Export Controls Review

1. Export Controls Review Presented to JHU Schools of Medicine, Nursing, and Public Health By Jahna Hartwig, JHUAPL Associate General Counsel July 26, 2007

2. Agenda Export Definitions US Export Laws OFAC Sanctions Programs ITAR EAR Licensing Requirements Jurisdiction Classification & Licensing �Deemed� Exports Exclusions, Exemptions, and Exceptions Public Domain Exclusion Fundamental Research Exclusion Export Controls & Publications Export Authorization

3. Definition of Export �Export� includes: Sending or taking controlled items out of the United States. Disclosing (including oral or visual disclosure) or transferring controlled technical data/technology to a foreign person, whether in the United States or abroad. For example: Emailing technical data to a foreign person; Discussing technical data with a foreign person; Posting technical data on the internet; Giving a public presentation that includes technical data; or Publishing technical data. (Note: Commerce regulations have special �deemed export� rules.) Performing a defense service on behalf of, or for the benefit of, a foreign person, whether in the United States or abroad. �Defense Service� means �furnishing of assistance (including training) to foreign persons, whether in the United States or abroad in the design, development, engineering, manufacture, production, assembly, testing, repair, maintenance, modification, operation, demilitarization, destruction, processing or use of defense articles. It can also include military training of foreign units and forces, regular and irregular, including formal or informal instruction of foreign persons in the United States or abroad or by correspondence courses, technical, educational, or information publications and media of all kinds, training aid, orientation, training exercise, and military advice.�Defense Service� means �furnishing of assistance (including training) to foreign persons, whether in the United States or abroad in the design, development, engineering, manufacture, production, assembly, testing, repair, maintenance, modification, operation, demilitarization, destruction, processing or use of defense articles. It can also include military training of foreign units and forces, regular and irregular, including formal or informal instruction of foreign persons in the United States or abroad or by correspondence courses, technical, educational, or information publications and media of all kinds, training aid, orientation, training exercise, and military advice.

4. Exports to Foreign Persons in the US �Foreign Person� means: a person who is not a US citizen, lawful permanent resident (i.e., green card holder), or asylum holder. a foreign corporation, business association, partnership, trust, society or any other entity or group that is not incorporated or organized to do business in the United States, as well as international organizations, foreign governments and any agency or subdivision of foreign governments (e.g. diplomatic missions). Interactions with foreign persons in the US can be exports. For example, Giving a presentation to foreign persons that includes export-controlled technical data. Discussing export-controlled technical data with foreign persons. Giving foreign persons access to export-controlled technical data or equipment.

5. Foreign Travel & Public Release Foreign travel can include exports. Examples include: Carrying export-controlled equipment. Carrying export-controlled technical data, including any data stored on your laptop. Giving a presentation to or having discussions with foreign persons that includes export-controlled technical data. Public release is, by definition, an export, because all members of the public, including foreign persons in the US and abroad, have access to the information. Examples of public release include: Posting technical data on the internet. Giving a public presentation that includes technical data. Publishing technical data in a journal or other periodical. (Note: Different rules for public release in Commerce and State regs.)

6. US Export Laws Foreign Assets Control Regulations (OFAC) Controls exports to specific countries, entities and individuals that are subject to US economic and trade sanctions 31 CFR pt. 500 et seq., http://www.treas.gov/offices/enforcement/ofac/legal/index.shtml Export Administration Regulations (EAR) Controls exports of �dual use� items � essentially any item that is not published or publicly available � including related technologies. 15 CFR pt. 730 et seq., http://www.access.gpo.gov/bis/ear/ear_data.html International Traffic in Arms Regulations (ITAR) Controls exports and temporary imports of defense articles, including civilian spacecraft/satellites, as well as related technical data and services. 22 CFR pt. 120 et seq., http://www.pmddtc.state.gov/itar_index.htm. US Munitions Import List (USMIL) Controls permanent imports of arms, ammunition and implements of war. 27 CFR pt 447, http://www.atf.treas.gov/firearms/feib/guidebook/FEIB-GB.pdf

7. OFAC Sanctions

8. ITAR, USMIL and EAR The ITAR, USMIL, and EAR control goods, technical data, and technical assistance/services. Neither the ITAR nor the EAR control public domain information, fundamental research, and basic marketing information. If an item is does not fall into one of these categories, it is subject to the ITAR or EAR (or, in some cases, more specialized regulatory regimes such as DOE or FDA regulations).

