Roberta Truscello , truscello@ hws Director of Sponsored Programs

1. Lend Me Your EARS (AND ITAR, AND OFAC): OVERVIEW AND EXCHANGE OF BASIC EXPORT CONTROL STRATEGIES FOR PUIs Roberta Truscello, truscello@hws.edu Director of Sponsored Programs Hobart and William Smith Colleges Carolyn Elliott-Farino, cellio12@kennesaw.edu Director of Contracting and Grants Administration Kennesaw State University

2. What We Will Cover Today Today’s presentation will focus on the actual risk we face (it is low for most of us) and the areas that are most likely to trip us up, and strategies we can use to ensure we capture any potentially problematic situations. We will: • briefly review the EAR, ITAR and OFAC regs • highlight some key concepts and definitions • provide links to some resources where you will find detailed explanations • discuss situations where you might face an export control issue • share some examples of export controls in action at PUIs

3. The Problem • You work at an institution that doesn’t have an export controls officer, and it may not have a compliance officer, either. How do you make sure your institution is following federal regulations vis-à-vis export controls for sponsored projects?

4. You know something about the export regulations, and know that you need to be aware of them, but you aren’t really sure if you have any export-controlled situations at your institution. • There are sessions on export controls at national and regional meetings, and the Commerce Department and State Department conduct training seminars. These sessions do a great job explaining the regulations and what to do if your project is export-controlled. They give detailed instructions on obtaining a license.

5. This information is very helpful, but for those of us with little exposure to controlled research or technology, it can be information overload and it doesn't answer a central question: Do we need to worry about this? How do we determine that this is something we need to worry about?What are the situations that are most likely to trip up my institution? • We assume we have a low risk of exposure – is this dangerous?

6. What We Will Cover Today Today’s presentation will focus on the actual risk we face (it is low for most of us) and the areas that are most likely to trip us up, and strategies we can use to ensure we capture any potentially problematic situations. We will: • briefly review the EAR, ITAR and OFAC regs • highlight some key concepts and definitions • provide links to some resources where you will find detailed explanations • discuss situations where you might face an export control issue • share some examples of export controls in action at PUIs

7. What We Will Not Cover Today We will not: • Discuss the licensing process or technology control plans. If you do have an export controlled situation and need a license, or if you need to implement a technology control plan, there are resources out there – including NCURA sessions – to help you with that. If you think a license is needed, you should contact your institution’s attorney.

8. Overview of Export Controls: What Are They? • EAR (Export Administration Regulations) – Department of Commerce, Bureau of Industry and Commerce (BIS) – commercial or military use (“dual use”), but primarily commercial • ITAR (International Traffic in Arms Regulations) – Department of State, Directorate of Defense Trade Controls (DTTC) – military use • OFAC (Office of Foreign Assets Control) Sanctions – Department of Treasury – economic and trade sanctions against targeted foreign governments, individuals, entities, practices

9. Good sources for reviewing the regulations in detail include: • http://doresearch.stanford.edu/research-scholarship/export-controls • www.bc.edu/content/dam/files/research/ppt/BCExportControls1.ppt • http://www.cogr.edu/Pubs_ExportControls.cfm • The websites of many research universities. Most of the big ones have export control officers and well developed websites with good resources for universities.

10. Definition: What Is An Export? • Physical shipment of a controlled item or goods • Transmission (electronic or digital) of a controlled item or information related to a controlled item • Release or disclosure (including verbal or visual) of controlled technology, software or technical data, either in the US or abroad • Use or application of controlled technology on behalf of, or for the benefit of, any foreign person or entity, either in the US or abroad • The controlled item itself, including information or software, is also referred to as an “export” • “Deemed exports” are treated as exports, and include release of controlled information to a foreign national in the US

11. Definition: What is a Deemed Export? Adeemed export occurs when export controlled information, technology or material is disclosed or released to a foreign person in the US. In these cases, an export is considered (“deemed”) to have been made to the recipient’s home country or last country of citizenship.

