Non-Disclosure Obligations and Receipt of Export Controlled Proprietary Data: Impact and Solutions

1. Non-Disclosure Obligations and Receipt of Export Controlled Proprietary Data: Impact and Solutions Non-Disclosure Obligations and Receipt of Export Controlled Proprietary Data: Impact and Solutions June 15, 2009 10 a.m. – 11:30 a.m. Office of Ethics, Compliance & Audit Services

2. Presenters • Moderator: Luanna Putney, Director of Research Compliance, Office of Ethics, Compliance & Audit Services, UCOP • Barbara Yoder, Private Consultant • Lourdes DeMattos, Contract and Grant Officer, Research Administration Office, UCOP • Dianne Archer, Coordinator, Private Contracts and Grants, Research Administration Office, UCOP • Patrick Schlesinger, AVC of Research Administration and Compliance, UC Berkeley

3. Housekeeping Items Muted—save questions until the end Recorded—will send link after session Materials—will send slide deck with case study materials after session

4. Course Outline Overview of Issues & General Approaches Common Clause and Standard Fix (Lockheed Martin) Case Example of Problem even with Standard Fix (Parker-Hannifin) Case Example of How Far Industry will go to Accommodate UC, Sample Management Plan & Guidance to Faculty (Ball) Problems that Can’t Be Fixed & Walk-Aways (Qualcomm) Conclusions and Questions

5. Why Receiving Export Controlled Proprietary Data is a Problem Company is transferring to UC the liability of export violation for disclosure to foreign persons (“deemed export”) Requires discrimination within the research team (the haves and have-nots), which is contrary to policy Places individual and institution at risk Such Information cannot be used to support UC’s mission of education & research

6. When should you worry? Non-disclosure obligations appear in various kinds of agreements: research, NDA’s, MTA’s, purchase of software, license-in of ‘things’ When the agreement has both a proprietary data/non-disclosure clause and an export clause, you should really worry If the agreement simply requires non-disclosure, but no mention of export, simply add statement that no export regulated material will be sent

7. Simplest Approach to Non-Disclosure Obligations Agree to receive proprietary data, but not any export-controlled proprietary data because of the substantial numbers of foreign students and visitors Foreign participation is an essential element of what makes UC on science’s cutting edge Restrictions on foreign persons are contrary to policy and impractical and compromise the science

8. Simplest ‘Fix’ Clause: Because UC is an institution of higher education and has many foreign persons who are students, employees, and visitors, UC intends to conduct the project as fundamental research under the export regulations. (in legalese: “such that the technical information generated by UC qualifies as public domain under ITAR 120.10(5) and 120.11 or publicly available under EAR 15CFR 734(b)(3) and 734.7 through 734.11”) Accordingly, no export-controlled proprietary data of Sponsor may be transferred to UC.

9. Alternate “Fix” Clause: Defer Same first part, re: fundamental research In the event Sponsor’s Confidential Information is determined by Sponsor to be export controlled, UC reserves the right to elect to not receive such export controlled information A plan for receipt, use, and dissemination must be developed and agreed to by a UC institutional official prior to disclosure or transfer

10. What to do When Sponsor’s Export Controlled Proprietary Data is Needed • Explain Why this creates a problem for UC • Ask Sponsor to divide into three groups: • Category #1: Proprietary, but NOT technical data as defined in export regulations (necessary for design, manufacture or use of controlled commodity) • Category #2: Export regulated technical data that isn’t essential to company to be held as proprietary • Category #3: Export regulated that must be held as confidential because essential to company’s competitive edge

11. Consult with Investigator Can project proceed where all research team members receive only material in categories #1 & # 2 Only one (or at most 2) team members receive the information in category #3 The team member receiving category #3 material agrees to not re-disclose it to any team member or any other person The team member(s) to receive category #3 are willing to accept risk of export violation (as well as the burden of clogging their brain with useless info)

12. When Will the Work-Around Work for Category #3 Data When the export controlled proprietary information is truly ‘background’ or such that the project can proceed with just one team member accessing the information When the sponsor understands that UC must and will publish the results of UC’s work (and to the extent any proprietary data influences UC’s work, it will be reflected when our drawings and designs are released)

13. When Will it NOT Work? When the company’s export controlled proprietary data cannot be separated from the UC work When all the research team require access to the export controlled proprietary data When the real issue is that the sponsor wants UC to perform R&D on the company’s products and really does not want to allow UC to publish and disseminate UC’s work

14. Case #1: Standard Commercial Clause,Lockheed Martin Lockheed Martin: Standard Commercial Clause

15. NDA for Research Project: Microwave Packaging Lockheed wanted to protect themselves against any responsibility for the University’s inadvertent disclosure of export controlled information. Included provision to comply with all export regulations. Included a provision prohibiting the transfer of: PROPRIETARY INFORMATION, including the transfer to foreign persons employed by or associated with, or under contract to the receiving Party, without the authority of any export license or applicable license exemption.

