Essentials of University Export Controls and Restricted ...

2 October 2018

Office of Export Controls (OEC)Office of Research Integrity and Compliance (ORI)

Essentials of University Export Controls and Restricted Research

Agenda• Introduction to Export Controls

• What is an export? What is controlled?• Export Controls and Academic Research

• Fundamental vs. Restricted Research• Export Controls and Project Lifecycle

• Export Controls at CU-Boulder• Policies• Procedures

• Questions and Discussion

What is Export Compliance?

• US Government restricts the release of certain technology, hardware, software and services to foreign nationals and foreign entities

• US national security • US/Allied military superiority• US foreign policy enforcement

• Trade sanctions, embargoes• Prevention of Weapons of Mass Destruction (WMD)

• Biological, Chemical, and Nuclear weapon proliferation• Economic and Intellectual Property (IP) protection

• Billions of dollars lost every year to foreign economic espionage and copyright infringement

Export Control Governing Bodies

Other Export Control Regimes• Office of Foreign Assets Control (OFAC)

• Department of the Treasury• Administers and enforces economic and trade sanctions based

on US foreign policy• CUBA, IRAN, NORTH KOREA, SYRIA, SUDAN

• Office of Anti-Boycott Compliance• Administered by the Department of Commerce/EAR• Arab League Boycott of Israel• Reporting requirements

• Foreign Corrupt Practices Act (FCPA)• Department of Justice• Anti-Bribery Provisions

Restricted Parties• USG also prohibits export and denies services to

individuals and entities on restricted party lists• Can be a public (NGO or government) or private (business)

entity or an individual• US persons and companies can be on restricted party lists!

• Restricted Party Screening (RPS) required before any export

• Specially Designated Nationals (SDN) – OFAC• GSA List of Excluded Parties• FBI Most Wanted• Department of Commerce Denied Parties• Department of State Debarred Parties

What is controlled?• “Commodity” – Hardware or other goods controlled via the

EAR (CCL) or ITAR (USML)

• “Software” – Software enumerated on the CCL or USML, or software needed for the operation of items on the CCL or USML

• “Technology” or “Technical Data” – information needed for the design, development, or use of an item on the CCL or USML

• “Services” – furnishing of assistance in the design and development of items controlled under EC regulations

What is controlled?• Physical shipment of hardware/items out of the United States

• Permanent and temporary shipments• Traditional shipments vs. “hand-carry”

• Transfers of information and technology to persons and entities outside of the United States

• Verbal, written, electronic, and visual disclosures are exports

• “Deemed” exports – technology disclosure to foreign nationals located in the United States

• Very common in academic settings

• OFAC embargoes: Cuba, Iran, North Korea, Syria, Sudan• All exports, financial transactions, services

“US Person” vs “Foreign National”

• “US Person”• Native born citizen or naturalized citizen• Legal permanent resident of United States• Any US company or organization (legally incorporated in the US)• Any US Government entity (federal, state, or local)

• “Foreign National”• Any person with foreign citizenship• Visa holders• Foreign companies and foreign government agencies• Any US person working/representing foreign company or

foreign government

Export Violations – Not Worth It!

• Penalties and jail times levied against entity and individual

• Civil and criminal charges• Loss of entity licensing and export

privileges• Debarment from federal funding• Negative impact on reputation and

branding

Export Violations – Not Worth It!IRAN SPONSORED CYBER THEFT(2014 - 2018)

SPEARPHISHING ATTACKS – 30 TERABYTES STOLEN FROM 144 UNIVERSITIES

IOWA STATE UNIVERSITY (2015) ITAR VIOLATIONS – STUDENT ARRESTED AND DEPORTED

UMASS LOWELL (2013) EAR99 TO RESTRICTED PARTY --USD 100,000 FINE AND PROBATION

GEORGIA TECH UNIVERSITY (2009)

US WEAPONS TECHNOLOGYACCESSED BY NATIONALS OF 36 COUNTRIES

UNIVERSITY OF TENNESSEE (2008)

PROFESSOR SENTECED TO FOUR YEARS IN PRISON

Scenario #1• A PI wants to submit a proposal to work with a

research lab associated with a university in Tehran, Iran. Should this work be flagged for export controls?

• YES! Iran is subject to strict OFAC embargoes. Export of any kind to OFAC embargoed countries cannot occur without explicit authorization from the United States government.