12. Key Concept: “Persons” with Regard to Exports • US Person – a US citizen, permanent resident (Green Card holder), refugee, or person under amnesty or political asylum. Also includes organizations and entities (such as universities) incorporated in the US. • Foreign person – anyone who is not a “US Person,” including students, post-docs, or research staff in the US on a visa.Also includes foreign corporations, business associations, partnerships, or any entity or group not incorporated in the US. May include international organizations, foreign governments and their agencies or subdivisions.

13. A Brief Overview of: • EAR • ITAR and later, 3. OFAC

14. 1. EAR ( Export Administration Regulations) • Who? Bureau of Industry and Security (BIS) of the Department of Commerce. • The EAR implement the Export Administration Act and apply to most commercial items, including dual-use items. • Dual-use items: items that have both commercial and military or proliferation applications. Term is used informally to describe items subject to the EAR.

15. 15 CFR 730-774 http://www.ecfr.gov/cgi-bin/text-idx?c=ecfr&rgn=div5&view=text&node=15:2.1.3.4.20&idno=15 • http://www.bis.doc.gov/index.php/regulations/export-administration-regulations-ear • http://www.bis.doc.gov/index.php/forms-documents/doc_view/412-part-734-scope-of-the-export-administration-regulations

16. BIS regulates: • Exports, including “deemed” exports • Reexports • Certain transfers of items “subject to the EAR” • Certain activities of US persons • What is an item? • Commodities • Software • Technology (knowledge how to design, produce, or use something)

17. Subject to the EAR • All items in the US, EXCEPT: • publicly available technology and software (excluding encryption); • items subject to the exclusive jurisdiction of another federal department or agency; • literary publications, such as newspapers or literary works (non-technical in nature) • US origin items wherever located • Certain foreign-made items

18. Commerce Control List (CCL), Supplement No. 1 to Part 774 of the EAR: contains the list of items subject to the licensing authority of the BIS. http://www.bis.doc.gov/index.php/regulations/commerce-control-list-ccl • EAR 99: Items subject to the EAR which are not listed on the CCL are designated as “EAR99.” • low-technology consumer goods, usually do not require a license • if you plan to export an EAR99 item to an embargoed country, to an end-user of concern, or in support of a prohibited end-use, you may be required to obtain a license

19. Who is subject to the EAR? • Certain activities of US persons related to the proliferation of nuclear explosive devices, chemical or biological weapons, or missile technology. • Activities of US or foreign persons prohibited by any order issued under the EAR.

20. 2. International Trafficking in Arms Regulations (ITAR) • Who? Directorate of Defense Trade Controls (DDTC) of the Department of State. • ITAR implement the Arms Export Control Act (AECA) and governs defense articles and defense services. • 22 CFR 120-130 http://www.ecfr.gov/cgi-bin/text-idx?c=ecfr&SID=b42b901932e65d5d410781b6bcccd6a1&rgn=div5&view=text&node=22:1.0.1.13.57&idno=22 • http://pmddtc.state.gov/regulations_laws/itar_official.html

21. Defense articles: • Any item or technical data designated on the US Munitions List (USML) http://pmddtc.state.gov/regulations_laws/documents/official_itar/ITAR_Part_121.pdf • Includes technical data recorded or stored in any physical form, models, mock-ups or other items that reveal technical data • Technical data: Blueprints, drawings, photographs, plans, instructions, documentation, or software application programs for the design, development, testing, production, repair, etc. of defense articles

22. Defense Services: • Furnishing of assistance, including training, to foreign persons in the US or abroad – encompasses the design, development, engineering, manufacture, production, assembly, testing, repair, maintenance, modification, operation, demilitarization, destruction, processing or use of defense articles • Military training of foreign units and forces

23. Fundamental Research and the Fundamental Research Exclusion

24. Fundamental Research National Security Decision Directive (NSDD) 189 defines fundamental research: "'Fundamental research' means basic and applied research in science and engineering, the results of which ordinarily are published and shared broadly within the scientific community, as distinguished from proprietary research and from industrial development, design, production, and product utilization, the results of which ordinarily are restricted for proprietary or national security reasons."

