Technology Transfer Controls: Restrictions on Exchanges of Technical Information

1. Technology Transfer Controls:Restrictions on Exchanges of Technical Information Barry J. HurewitzWaltham, MA May 31, 2012

2. Overview • 1 Foundations for control • 2 Identifying controlled technology • 3 Defining exports of technology • 4 Determining technology controls • 5 Technology control plans • 6 Technology control challenges

3. Foundations for controlUnique nature of technology • Control regimes attempt to reflect the special character of technology • Intangible • Dynamic • Collaborative • Derivative • Foundational

4. Foundations for controlRegulatory objective • Controls for same reasons for export control as for commodities, equipment, materials and software • Deny access to adversaries • Maintain qualitative technical superiority • Heightened concern for technologies conveying development or production capabilities, as opposed to only operation/use

5. Foundations for controlSources of technology controls • Classified information: National Industrial Security Program Operating Manual • Defense trade: International Traffic in Arms Regulations • Dual-use technologies: Export Administration Regulations

6. Identifying controlled technologyTechnology under the ITAR • 120.10 Technical data • (1) Information required for the design, development, production, manufacture, assembly, operation, repair, testing, maintenance or modification of defense articles • E.g., Information in the form of blueprints, drawings, photographs, plans, instructions or documentation • (2) Classified information • (3) Invention secrecy order • (4) Software directly related to defense articles

7. Identifying controlled technologyTechnology under the ITAR • “Technical data” does not include • General scientific, mathematical or engineering principles commonly taught in schools, colleges and universities • Information in the public domain (e.g., published and which is generally accessible or available to the public) • Basic marketing information on function or purpose • General system descriptions of defense articles

8. Identifying controlled technologyITAR defense services • 120.9 Defense service • (1) Assistance (including training) to foreign persons, in the design, development, engineering, manufacture, production, assembly, testing, repair, maintenance, modification, operation, demilitarization, destruction, processing or use of defense articles • (2) Furnishing controlled technical data • (3) Military training of foreign units and forces • Even if services involve public domain data • Subject to licenses or agreements (TAA/MLA)

9. Identifying controlled technologyITAR defense services • Proposed revised definition (4/13/11) • Exclude: • Services based solely on public domain data • Mere hiring of foreign nationals • Include: • Integration of items into defense articles • Training, but only with respect to employment of defense articles

10. Identifying controlled technologyTechnology under the EAR • Technology:Specific information necessary for the “development,” “production,” or “use” of a product • Technical datamay take forms such as blueprints, plans, diagrams, models, formulae, tables, engineering designs and specifications, manuals and instructions written or recorded on other media or devices such as disk, tape, read-only memories • Technical assistance may take forms such as instruction, skills training, working knowledge, consulting services; may involve transfer of technical data

11. Identifying controlled technologyTechnology under the EAR • Development:All stages prior to serial production, such as: design, design research, design analyses, design concepts, assembly and testing of prototypes, pilot production schemes, design data, process of transforming design data into a product, configuration design, integration design, layouts • Production: All production stages, such as: product engineering, manufacture, integration, assembly (mounting), inspection, testing, quality assurance

12. Identifying controlled technologyTechnology under the EAR • Use: Operation, installation (including on-site installation), maintenance (checking), repair, overhaul and refurbishing • “All six activities in the definition of ‘use’ must be present to trigger a license requirement” 71 Fed. Reg. 30843 (5/31/2006)

13. Defining exports of technologyTechnology export under the ITAR • 120.17 Export • Sending or taking defense article out of the U.S. (except mere travel by a person with personal knowledge that includes technical data • Transfer of controlled aircraft, vessel, or satellite • Disclosure via oral or visual disclosure-- To foreign government, embassy or mission -- To a foreign person (4) Performing a defense service on behalf of, or for the benefit of, a foreign person

14. Defining exports of technologyEAR tech transfer & deemed export • Export of technology or (non-encryption) software: • Release of technology or software in a foreign country • Release of technology or source code to a foreign national (deemed export) • “Release” occurs via: • Visual inspection • Oral exchanges • Application abroad of personal knowledge or technical experience acquired in the U.S.

15. Determining technology controlsLimitations on technology controls • Public availability/public domain • Operation and sales technology • “Required” to achieve or exceed regulatory threshold • Intra-organizational disclosures • Limited-purpose disclosures • Disclosures with assurances

16. Determining technology controlsPublic domain/publicly available

17. Determining technology controls EAR operation technology • Operation technology is the minimum technology necessary for the installation, operation, maintenance (checking), and repair • Minimum necessary does not include technology for development or production and includes use technology only to the extent “required” to ensure safe and efficient use • Subject to further restrictions under specific ECCNs

18. Determining technology controls EAR sales technology • Sales technology means data supporting a prospective or actual quotation, bid, or offer to sell, lease, or otherwise supply an item • Of a type customarily transmitted with a prospective or actual quotation, bid, or offer in accordance with established business practice • Excluding detailed design, production, or manufacture technology, or the means of reconstruction, of either the quoted item or its product that the consignee could employ to reduce the technology to production • Subject to further restrictions under specific ECCNs

19. Determining technology controlsTypes of EAR technology controls • Unqualified: “Technology” for the “development,” “production,” or “use” of items controlled by [ECCN] • Qualified:“Technology,” according to the General Technology Note, for the “development,” “production,” or “use” of items in [ECCN] • Also: “Technology” exclusively for the “development” or “production” of [item] • Catchall: ECCN 0E521 will cover “[a]ny technology subject to the EAR that is not listed elsewhere in the CCL, but which is controlled for export because it provides at least a significant military or intelligence advantage to the U.S. or for foreign policy reasons”

