Export Controls

How might export controls affect my activities at the University?

U.S. export controls consist of a broad, diverse, and complicated array of regulatory requirements that have varying and often surprising impacts on the activities of the University’s personnel. Three areas in particular give rise to most export control issues in the University setting.

• Controlled information releases in the U.S. The Export Administration Regulations (EAR) and International Traffic in Arms Regulations (ITAR) prohibit the unauthorized disclosure or transfer of controlled software, technology, and technical data to non-U.S. persons, both abroad and in the United States (a "deemed export," which is discussed further in question 4 below). As a result, the University must take care to prevent EAR- and ITAR-controlled software and technical information from being disclosed to non-U.S. students and researchers in the absence of U.S. Government authorization. The chief approach taken to avoid such disclosures is to ensure that research results are not EAR- or ITAR-controlled to begin with. To accomplish this, the University generally relies on the "fundamental research" exclusion from the EAR and ITAR, which is discussed further in question 6 below.
• Geographic exports outside the U.S. Export controls regulate the shipment, transmission, carriage, or provision of certain goods, software, technology, and services outside of the United States. The goods, software, and technologies subject to the regulations include the EAR-controlled items on the Commerce Control List (CCL) and the ITAR-controlled items on the U.S. Munitions List (USML). Regulated services include defense services subject to the ITAR and certain activities having a restricted military, intelligence, or security end-use governed by the EAR.
• Travel, financial transactions, and other activities subject to sanctions. The Foreign Assets Control Regulations and related rules impose economic sanctions against several countries as well as the individuals and organizations on the Specially Designated Nationals and Blocked Persons List (a U.S. Government official list of organizations and individuals subject to strict sanctions), among other lists. The country-wide sanctions include robust restrictions on travel and trade to and from the targeted countries, affecting the ability of University personnel to study, teach, or conduct research in those locations.

Anyone facing a potential export controls issue should not hesitate to seek guidance from the University's Export Controls and Research Security team (ECRS, [email protected]).

What items are on the Commerce Control List (CCL) and U.S. Munitions List (USML)?

The CCL consists of certain military items and commodities, software, and technologies that have “dual-use” commercial and potential military, intelligence, or national security applications. The USML consists generally of military and certain satellite items.

Consult ECRS to determine whether a particular item is on the CCL or USML.

What technologies are controlled by the EAR and ITAR?

The EAR govern the export of technology required for the development, production, or refurbishment/remanufacture of various items identified on the CCL. Instructions on merely how to use or repair an item on the CCL generally do not rise to the level of controlled technology. In other words, EAR-controlled technology consists of technical know-how about designing and making a listed commodity, but not operation or maintenance information, except in rare cases involving certain military or satellite systems.

The ITAR govern the export of controlled technical data, defined as technical information required for the design, development, production, manufacture, assembly, operation, repair, testing, maintenance, or modification of a defense article identified on the USML. Note that under the ITAR, even operation and maintenance information is subject to control.

Carved out from the definitions of EAR- and ITAR-controlled technology and technical data is information that results from "fundamental research," which is discussed further in question 6 below.

What is a "deemed export"?

Under the EAR and ITAR, the release of controlled software, technology, or technical data to a non-U.S. person located in the U.S. is deemed to constitute an export to that person's country of origin. Such a "deemed export" is distinguishable from an actual export (in which a controlled item leaves the U.S.) but the act is still treated as an export for licensing purposes under the EAR and ITAR.

What's the difference between U.S. persons and non-U.S. persons for purposes of the EAR and ITAR?

With respect to individuals, a U.S. person is generally anyone who is a U.S. citizen or lawful permanent resident ("green card" holder), or who has been granted political asylum or other protected status. A non-U.S. (or foreign) person is any individual who is not a U.S. citizen or permanent resident, and who has not been granted protected status. Thus, a foreign-born student or researcher attending or working at the University on a visa is a non-U.S. person.

With respect to organizations, a U.S. person is any corporation or other entity incorporated or organized to do business in the U.S., or any federal, state, or municipal governmental entity. A non-U.S. person is any entity or group incorporated or organized to do business in a non-U.S. jurisdiction, or a non-U.S. government (including any agency or subdivision) or international organization.

What is the "fundamental research" exclusion?