25. The Fundamental Research Exclusion (FRE) No license is needed to disclose technical information to foreign nationals inside the US if the information is in the public domain. This includes information published and generally accessible to the public through “fundamental research in science and engineering at accredited institutions of higher learning in the US where the resulting information is ordinarily published and shared broadly in the scientific community.” (EAR 734.8; ITAR 120.11(8))

26. The Public Domain means information that is published and generally accessible to the public, e.g.: • Sales at newstands • Subscriptions • Mailings • Libraries • Unlimited distribution at a conference • Fundamental research

27. Why is the FRE Important for Universities and Colleges?

28. The FRE is important to academic institutions because it will probably apply in at least 90% of your potential export situations. If the FRE applies, you do not need to apply for a license. • The FRE does not apply to the export of tangible goods, biological materials, source code, or software.

29. What Can Destroy the FRE? • Acceptance of restrictions on the publication of scientific and technical information resulting from the project or activity. For the FRE to apply, the results must “ordinarily be published and shared broadly.” • Acceptance of restrictions on the use of foreign nationals in the research. • Acceptance of specific national security controls on a research project or activity sponsored by the U.S. Government.

30. What If the FRE Doesn’t Apply? • Is this an export, including a deemed export? • If the answer is “no”, you don’t have to worry about export controls at this time. This may change in the future if the participation of foreign national is envisioned. • If the answer is “yes”…

31. Let’s look at the definitions of export and deemed export again…

32. Definition: What Is An Export? • Physical shipment of a controlled item or goods • Transmission (electronic or digital) of a controlled item or information related to a controlled item • Release or disclosure (including verbal or visual) of controlled technology, software or technical data, either in the US or abroad • Use or application of controlled technology on behalf of, or for the benefit of, any foreign person or entity, either in the US or abroad • The controlled item, information or software is also referred to as an “export” • “Deemed exports” are treated in the same way as exports (involve release of controlled information to a foreign national in the US)

33. Definition: What is a Deemed Export? Adeemed export occurs when export controlled information, technology or material is disclosed or released to a foreign person in the US. An export is considered (“deemed”) to have been made to the recipient’s home country or last country of citizenship.

34. Highlight: Deemed Exports & PUIs Deemed export situations are not always obvious and can therefore be problematic for PUIs. Even if no PI travel is involved, no one is paid, and nothing is being physically shipped or emailed, you may still have an issue if a project involves or allows: • Foreign students (paid or unpaid) • Foreign national staff (paid or unpaid) • Symposium attendees or program participants from other countries • Visiting scholars, or people touring labs

35. Exports & Deemed Exports: Possible Red Flags • Foreign persons, including students, post-docs, and staff working in labs or on sponsored projects. They do not have to be paid in order for there to be an export issue. • Collaborations with non-US corporations and multi-national corporations. If controlled and FRE does not apply, you may need a license. A US corporation with an abroad division may also be a foreign person, as are foreign governments and their subdivisions.

36. Exports & Deemed Exports: Possible Red Flags • Faculty or student projects involving foreign companies or US companies with offices or divisions abroad – if controlled and no FRE, you may need a license. • International travel, especially with a laptop. We will cover this under sanctions.

37. If the FRE does not apply andthis is an export, including a deemed export, you need to ask: • What is the item? Is it controlled? • Where is it going? • Who will receive it? • What will be the end-use?

38. At this point, you need to work with the PI to classify the export item: • CCL • USML • Vendor software such as Visual Compliance

39. If the research is not subject to the FRE and controlled technology is involved: • The research may need to be restructured. • A technology plan will be required. • You may need a license. Consult the BIS or DTTC webpages for licensing information.

