NCURA Conference Export Controls and Embargoes, What You Never Wanted to Know November, 2002 Jamie Lewis Keith, Senior

1. Massachusetts Institute of Technology NCURA Conference Export Controls and Embargoes, What You Never Wanted to Know November, 2002 Jamie Lewis Keith, Senior Counsel

2. A. How Does An Academic Research Institution • Maintain Its Open Teaching and Research Environment • Participate in Joint Research, and • Comply with Export Controls and Embargoes • On Campus, With An International Faculty and Student Body (Deemed Exports Problem); • Elsewhere In US (Deemed Exports, Other Institutions’ Compliance Problem); and • Abroad (Whether working with US Nationals or Foreigners)? 1

3. B. Not An Easily Answered Question • Culture of Free Exchange of Information, Sharing of Equipment in Research/Teaching • Culture/History of Nationality Blindness, Global Contribution in the Advancement of Knowledge • Institutions Are Decentralized, Ill-Adapted to Controls—Particularly Counter-Culture Controls • Regulations Are Hopelessly Complicated, Frequently Change • Licensing Takes Time—Unnatural to Halt Research • Increasing Regulation Makes It More Difficult to Not Do Research if License Required • Challenges Include: 2

4. C. Five Key Elements To Successful Compliance Approach • 1. Keep It Simple! • 2. Keep It Open! • 3. Centralize Administration/Oversight in Office Faculty Cannot Ignore (OSP) • 4. Support Responsible Office with Legal Counsel • 5. Educate Community On • What Law Requires—Consequences for Violations • How to Keep It Simple and Open • Use Examples—Lessons Learned 3

5. Provide Threshold Guidelines • When I Do Not Need to Be Concerned About EAR, ITAR, Embargoes Because They Do Not Apply • — Faculty Can Assess • When I Do Not Need to Get an Export License Although EAR Applies (Still Need to Follow Export Documentation/Procedures) • — Faculty Can Assess • When I Can Expect Not to Get A License When ITAR/Embargoes Apply—When I Can’t Do the Research — Faculty Can Assess First Order, Then Confirm with OSP • When an EAR or ITAR License May Be Required — Consult with OSP/Central Office • Be Clear When It Is Not Simple • Encourage the Right Consultation With OSP/Central Office D. How To Keep It Simple 4

6. E. When Export Controls (EAR, ITAR, Embargoes) Do Not ApplyPublic Domain/Publicly Available • Public Domain (ITAR)/Publicly Available (EAR) (22 CFR §§120.11, 120.10, 15 CFR §§734.3(b)(3), 734.7, 734.9) • Broadest Exclusion Under EAR and ITAR • — Allowing Deemed Export (in US) or Export (Abroad) Without Export Controls Applying At All • Preconditions • — No Equipment or Encrypted Software Involved • — No Reason to Believe Information/Non-Encrypted Software Will Be Used In/For Weapons of Mass Destruction • — US Government Hasn’t Imposed Export Controls as Funding Condition 5

7. Applies to Information and Non-Encrypted Software Already Published, Not Just Ordinarily Published, Through/At One or More of the Following: • Libraries Open to the Public, Including Most University Libraries • Unrestricted Subscriptions, News-stands, Bookstores for a Cost Not Exceeding Reproduction/Distribution Cost (Including Reasonable Profit) • Published Patents • Conferences, Meetings, Seminars, Trade Shows, Exhibitions in the US, which are Generally Accessible to the Public for a Fee Reasonably Related to Cost, and Where Attendees May Take Notes • Websites Accessible to Public, Free and Without Host’s Knowledge or Control of Who Visits or Downloads Software/Information (Clear in EAR, Likely OK in ITAR) • General Science, Math, Engineering Commonly Taught At, and In Course Catalogues of, a University Located Anywhere E. When Export Controls (EAR, ITAR, Embargoes) Do Not ApplyPublic Domain/Publicly Available 6