20. Determining technology controlsEAR General Technology Note • The export of “technology” that is “required” for the “development,” “production,” or “use” of items on the Commerce Control List is controlled according to the provisions in each Category • “Technology” “required” for the “development,” “production,” or “use” of a controlled product remains controlled even when applicable to a product controlled at a lower level

21. Determining technology controls EAR General Technology Note • Required: …that portion of “technology” or “software” which is peculiarly responsible for achieving or exceeding the controlled performance levels, characteristics or functions • Example: Product X is controlled if it operates at or above 400 MHz and is not controlled if it operates below 400 MHz. • If production technologies A, B, and C allow production at no more than 399 MHz, then technologies A, B, and C are not “required” to produce the controlled product X • If technologies A, B, C, D, and E are used together, a manufacturer can produce product X that operates at or above 400 MHz • In this example, technologies D and E are “required”…

22. Determining technology controls EAR General Technology Note • Required technology refers only to that portion of technology which is peculiarly responsible for achieving or exceeding controlled performance levels, characteristics or functions • In classifying technology, granularity matters!

23. Determining technology controls Options for intra-organizational export • EAR • License Exceptions BAG and TMP • License Exception STA • Proposed License Exception ICT • Internal-use of encryption technology to U.S. subs and favored-country private-sector end users • ITAR • 125.4(b)(9): Allows technical data export by a U.S. person who is an employee of a U.S. corporation to a U.S. person employed by that corporation outside the United States • 124.16 and 126.18: Allows certain exports to dual or third-country nationals who are bona fide regular employees, directly employed by the foreign consignee or end-user

24. Technology Control PlansTopics for technology control planning • Define the stakeholders subject to controls • Describe the covered information • Designate & empower responsible company officials • Physical access control (segregated work areas) • Technical/IT security control • Administrative safeguards (badging, escorts) • Compliance certification • Training/indoctrination • Monitoring and internal reporting • Sanctions • Corrective action

25. Technology Control PlansTCP origins in the NISPOM • NISPOM 10-509: • A TCP is required to control access by foreign nationals assigned to, or employed by, cleared contractor facilities… • The TCP shall contain procedures to control access for all export-controlled information • NISPOM 2-307: • A TCP shall be implemented by companies cleared under FOCI negation measures

26. Technology Control PlansTCPs in the ITAR • 126.13(c): TCP required when foreign nationals are employed at or assigned to security-cleared facilities • 126.18(c)(2): “Technology security/clearance plan” required as condition of exemption for intra-organizational transfers • 124.15(a)(1): “Technology transfer control plan” and “encryption technology control plan” required to support satellite-related licenses • 126.5(c)(4): “Technology transfer control plan” to support use of Canadian exemption

27. Technology Control PlansTCPs in BIS practice • BIS guidance: TCPs required in cases when foreign nationals are employed at or assigned to … facilities that handle export-controlled items or information • TCP license condition for technology transfer • Establish satisfactory procedures to ensure compliance with the conditions of this license, particularly those regarding limitations on access to controlled technology by consignee and the requirement to obtain U.S. government authorization before divulging controlled technology to other parties. • Consignee shall implement their TCP to ensure compliance with the conditions of this license. A copy of the TCP must be delivered to DOC/BIS prior to the export of technology.

28. Technology Control PlansTCPs in BIS practice • TCP license condition for deemed exports • Applicant will establish procedures to ensure compliance with the conditions of this license, particularly those regarding limitations on access to technology by foreign nationals. The Applicant’s key export control management officials will ensure that the foreign national complies with [these license conditions]. A copy of such procedures will be provided to DOC/BIS. • Minimum necessary disclosures • Non-disclosure notice and certification

29. Technology Control PlansBIS required TCP contents • Statement of corporate commitment • Identification of key export management officials • Training program • Security procedures for preventing access to controlled technology by unauthorized personnel (e.g., badges, access codes) including procedures for visitors and unauthorized employees • Pre-employment screening and non-disclosure agreement • Access restrictions to ensure employees do not received controlled technology until authorized • Distribution restrictions to ensure that controlled technology is not disseminated in an unauthorized manner

30. Technology control challengesManaging access to changing intangible information • Classifying nascent technologies • Incorporating export classification into patent process • Controlled technologies developed by foreign nationals • Actual vs. potential access to controlled technology • Access to global corporate networks

31. Technology Control PlansSpecial technology transfer challenges • Applying de minimis standards • “Reexports of foreign technology commingled with or drawn from controlled U.S.-origin technology” (EAR 734.4) • Valuation of foreign and controlled U.S. origin technology • One-time report for government verification • Technical assistance relating to encryption items • … technical assistance, when rendered with the intent to aid in the “development” or “production” of encryption commodities or software …, may require authorization under the EAR even if the underlying encryption algorithm to be implemented is from the public domain or is not of U.S. origin. EAR 774 Supp. No. 1, ECCN 5E002 License Req. Note

32. Technology Control PlansSpecial technology transfer challenges • Discerning the purpose(s) of technical assistance pertaining to non-controlled items • Employee travel policies and practices • Technology control in international joint ventures • Appointment and reporting by compliance personnel • Contractual safeguards to ensure compliance • Managing deemed export compliance • Managing technology transfer in the “cloud”

33. Questions? • Barry J. Hurewitz • Partner, WilmerHale • +1 202 663 6089 • barry.hurewitz@wilmerhale.com