The EAR and ITAR exclude the results of "fundamental research" from the scope of technologies subject to control. The EAR define fundamental research as "research in science, engineering, or mathematics, the results of which ordinarily are published and shared broadly within the research community, and for which the researchers have not accepted restrictions for proprietary or national security reasons." (The definition in the ITAR is substantially the same.) Because technology and information that arise during or result from fundamental research are not subject to the EAR and ITAR, they generally may be shared with non-U.S. persons without restriction.

Are there any other instances in which my work would not qualify as fundamental research?

Work is not fundamental research when it is subject to restrictions either on publication (other than for reasonable review to protect intellectual property) or on personnel access. As a general matter, Board of Regents Policy: Openness in Research prevents the University from accepting such restrictions, and the Office of Sponsored Projects Administration (SPA) works actively to negotiate them out of sponsored grants, contracts, and cooperative agreements.

If restrictions cannot be removed or adequately revised in connection with a project, the responsible principal investigator (PI) must decide either to decline the work, or to pursue an exemption under Administrative Policy: Openness in Research. The standard for obtaining an exemption is "compelling reasons."

If the University accepts the publication or access restrictions, the project cannot be treated as fundamental research excluded from the EAR and ITAR. Accordingly, the PI must work with ECRS to implement a Technology Control Plan, the purpose of which is to ensure that EAR- or ITAR-controlled technical information is appropriately segregated and secured.

In addition, proprietary or confidential technical information subject to the EAR or ITAR provided by a sponsor or other external party does not qualify as fundamental research. As in the case with restricted research, a PI who wishes to receive such materials must first coordinate with ECRS to establish the appropriate Technology Control Plan.

Finally, work on certain encryption source code cannot qualify for treatment as fundamental research.

I see how export controls may apply to research, but do I have to worry about teaching as well?

For the most part, no. As a general matter, information shared openly in the classroom or a teaching lab is not subject to the EAR or ITAR, so the presence of students from non-U.S. countries (even comprehensively embargoed countries) does not create a significant compliance risk in typical educational settings in the U.S. 

Teaching activities involving students physically located in sanctioned locations, however, could implicate export control issues and must be brought to ECRS’s attention.

I need to ship or take samples or equipment to a foreign country. Does the fundamental research exclusion apply?

No. The fundamental research exclusion works only for the disclosure of software, technology, and technical data to non-U.S. persons. It does not apply to the shipment or carriage of tangible equipment, materials, or samples outside the U.S.

Prior to export, check with ECRS to determine whether the item is on the CCL or USML, and whether a U.S. Government license is required.

Are there any special restrictions on working with students and researchers from embargoed countries?

As noted in the answer to question 1 above, the Foreign Assets Control Regulations restrict travel and trade to and from embargoed countries in many respects, but certain activities are allowed. Most importantly, the University may host students and researchers from embargoed countries (provided the appropriate visas have been issued) without the need for special U.S. Government authorization. As is the case with visitors from other foreign countries, the University must simply prevent the unauthorized disclosure of EAR- or ITAR-controlled technical information to these students and researchers.

Once a student or researcher returns to an embargoed country, however, the University must be very careful about any further interactions, because exports to and imports from embargoed countries remain prohibited in general. So, for instance, while the University may provide an education and degree to an engineering student visiting from Iran on a visa, a University laboratory could not receive and analyze a sample sent by that student after they returned to Iran.

When should I consult the Export Controls and Research Security team?

Contact ECRS whenever there could be a potential export controls issue, such as in the following circumstances:

• Whenever a sponsor attempts to impose publication or personnel access restrictions on research activities, unless a SPA GCO is already handling the matter with the ECRS.
• Before receiving export-controlled technical information from an external party, such as an industry or U.S. Government research sponsor, unless a SPA GCO is already handling the matter with ECRS.
• Whenever documents from sponsors or other parties refer to the EAR, the ITAR, or export controls generally.
• Before accepting military hardware, software, technology, or technical data from an outside party to be used in a project as part of an instructional course.
• Before preparing to export from the U.S. any technology, equipment, materials, or chemical or biological agents (including toxins and genetic elements) on the CCL.
• Before handling or preparing to export from the U.S. any goods, technical data, or services subject to the ITAR.
• Before providing any sort of support or assistance regarding military, intelligence, or security R&D in a country outside the U.S.
• Before traveling to an embargoed country on University business.