8. E. When Export Controls (EAR, ITAR, Embargoes) Do Not ApplyPublic Domain/Publicly Available • If Only EAR (Not ITAR) Information or Non-Encrypted Software is Involved, Publicly Available Also Includes Information Already Published At/Through: — Conferences, Meetings, Seminars, Trade Shows, Exhibitions In US or Abroad — Any Educational Information Released in a Course of Any Academic Institution, Wherever Located, and Listed In Its Course Catalogue or Associated Teaching Laboratories • Public Domain/Publicly Available Information/Non-Encrypted Software Isn’t Subject toControls Even If OFAC Embargoed Countries or Nationals, or EAR Denied Persons areInvolved • — But wise to check with Central OSP Office • Restrictions on Travel to Embargoed Countries May Still Apply Under OFAC Regulations (31 CFR Part 500). 7

9. E.When Export Controls (EAR, ITAR, Embargoes) Do Not ApplyUS University Fundamental Research • US University Fundamental Research (ITAR and EAR) (22 CFR §120.11(8) and 15 CFR 734.8(a) and (b)) • Easy to Misunderstand Breadth of This Exclusion from Export Controls-- Limited Exclusion • Cannot Create Fundamental Research Information or Non-Encrypted Software AnywhereOtherThanAt an AccreditedInstitutionof HigherLearningLocatedin the US • — Foreigners Can Participate in Creation of Fundamental Research Only at an Accredited University Located in the US • — US University Faculty/Students Cannot Do Research Abroad Under the Fundamental Research Exclusion • — Once Fundamental Research is Created in the US, It Can Then Be Exported Abroad Without Controls Applying • — Very Limited Exception for “Fundamental Research” Involving Research Satellites and Related Information Exports to Certain Entities in NATO, Major Non-NATO Ally, European Space Agency, EU Countries Involving Only Nationals of Such Countries (22 CFR §§121.1(XV(a) or (e)), 123.16(b)(10) (Equipment), 125.4(d)(Information/Instruction)) 8

10. E.When Export Controls (EAR, ITAR, Embargoes) Do Not ApplyUS University Fundamental Research • Definition: Information/Non-Encrypted Software Resulting From Basic and Applied Research in Science and Engineering Conducted At An Accredited University Located In the US, Which is Ordinarily Published and Shared Broadly In Scientific Community, and Which is Not Proprietary, and to Which Publication Restrictions Do Not Apply —Proprietary Information Provided by Sponsors to University Researchers Is Not Fundamental Research and May Be Subject to Export Controls • Preconditions: — EAR/ITAR-ListedEquipment and Encrypted Software Not Involved — No Reason to Know of Use In/For Weapons of Mass Destruction — Information/Non-Encrypted Software Is Being Released to Foreigners In US Only (deemed export) at an Accredited University — There Are No Publication Restrictions On Research Results, Except (under EAR and Probably Under ITAR but not decided) for a Short Pre-Publication Review to Remove Proprietary Information Provided by Sponsor to the Researcher-- Or to File for Patent Protection • • Cannot Accept Publication Restrictions – No Side Deals • — Research Results are Not Proprietary or Classified • — Unclear Whether ITAR Requires Actual Publication of Results or Just “Ordinarily Published” - Prevailing Wisdom is that Ordinarily Published is Enough 9

11. E.When Export Controls (EAR, ITAR, Embargoes) Do Not ApplyUS University Fundamental Research • Information/Non-Encrypted Software Resulting From Fundamental Research Undertaken At An Accredited University In the US, Is Not Subject to Export Controls --Even If OFAC-Embargoed Countries or Nationals or EAR-Denied Persons Are Involved — Can Create It Without Controls Applying On Campus — Once Created, Can Export It Anywhere 10