40. 3. Sanctions, including OFAC Sanctions http://www.treasury.gov/resource-center/sanctions/Programs/Pages/Programs.aspx

41. Red Flag: State Sponsors of Terrorism: Cuba, Iran, Sudan, Syria* Countries determined by the Secretary of State to have repeatedly provided support for acts of international terrorism are designated pursuant to three laws: section 6(j) of the Export Administration Act, section 40 of the Arms Export Control Act, and section 620A of the Foreign Assistance Act. Taken together, the four main categories of sanctions resulting from designation under these authorities include restrictions on U.S. foreign assistance; a ban on defense exports and sales; certain controls over exports of dual use items; and miscellaneous financial and other restrictions. * current as of 7/27/13

42. Office of Foreign Assets Control (OFAC) • OFAC administers a number of different sanctions programs. The sanctions can be either comprehensive or selective, using the blocking of assets and trade restrictions to accomplish foreign policy and national security goals. • Specially Designated Nationals List (SDNL)

43. Red Flag: Working with Comprehensively Embargoed and Targeted Countries • Be vigilant – you are likely to need a license and/or may not be able to export • Seek advice from university counsel or other institutional officials before proceeding further

44. Red Flag: OFAC & EAR Comprehensively Embargoed Countries (Cuba, Iran, Syria) • Under OFAC and EAR, Iran, Cuba, and Syria are subject to comprehensive embargoes that prohibit virtually all exports/imports and other transactions without a license or other US Government authorization. http://doresearch.stanford.edu/research-scholarship/export-controls/export-controlled-or-embargoed-countries-entities-and-persons

45. Cuba: • All items on the CCL require a license. • EAR99 items require license. • General policy of denial. • Some license exceptions. • Iran: • License requirements and other restrictions on exports and reexports to Iran. • Comprehensive embargo on transactions involving Iran administered by OFAC. • Syria: • Prohibition on export to Syria of products of the US, other than food and medicine.

46. Red Flag: Targeted Sanctions Countries  OFAC • Libya, Lebanon, Somalia, Belarus, Sudan, North Korea, Iraq, Yemen, Myanmar (formerly Burma), Liberia, Zimbabwe, Balkans, the Cote D'Ivoire (formerly Ivory Coast) EAR • North Korea, Iraq

47. Countries with Restricted Entities on the EAR Entity Chart • China, Canada, Germany, Iran, India, Israel, Pakistan, Russia, Egypt, Malaysia, Hong Kong, Kuwait, Lebanon, Singapore, South Korea, Syria, United Arab Emirates the United Kingdom. ITAR Prohibited Countries • Afghanistan, Belarus, Cuba, Cyprus, Eritrea, Fiji, Iran, Iraq, Cote d'Ivoire, Lebanon, Libya, North Korea, Syria, Vietnam, Myanmar, China, Haiti, Liberia, Rwanda, Somalia, Sri Lanka, Republic of the Sudan (Northern Sudan), Yemen, Zimbabwe, Venezuela, Democratic Republic of the Congo.

48. Red Flag: Travel With Laptops and other Mobile Devices • Not strictly a sponsored program issue, but one of the most likely areas where a PUI can run afoul of export control laws. • There are two license exceptions for travel with items and software containing encryption code (laptops, mobile devices):

49. License Exception TMP (Temporary Exports) allows those departing from the US on university business to take with them as "tools of the trade" institution-owned or controlled, retail-level encryption items such as laptops, smartphones, and encryption software in source or object code to all countries except Sudan and Cuba, as long as the items and software will remain under their "effective control" overseas and are returned to the US within 12 months or are consumed or destroyed abroad;

50. License Exception BAG (Baggage) allows individuals departing the US either temporarily (travel) or longer-term (relocation) to take with them as personal baggage family-owned retail-level encryption items including laptops, smartphones, and encryption software in source or object code. The encryption items and software must be for their personal use in private or professional activities. Citizens and permanent resident aliens of all countries except Cuba, Libya, Syria, Sudan, North Korea and Iran may take with them as personal baggage non-retail "strong" encryption items and software to all locations except embargoed or otherwise restricted locations.