Question: Thanks for the heads-up last week about the compliance risks of storing sensitive data in the cloud—and the good news that regulatory changes may be ahead. Are there other revisions to the EAR and ITAR in the works that are likely to impact my company’s policies for safeguarding export-controlled technology and technical data? As I look at the Proposed Rules published by State and Commerce on June 3, I get the impression that they’re mostly about definitions—clarifying the meanings of certain technical terms. How important is all that stuff, practically speaking, to a firm like ours?
Very important. Compliance requirements and potential violations often hinge on the definition of a single word! So you really need to review these proposed new definitions carefully—both the Commerce Department’s proposed revisions to the definitions in the EAR and the State Department’s proposed revisions to definitions in the ITAR— to determine what impact they would have on your operations and compliance obligations, should they be adopted.
As I’m sure you’re well aware, U.S. export controls under the ITAR for defense articles and services contrast sharply with the (generally) more liberal controls under the EAR for “dual-use” commodities, software, and technology. For that reason, it’s critically important that you determine accurately whether or not the items or technical data you plan to ship or transfer internationally are subject to ITAR controls. Making that jurisdictional determination requires paying careful attention to the current USML and the appropriate categories within the USML that apply to the export in question.
That’s one of the reasons it’s also vital that you follow closely all the recent changes that have been made to the USML—and the “600 series” ECCNs of the CCL— due to the ongoing Export Control Reform initiative, as well as those changes that are still being made. And that most emphatically includes proposed revisions to the definitions of terms!
The Proposed Rule published by the DDTC on June 3 is notable for its length (14 pages of hard copy in the small print of the triple-columned Federal Register) and for the unusually large number of revisions to the ITAR that are proposed. It contains a plethora of new definitions for regulatory terms, making it a veritable dictionary. Many of the proposed revisions are meant to harmonize the ITAR rules with those of the EAR. The BIS published a similar Proposed Rule with conforming amendments.
The key terms and phrases that would be redefined, clarified, updated, or adopted under the June 3 Proposed Rules include the following:
Technology
Technical Data
Public Domain
Fundamental, Basic, and Applied Research
Development
Production
Required
Defense Article
Defense Service
Characteristics and Functions (of an item)
Peculiarly Responsible
Export
Reexport
Release
Transfer (in-country)
Retransfer
End-to-end Encryption
For exports controlled by the ITAR, two of the proposed new definitions are especially noteworthy: “public domain” (vs. “technical data”) and “defense service.” That’s because these definitions potentially apply to every single category of the U.S. Munitions List.
We’ll take a closer look at the first of these this week, and discuss the second and more controversial of the two in a future post.
Revisiting “Public Domain”
The State Department proposes to revise the definition of “public domain” in ITAR Section 120.11 in order to simplify, update, and introduce greater versatility into the definition. The current version of ITAR Section 120.11 enumerates the ways in which “public domain” information might be published. State says that it now believes that defining “public domain” by a list such as this is unnecessarily limiting in scope and insufficiently flexible, given the continually evolving array of physical and electronic media and communication technologies by which information can be disseminated. The new definition they propose is intended to be more versatile than the list-based approach to identifying public-domain information sources.
Under the State Department’s proposed revisions to definitions in the ITAR, unclassified information and software are considered to be in the public domain—and thus not technical data or software subject to the ITAR—“when they have been made available to the public without restrictions upon their further dissemination such as through any of the following . . . .” Among the means of dissemination mentioned, 120.11(a)(4) is of special interest, as it includes in the “public domain” information available on publicly accessible web sites:
(4) Public dissemination (i.e., unlimited distribution) in any form (e.g., not necessarily in published form), including posting on the Internet on sites available to the public;
There are some important qualifications that should be carefully noted, however.
One well-known consequence of the open, uncontrolled nature of the internet is that a vast amount of information can be found online that was uploaded illegally, in violation of a wide range of national and international laws governing copyrights, patents, privacy, public safety, national security, and many other matters. Plainly, the discovery of certain technical data, information, or software on a web site carries no guarantee that the individual or organization posting it hasn’t done so in violation of U.S. export laws and regulations.