16. Highlights We all want to protect ourselves from inadvertent disclosure….However, it is important that the company understand the nature of our Fundamental Research Exclusion (FRE). A general statement requiring our compliance with export regulations is, in and of itself, ok. Proprietary Information ≠ Export Controlled Information We need parameters around what constitutes Export Controlled Information

17. Solutions Limit the definition of what’s restricted on re-transfer to foreign persons to: “Export Controlled Proprietary Information” “Without limiting the foregoing, the receiving Party agrees that it will not transfer any export controlled PROPRIETARY INFORMATION, to include transfer to foreign persons employed by or associated with, or under contract to the receiving Party, without the authority of any export license or applicable license exemption.” Set out expectations for fundamental research, with little or no export controlled information being provided to us by Sponsor. “Whereas, it is recognized that THE REGENTS conducts fundamental and open research and intends to publish and share the results of such research; Whereas LOCKHEED MARTIN, in recognition of The Regents mission, will limit the amount of any export controlled Proprietary Information that it discloses to THE REGENTS’ employee, Dr. X;”

18. Limit the amount of EC Proprietary Information to be received Sponsor must first notify UC of its intent to disclose EC Proprietary Information & transfer to named UC employee only Sponsor must provide the ECCN number and keep inventory “Prior to the transfer of any export controlled PROPRIETARY INFORMATION to the receiving party, the disclosing Party will notify the receiving Party of the specific export control classification number of such export controlled PROPRIETARY INFORMATION. LOCKHEED MARTIN will disclose export controlled PROPRIETARY INFORMATION only to The Regents’ employee, Dr. X; will mark all such information conspicuously with a legend identifying such information as “Export Controlled” and indicating the specific export control classification number; and will maintain an inventory or library of all export controlled PROPRIETARY INFORMATION disclosed to Dr. X. Solutions (Con’t)

19. Additional Improvements: Could have added: • Sponsor must await UC’s acceptance by a UC authorized official before transferring to contact (e.g. have everything go through a campus institutional official before going to PI/named employee—probably resulting in further limiting the amount of material transferred), or require cc. be sent to institutional official, so can at least monitor volume • UC must retain the right to reject such information, and this shall not be deemed a breach of the agreement.

20. Why it Worked: FRE understood by Lockheed PI intended to publish research results PI would be the only person receiving the controlled and proprietary information PI agreed not to re-disclose One other student/UC employee would receive proprietary, but not export controlled information

21. Summary Principles for Standard Response: Sponsor shall first notify a UC institutional official of its intent to disclose confidential information subject to export controls, and tell UC the nature of the information to be provided and why they believe it is necessary for the project Sponsor must provide the ECCN number Sponsor must await UC’s authorized official’s agreement to receive the disclosure before disclosing. UC must retain the right to reject receipt of sponsor confidential information subject to export controls, and this shall not be deemed a breach of the agreement. Sponsor must disclose only to a designated UC point person; that person must agree to accept the responsibility to not re-disclose to any other person

22. Parker-Hannifin • Collaborative research between UC & P-H to reduce noise levels of P-H’s aircraft engine bleed valves • UC published work likely to include how to improve valves • Project in its 8th month when P-H needed to disclose information it claimed is export controlled & proprietary • Research agreement EC, confidentiality and publication provisions generally acceptable • Called for the parties to execute a data mgmt plan (NDA) before such information was to be exchanged

23. P-H Original Data Mgmt Plan • Acknowledged that the parties intend to be FR, but FR then becomes non-FR if: • Prepublication review reveals patentable tech. • P-H provides tech data that is in furtherance of project that is confidential/proprietary • P-H provides technical assistance to UC • P-H provides “unpublished technology” info that becomes part of the research

24. Issues/Problems: • Iranian UC student working on project • Cannot utilize 125.4(b)(10) exception (Iran an embargoed country) • P-H (and PI) thought we could pull Iranian student off project = then, no EC problem! • P-H wanted to treat all EC’d information as “proprietary” • No distinction between truly proprietary information versus other info associated with valves or other P-H technology that might simply be EC’d. • Misconception that technology that might be EC’d and proprietary (patentable) may not be published, thus, UC’s results become non-FR

25. How to fix data plan • Clear up misconceptions with P-H: • UC cannot discriminate against Iranian student • P-H must make distinction between “crown jewels” and info that is EC’d but not proprietary. • UC must retain publication ability, including results that might show others how to improve valve • Reasonable delay of publication for patent protection does not take this out of the FR exemption • P-H should disclose only minimum EC/proprietary information necessary to accomplish goals of project • Clarify with PI: • Can project continue if only he receives EC/proprietary info? • Can he still publish?