9. International Traffic in Arms Regulations (ITAR) Controls exports of defense articles, as well as technical data and services related to those articles, under the ITAR. An item is an ITAR-controlled defense article if it is �specifically designed, developed, configured, adapted, or modified� for a military application, and does not have predominant civil applications or civilian performance equivalent (defined by form, fit and function), or has significant military or intelligence applicability. The intended use of the article or service after its export (i.e., for a military or civilian purpose) is not relevant in determining whether the article or service is subject to the ITAR.

10. ITAR Categories Military Electronics Fire Control, Range Finder, Optical and Guidance and Control Equipment Auxiliary Military Equipment Toxicological Agents, Including Chemical Agents, Biological Agents, and Associated Equipment Spacecraft Systems and Associated Equipment Nuclear Weapons, Design and Testing Related Items Classified Articles, Technical Data and Defense Services Not Otherwise Enumerated Directed Energy Weapons Submersible Vessels, Oceanographic and Associated Equipment Miscellaneous Articles Firearms, Close Assault Weapons and Combat Shotguns Guns and Armament Ammunition/Ordinance Launch Vehicles, Guided Missiles, Ballistic Missiles, Rockets, Torpedoes, Bombs, and Mines Explosives and Energetic Materials, Propellants, Incendiary Agents, and Their Constituents Vessels of War and Special Naval Equipment Tanks and Military Vehicles Aircraft and Associated Equipment Military Training Equipment and Training Protective Personnel Equipment and Shelters The ITAR includes 21 categories of defense articles.

11. ITAR Categories The ITAR Categories contain subcategories describing the controlled articles. Each category has a subcategory for: Components, parts, accessories, attachments and/or other associated equipment that have been specifically designed, developed, configured, modified or adapted for the articles listed in the category. Technical data and defense services directly related to the defense articles listed in the category.

12. ITAR-Controlled Technical Data �Technical Data� is: Information�which is required for the design, development, production, manufacture, assembly, operation, repair, testing, maintenance or modification of defense articles. This includes information in the form of blueprints, drawings, photographs, plans, instructions and documentation. Classified information relating to defense articles and defense services. Information covered by an invention secrecy order. Software directly related to defense articles. "Technical data" does not include: Basic marketing information on function or purpose or general system descriptions of defense articles. Information concerning general�scientific, mathematical or engineering principles commonly taught in schools, colleges and universities. Information in the public domain.� Determining what is and is not technical data can be challenging. Note importance of �required for� language. General guide � would it be considered proprietary in a non-academic environment? would you be asking the recipient to sign an NDA? Is it the �how to,� rather than the �what� information? Would it enable anyone to improve the design, development, etc. of their defense article? Determining what is and is not technical data can be challenging. Note importance of �required for� language. General guide � would it be considered proprietary in a non-academic environment? would you be asking the recipient to sign an NDA? Is it the �how to,� rather than the �what� information? Would it enable anyone to improve the design, development, etc. of their defense article?

13. Export Administration Regulations The EAR regulate exports of most commercial items. Items that are �dual-use� (commercial and military applications). Purely commercial items without an obvious military use. EAR controlled items are listed on the Commerce Control List (CCL) in EAR part 774, http://www.access.gpo.gov/bis/ear/ear_data.html The CCL has ten categories of controlled items, each of which has five subcategories, under which are various Export Control Classification Numbers (ECCNs) that describe the controlled items. Items subject to the EAR that are not elsewhere controlled in any category in the CCL are designated by the number EAR99. EAR99 items generally consist of low-technology consumer goods and generally do not require a license to export. Exceptions would be exports an embargoed country, to an end-user of concern or in support of a prohibited end-use, you may be required to obtain a license.