With regard to such contingencies, a note to the proposed revision to ITAR Section 120.11 warns that anyone exporting, reexporting, or retransferring export-controlled information found on the internet, or otherwise making it available to the public, will be committing an export violation.
Taken together, the new definition and the warning that accompanies it raise the specter of inadvertent illegal exports of ITAR-controlled technical data by U.S. exporters who had no reason to suspect that the information they were making use of was not in the public domain, given that it was already freely available to the public via the internet. Evidently foreseeing this concern, the DDTC immediately reassures exporters, in a second note to the new Section 120.11, that in such cases a person will not be considered guilty of an export violation . . . unless — as described in the revised Section 127.1(a)(6) — “such person has knowledge that the technical data or software was made publicly available without an authorization.”
But here’s the rub: how can your company be certain that any item of technical information found on the internet was properly cleared for public release before being uploaded? And if your company should inadvertently disseminate technical data that later turns out to have been controlled by the ITAR and uploaded to the internet by somebody else without DDTC authorization, how would you be able to prove that you did not “have knowledge” that it was export-controlled? Those are just a few of the questions and concerns that have been raised about the language of this proposed revision to ITAR Section 120.11. Discussions of these concerns between the regulatory agencies, the defense industry, the research universities, and the legal community are ongoing. It is possible that the language in the Proposed Rules will be revised as a result of those discussions. Whenever the DDTC and BIS publish their Final Rules on the definitions of these key terms — possibly within the next few months — we may find that some of these points have been addressed and further clarified.
Stay on the Safe Side
Be that as it may, here is what we recommend to you as the safest policy and procedure for your company under the current regulations — and none of the revisions currently under consideration by the DDTC or BIS is likely to change this greatly: before posting to the internet any technical information about your company’s products or research, other than non-proprietary general system descriptions or information on the basic function or purpose of an item, thoroughly review the USML and the CCL to determine if the information falls under U.S. export controls. If there is doubt about export jurisdiction, request a Commodity Jurisdiction determination from the DDTC; and if State should determine that ITAR controls apply, obtain an export license for the technical data, or request authorization for “release” of the document you want to post online from the appropriate agency, as described in Section 120.11(b).
Remember that knowingly uploading controlled technical data to the internet without appropriate authorization is a export violation that could have extremely serious penalties and consequences, for both you and your company, whether or not there is any evidence that a foreign national has read or downloaded the data. Don’t needlessly put yourself and your company at risk.
Paragraph (b) of the revised definition explicitly sets forth the DDTC’s requirement of authorization to release information into the “public domain.” This requirement is not new: it also exists under the current rules; the revised rules would state it more explicitly and amend some definitions to clarify the scope of the information covered, but the requirement is already there. Before you can make such information available, the U.S. Government must approve the release through one of the following agencies: (1) The State Department’s DDTC; (2) the DoD’s Office of Security Review (OSR); (3) a relevant U.S. Government contracting authority, if one exists, with the authority to allow the technical data or software to be made available to the public; or (4) another U.S. Government official with the proper authority for this.
In many cases, we believe that requesting a security review by the OSR will be the best and wisest route you can take in order to safeguard your company against the risk of an export violation. Guidelines for submitting documents for review can be found on their web site.
The experienced compliance professionals at Export Compliance Solutions (ECS) are well-positioned to advise you regarding the impact that the revised definitions in the June 3 Proposed Rules are likely to have on your operations and corporate export compliance programs, and to assist you with other export control issues as well. Our consultants frequently work with ECS clients to review their current classification policies and procedures, conduct large-scale or multi-national classification projects, train employees in navigating complex reporting and recordkeeping requirements, discover ways to enhance and streamline administrative processes, and more effectively implement internal compliance audits and assessments. As America’s premier trainers and consultants in EAR and ITAR compliance, we can help you make sure that your company maintains full compliance with the changing Commerce and State Department regulations.