12. F.When Export Controls Do or May ApplyHelpful Thresholds – License Required? 1. If Public Domain/Publicly Available or Fundamental Research ExclusionsDoNotApply -- And Exposure to Foreigners In the US (even on campus) or Transfer or Travel Abroad Is Involved, Then, Export Controls • May Apply and EAR License May Be Required Before Any Deemed Export or Export If Equipment, Software Is on the EAR Commerce Control List (CCL) or Information Concerns Listed Items • ITAR Will Apply and a License Will Be Required • — If Equipment, Software is on the ITAR US Munitions List (USML) or Information/Software Concerns Listed Items or • — Even if Not On Lists, If Reason to Know That Equipment, Information, Software Will Be Used In/For Weapons of Mass Destruction or • — Even if Not on Lists, if Equipment, Software, Information Is Designed or Modified For Military Use 11

13. F.When Export Controls Do or May ApplyHelpful Thresholds – License Required? 2. If Equipment, Software Will Be Used In or Regards Outer Space and Doesn’t Fall Under 22 CFR §123.16(b)(10) or the Related Information/Training/Services Aren’t in the Public Domain and Don’t Fall Under 22 CFR or §125.4(d)– And Exposure to Foreign Nationals in US (deemed export) or Transfer or Travel Abroad is Involved — License Will be Required if on USML • If Exclusions Do Not Apply, And Exposure to Foreign Nationals in the US (deemed export) or Transfer or Travel Abroad Is Involved – And Information, Software, Equipment Is Not on USML, But Is on CCL as EAR 99 Only • May Need License If — Destination-Foreigner’s Nationality Is China, India, Israel, Pakistan, Russia (countries with restricted entities on EAR Entities List--15 CFR 744, Supp.4) — End User Is on “Denied Person List” (http://www.bxa.doc.gov/DPL/Default.shtm) 12

14. F.When Export Controls Do or May ApplyHelpful Thresholds – License Required? • — Destination/Foreigner’s Nationality is an OFAC Embargoed Country (Afghanistan, Unita (Angola), Cuba1, Iran1, Iraq1, Libya1, N. Korea1, Former Republic of Yugoslavia, the Balkans (Macedonia, S. Serbia, Montenegro, W. Balkans), Burma, Liberia, Sudan1, Sierra Leone) • — Destination/Foreigner’s Nationality is Another US Embargoed Country (Rwanda*, Serbia, Kosovo, Montenegro, OFAC Embargo List) • Otherwise, Don’t Need License (Just Follow Export Documentation and Procedures) 4. If Exclusions Do Not Apply, And Equipment, Software, Information Is On USML, License Is Required Before Any Exposure to Foreigners In US, Even On Campus (deemed export) or Transfer or Travel Abroad • Will Not Get License —If Destination/Foreigner’s Nationality is Afghanistan, Armenia, Azerbaijan, Belarus, Cuba1, Iran1, Iraq1, Libya1, N.Korea1, Syria1, Vietnam, Burma*, China*, former Republic of Yugoslavia (Serbia and Montenegro), Haiti*, Liberia*, Rwanda*, Somalia*, Sudan1*, Zaire (Democratic Republic of Congo)* or any UN Security Council Arms Embargoed Country (Unita (Angola)) 1 – State Department Terrorist Countries (T-7) * - US Arms Embargo Countries • May Get A License Otherwise 13

15. G.Major Truths • 1. It Is Easier For Universities to Make Information/Non-Encrypted Software Public – Than to Keep It From Exposure to Foreign Colleagues and Students On Campus, Elsewhere In US, and Abroad — Use the Public Domain/Publicly Available Exclusions Whenever Possible — Use Fundamental Research Appropriately On Campus in US 2. Beware of Equipment and Encrypted Software — Do Not Ship/Release Abroad to Foreigners Or US Nationals Before Checking USML and CCL, and Central Office/OSP — Consider Deemed Export Question on Campus -- Possible “Fundamental Research” Exclusion Under EAR; Unclear Under ITAR -- “Publicly Available” “Educational Information” Through Course or Teaching Lab Exclusion Under EAR, but Not ITAR 14