14. EAR Categories and Subcategories 0. Nuclear Materials, Facilities, and Equipment (and Miscellaneous Items) 1. Materials, Chemicals, Microorganisms, Toxins 2. Materials Processing 3. Electronics 4. Computers 5. Telecommunications & Information Security 6. Sensors and Lasers 7. Navigation and Avionics 8. Marine 9. Propulsion Systems, Space Vehicles, and Related Equipment The ten categories of items on the CCL are:

15. EAR-Controlled Technology Technology is specific information necessary for the �development�, �production�, or �use� of a product. The information takes the form of �technical data� or �technical assistance�. �Technical data� may take forms such as blueprints, plans, diagrams, models, formulae, tables, engineering designs and specifications, manuals and instructions written or recorded on other media or devices such as disk, tape, read-only memories Technical assistance may take forms such as instruction, skills training, working knowledge, consulting services. �Development� is related to all stages prior to serial production, such as: design, design research, design analyses, design concepts, assembly and testing of prototypes, pilot production schemes, design data, process of transforming design data into a product, configuration design, integration design, layouts. �Production� means all production stages, such as: product engineering, manufacture, integration, assembly (mounting), inspection, testing, quality assurance. �Use� means operation, installation (including on-site installation), maintenance (checking), repair, overhaul and refurbishing.

16. Licensing Requirements To determine licensing requirements, you must first determine which regime applies (�jurisdiction�) and into which category the item fits (�classification�). ITAR licensing requirements are much more stringent than the requirements under the EAR. EAR has many exemptions and allows shipment of many controlled items to most destinations without a license. ITAR has fewer exemptions and requires licenses for all controlled items to almost all destinations.

17. Jurisdiction for Controlled Items ITAR has jurisdiction over items that are �specifically designed, developed, configured, adapted, or modified for a military application� and either does not have either predominant civil applications or civil performance equivalent (defined by form, fit and function); or has significant military or intelligence applicability The intended use of the article or service after its export (i.e., for a military or civilian purpose) is not relevant in determining jurisdiction. EAR has jurisdiction over items that are not either ITAR-controlled or controlled under one of the other specialized regimes (FDA, DOE, NRC, etc.) If jurisdiction is unclear or there is a good argument for changing jurisdiction for an ITAR-controlled item, a Commodity Jurisdiction (�CJ�) Request can be filed with the State Department.

18. Classification & Licensing Once jurisdiction is determined, the next step is classification. All ITAR controlled items/data require a license to every destination unless an exemption applies. Licensing/authorization process can take several weeks to several months. EAR license requirements vary depending classification. Each Export Control Classification Number (�ECCN�) includes the specific reasons for control (e.g., missile technology, anti-terrorism, etc.). The reasons for controls determine which countries require a license or whether there is no license required (�NLR�). The EAR also prohibits exports to certain end-users and for certain end-uses.

19. Commerce Control List Sample Note the reasons for control � �Non-proliferation� and �Anti-terrorism�Note the reasons for control � �Non-proliferation� and �Anti-terrorism�

20. Note reason for control is AT � Anti-Terrorism.Note reason for control is AT � Anti-Terrorism.

21. Commerce Country Chart Sample Note the light controls on Canada versus the strict controls on China. 3A225 items can be sent to Canada, but not China, without a license. Note that none of these countries have AT (Anti-Terrorism) controls. 3A992 items do not require a license for any of these countries.Note the light controls on Canada versus the strict controls on China. 3A225 items can be sent to Canada, but not China, without a license. Note that none of these countries have AT (Anti-Terrorism) controls. 3A992 items do not require a license for any of these countries.