26. Revised data plan • All controlled info must be clearly ID’d by P-H as EC/proprietary @ time of disclosure • Controlled info disclosed only to two individuals (co-PI’s) • P-H to transfer only minimum controlled info required • P-H to identify any proprietary info that is not EC’d • UC remains responsible for its handling of controlled info under the plan

27. (Original Res Agmt EC clause): EXPORT COMPLIANCE. The Parties intend to conduct the Research Project as fundamental research in compliance with the applicable United States export regulations (i.e., the International Traffic in Arms Regulations and the Export Administration Regulations, as may be applicable (each an “Applicable Export Regulation”)). In the event that either Party (the “Disclosing Party”) needs to provide material that is both classified as technical data under an Applicable Export Regulation and is to be treated as Confidential Information (“Export Controlled Proprietary Information”) to the other Party (the “Receiving Party”), the Disclosing Party (1) shall not send the Export Controlled Proprietary Information to the Receiving Party until Disclosing Party’s Authorized Representative and the Receiving Party’s Authorized Representative develop a plan for the receipt of Export Controlled Proprietary Information which complies with all requirements of the Applicable Export Regulation(s), including the requirement for obtaining any export license, if applicable, and (2) each Party agrees to make reasonable efforts to minimize the amount of Export Controlled Proprietary Information transferred. For purposes of this provision the Authorized Representatives are as follows: For University: [Principal Investigator] For Sponsor: [________]”

29. Ball Aerospace UC and Ball to develop joint proposal for NASA space-based research project ITAR Exception 125.4(b)(10) allows UC to transfer ITAR technical data to it’s foreign employees as long as further re-disclosure is prohibited Ball expects UC to sign their standard NDA

30. Ball Accepts UC Strategy After conversations with Ball export and program officers, Ball agrees to carefully divide material into UC’s 3 categories Ball agrees to restrict the amount of export controlled data that must be kept proprietary (category #3), to have high standards and not routinely put everything into that category, and to transmit it only to the PI

31. Ball Makes Further Changes to the Standard NDA Competition sensitive data is only confidential until competition is over Proprietary data to be disclosed for 1 (not 3) years Ball to keep track of any material they want returned or destroyed & inform UC within 30 days of termination of agreement Deleted reference to & control of UC documents that contain portions of their data Deleted indemnification for violation of export regulations

32. Management Plan & Instructions Ball takes responsibility to review final proposal and identify any Ball proprietary data to be marked (otherwise, not confidential) Ball to make different markings: competition sensitive, proprietary, & proprietary/export (with latter category to PI only) Ball to place ‘expiration date’ on proprietary marking so clear when expires

33. Qualcomm Case • Company claims broad range of information proprietary and will be exchanged under the NDA • Software, hardware, “research,” algorithms, “business activities and outlooks” • Would not specify which was export controlled

34. Can Export Controlled Information from Qualcomm be Managed? • UC – before transferring proprietary, export-controlled information, transferring party notifies the other in writing so that a management plan can be prepared • Management plan advantages • Who will receive it? • How will it be used in the project? • Do we agree that it is really export controlled?

35. Qualcomm Response • Notification and management plan rejected. • Only agrees to “cooperate” from time to time “upon reasonable request” to jointly determine the export classification of the information shared with the other party • Q does not agree to do the classification prior to transfer • Is this really manageable?

36. Is this a Walk-Away? • Yes • The controlled information would be provided by Qualcomm but they refused to identify it prior to transfer • Qualcomm is in the best position to definitely classify the information • EAR presumes that the company sending the information knows the ECCN and will manage required licensing (15 CFR 734, Supp. 1 Q&A D(2)) • UC would not know how the information could be used in the project • UC would not be able to manage the risk of deemed export violation

37. Get a Deemed Export License? • Deemed export licenses don’t work in an open, academic environment • Fluid membership of research teams with foreign students and visiting scholars • Licenses restrict use of information • Export control risk and University policy violation • Research teams are to be based on scientific merit, not citizenship or immigration status

38. Conclusions • Understand Why Receiving Export Controlled Technical Data that must be kept In-Confidence is a problem: • Compromises UC’s education & research mission • Foreign persons are excluded from research team even though their contributions are essential • Alienates foreign partners and divides team • Creates personal and institutional liability for violation of export regulations

39. Conclusions Explain position to faculty and sponsors so that it is clear why it is in everyone’s interest to eliminate or drastically reduce the amount Ask sponsors to transfer Category #1 or #2 material and/or to secure any prime contract required CO prior approval for release so becomes Category #2 when sent to UC Clarify that only 1 (and no more than 2) members of team will receive Category #3 Set high standard for Category #3 Emphasize publication of UC’s results

40. Questions? • Campus export control contacts • Luanna Putney, Director of Research Compliance, Office of Ethics, Compliance & Audit Services 510-987-0028, luanna.putney@ucop.edu