �victimized by the conspirators� and cooperated throughout with the FBI UT�s Code of Conduct specifically prohibited employee activities that violated federal securities laws UT policies required employees to report violations of state or federal laws. UT policies required employees to Understand any export control requirements that related to employee�s work Ensure that no exports were made contrary to requirements

20. Conspiracy Charge AGT subcontracted to Roth Roth employed foreign grad students, including China and Iran Roth and AGT falsely stated to AFRL that no foreign nationals would be used Roth directed foreign nationals to work on the project AGT assigned PRC national to work on project in task order to Roth Roth sent letter to PRC national asking him to work on project

21. Export Violations AGT exported restricted technical data to foreign national Final report Progress reports Roth exported restricted technical data in travel to PRC and delivery of 30-pp DARPA proposal containing plasma actuator technology for specific USAF aviation munitions project Roth directed PRC student to transmit data to PRC contact Roth allowed access to restricted equipment and data to Iranian student

22. Trial Roth: Didn�t believe he had broken the law Research hadn�t produced anything tangible Received only $6,000 from contract US: Roth knew information was restricted Initially kept restricted information with U.S. student but eventually shared with foreign nationals

23. Conviction Guilty on all 18 counts Jurors deliberated 6 hours Roth faces 160 years and $1.5M in fines Verdict �should serve as a warning to anyone who knowingly discloses restricted U.S. military data to foreign nationals.� � Patrick Rowan, Acting Asst. AG for National Security

24. UC Export Control Compliance Plan Use of Fundamental Research Exclusion Basic Do�s and Don�ts

25. National Security Decision Directive 189 To the maximum extent possible, the products of fundamental research should remain unrestricted. Where the national security requires control, the mechanism for control of information generated during Federally-funded fundamental research in science, technology, and engineering at colleges, universities, and laboratories is classification. No restriction may be placed upon the conduct or reporting of Federally-funded fundamental research that has not received national security classification, except as provided in applicable U.S. statutes. President Bush�s National Security Advisor, Condoleezza Rice, reaffirmed NSDD-189 in November 2001.

26. UC Policy on Publication �It is a long-standing University policy that freedom to publish or disseminate results is a major criterion of the appropriateness of a sponsored project, and particularly of a research project.� - UC Contract and Grant Manual section 1-410

27. UC Policy on Citizenship Restrictions �. . . it is contrary to University policy to accept provisions in sponsored projects or gifts which require discrimination in employment, including discrimination based on citizenship.� -- Council of Chancellors, June 17, 1988

28. What is �Fundamental Research�? The export regulations, both EAR & ITAR, define fundamental research as: Basic and applied research in science and engineering conducted at US universities, the results of which ordinarily are published and shared broadly within the scientific community. See Supplement No. 1 to Part 734 for extensive explanatory questions and answer regarding what is not subject to the EAR in the context of university and research laboratory activities.

29. What is Not Fundamental Research? Given this definition of fundamental research, university research will not qualify as fundamental research if The university or research institution accepts any restrictions on the publication of the information resulting from the research, other than limited prepublication reviews by research sponsors to prevent inadvertent divulging of proprietary information provided to the research by the sponsor or to ensure that publication will not compromise patent rights of the sponsor; or The research is Federally-funded and specific access and dissemination controls regarding the resulting information have been accepted by the university or researcher.

30. Do�s and Don�ts � Shipping Do NOT ship any item outside the U.S. without first checking the ITAR and EAR lists to determine if the item is controlled. Secure license approval or verify license exception PRIOR to shipment for all controlled items.

31. Do�s and Don�ts � Restricted Information Do NOT enter into secrecy agreements or otherwise agree to withhold results in project conducted at the University or that involve University facilities, students or staff. Do NOT accept proprietary information from another that is marked �Export Controlled�.� Review any Confidentiality/ Non-Disclosure Agreements to insure that UC and you are not assuming the burden of restricting dissemination based on citizenship status or securing licenses.

32. Do�s and Don�ts � CitizenshipRestrictions Do NOT provide citizenship, nationality, or visa status information for project staff to others or include such information in proposals.� Do NOT agree to background checks or other arrangements where the external sponsor screens, clears, or otherwise approves project staff.� Do NOT attend meetings where foreign nationals are prohibited from attending.� Do not sign the DD2345, Militarily Critical Technical Data Agreement, as a condition of attending a conference or receiving materials from the government.

33. Do�s and Don�ts - Travel Do NOT travel to Cuba, Iran, North Korea, Sudan, or Syria for research or educational activities without first contacting the campus Office of Research to secure a license from the Office of Foreign Assets Control. Do review equipment that you will be taking with you against export controls. A license may be required.