22. �Deemed� Export Licensing Release of �technology� or source code controlled by the EAR to a foreign national within the United States is subject to the �deemed export� rule, except encryption source code. Foreign nationals in the US may use any type of encryption source code and object code. Deemed export authorization is required when a U.S. person intends to provide technical assistance related to encryption technology to foreign nationals using source code. Licensing requirements may also apply to transfers of encryption software in the United States if the transfer is to an embassy or affiliate of a foreign country. The "deemed export" rule requires that you apply for a license when you intend to transfer controlled technologies to foreign nationals in the United States if transfer of the same technology to the foreign national's home country would require an export license.

23. �Deemed Export� Licensing The technologies controlled under the EAR are �development,� �production,� and �use� technologies listed in the CCL. EAR99 technologies are not controlled except to Cuban nationals and other sanctioned entities or for prohibited end-uses. �Use� technologies are only controlled if all six activities in the definition of ��use�� are present (operation, installation, maintenance, repair, overhaul and refurbishing). This is because the totality of those activities would provide the foreign national with enough knowledge to replicate or improve the performance capabilities of the controlled item Mere operation of a controlled item by a foreign national does not trigger the requirement for a deemed export license. The Deemed Export Rule does not apply to disclosures of ITAR-controlled technical data.

24. Exclusions, Exemptions, and Exceptions Public Domain information is not subject to export controls. The ITAR defines �public domain� as information which is published and which is generally accessible or available to the public: Through sales at newsstands and bookstores; Through subscriptions which are available without restriction to any individual who desires to obtain or purchase the published information; Through second class mailing privileges granted by the U.S. Government; At libraries open to the public or from which the public can obtain documents; Through patents available at any patent office; Through unlimited distribution at a conference, meeting, seminar, trade show or exhibition, generally accessible to the public, in the United States; Through public release (i.e., unlimited distribution) in any form (e.g., not necessarily in published form) after approval by the cognizant U.S. government department or agency; Through fundamental research in science and engineering at accredited institutions of higher learning in the U.S. where the resulting information is ordinarily published and shared broadly in the scientific community.

25. Exclusions, Exemptions, and Exceptions �Fundamental research� is �public domain� information that is not subject to export controls. Fundamental research is defined to mean basic and applied research in science and engineering, where the resulting information is ordinarily published and shared broadly within the scientific community, as distinguished from research the results of which are restricted for proprietary reasons or specific U.S. Government access and dissemination controls.� University research will not be considered fundamental research if:� the University or its researchers accept other restrictions on publication of scientific and technical information resulting from the project or activity, or the research is funded by the U.S. Government and specific access and dissemination controls protecting information resulting from the research are applicable. This exclusion applies to the technology arising during or resulting from fundamental research, not to the technologies required to conduct the research. Authorization may be required if during the conduct of the research controlled technology must be released to a foreign national.

26. Export Controls & Publications Under the ITAR, you can be penalized for publishing controlled technical data. Under the EAR, publicly available technology, including technology that is �made public by the transaction in question,� is not subject to the EAR. The only exception is that certain encryption software remains controlled regardless of its public availability. See Supplement No. 1 to part 734 of the EAR for an extensive list of questions and answers on Publications, Conferences, Educational Instruction, Research, Correspondence, and Informal Scientific Exchanges, and other technology control issues. Available at http://www.access.gpo.gov/bis/ear/pdf/734.pdf.

27. Export Authorization Process If the item you are exporting is controlled, you need some form of US Government authorization - a license, technical assistance agreement (TAA), or license exemption/exception - before the item can be exported. Export Licenses and TAAs are obtained by submitting a draft license or agreement and other appropriate paperwork to the relevant US Government Department (State, Commerce, or Treasury � not Defense) for approval. Exemptions/Exceptions can be used without going through the licensing process, though some require approval of the US Government Sponsor. Failure to obtain authorization from the relevant US government agency can result in large civil fines and, in extreme cases, criminal penalties. ITT and LM Sippican examples.ITT and LM Sippican examples.

28. Contact Information Jahna Hartwig, Associate General Counsel JHU Applied Physics Laboratory Tel: 443-778-5431 Fax: 443-778-5254 Email: jahna.hartwig@jhuapl.edu