Scenario #2• A researcher receives an award from the United

States Navy to conduct research on antennas and radar systems used for military applications. The professor wants to use Chinese and German research associates on the project. Should this project be flagged for export controls?

• YES! Items developed to military specifications or for military end-use are ITAR controlled and have strict restrictions on foreign national access.

Most academic research is not subject to export controls, BUT…

• Need to account for and address:• International students and faculty• International shipments, travel, and hand-carried

items• Contractual clauses related to controlled research

and publication restrictions• Fundamental research and educational efforts• Technology Control Plans and controlled labs

Fundamental Research and Export Controls

• Fundamental research in STEM (science, technology, engineering, mathematics) on academic campuses has a lot of overlap with export controlled technologies

• Information to be published and shared among wider scientific and engineering communities and available in the public domain is EXEMPT from export controls.

Credit: Don Sliget, defensetradelaw.com

Fundamental Research Exclusion (FRE) Criteria

• Science, mathematics and engineering research at accredited institution of higher learning in the United States

• Only basic and applied research is eligible for the FRE

• Researcher must be free to publish and have the intention to publish

• No restrictions on participants (e.g. clearance levels, foreign national restrictions)

• IMPORTANT: Fundamental Research Exclusion applies ONLY to publishable results and information. The FRE DOES NOT apply to equipment!

Basic Research

• No commercial objective or specific outcome

• Expansion of knowledge

Applied Research

• Knowledge derived from basic research to explore possible solutions for specific needs

Research Development

• In-depth study of specific need

• Prototyping

• Processes and Methods

Demonstration• Actionable

results

• Patents and

• Production and manufacturing

The FRE only applies to the BASICand APPLIED stages of research!

Information NOT Considered Basic or Applied

• Advanced Technology Development• Design Methodology

• Advanced Component Development• Engineering Analysis• Manufacturing Know-How• “Specially Designed” for space and military use• Prototyping• Partial or Full-Scale Commercialization

Protecting Fundamental Research• Restriction on research participants

• Clauses barring foreign nationals or requiring export authorization for foreign involvement

• AFMC 5352.227-900 – Export Controlled Data Restrictions• “An export license is required before assigning any foreign source

to perform work under this contract or before granting access to Foreign Persons or any equipment and technical data generated or delivered during performance.”

• Restriction on research publication or dissemination• Clauses restricting the release of information about the research or the

research results• DFAR 242.204-7000 – Disclosure of Information• “The Contractor shall not release to anyone outside the

Contractor’s organization any unclassified information…pertaining to any part of this contract related to this contract unless 1) the contracting officer has given prior written approval; or 2) the information is otherwise in the public domain”

Education Instruction Exclusion

• ITAR• Technical data relating to general scientific,

mathematical, or engineering principles commonly taught in schools, colleges, and universities or information in the public domain

• EAR• Information released by instruction in catalog

courses and associated teaching laboratories of academic institutions

The Importance of “Public Domain”• Export regulations define public domain as

published information generally accessible or available to the public

News stands and book storesUnrestricted subscriptions and second class

mailing privilegesLibraries and patentsDistribution at conferences, exhibitions, trade

shows open to the publicPublic release (UNLIMITED DISTRIBUTION)

with US Government APPROVAL

Restricted Research• Restricted Research is any research subject to US export controls

or research for which the sponsor limits access, participation, or dissemination of the work or research results.

• Restricted research includes but is not limited to:• Classified research• Designated unclassified information

• “Sensitive”, “non-releasable unclassified”, “Covered Defense Information” (CDI), “Controlled Unclassified Information” (CUI)

• Research and results that require sponsor approval prior to publication

• Research and results where the sponsor requires review (more than 90 days) before publication

Restricted Research

• CU attempts to maintain fundamental research throughout award negotiations

• If clauses restricting participation or publication cannot be removed, PI must submit petition

• Faculty Committee on Restricted, Proprietary, and Classified Research (FCRPCR)

• FCRPCR will review petition and make recommendation to the Vice Chancellor for Research

Restricted Research• Following FCRPCR review and petition, PI may be

required to:• Develop contingency plans for individuals impacted by

publication restrictions (such as students or junior faculty)

• Documentation of informed consent by all project members

• Classified research• CU boulder is a “non-holding facility” – cannot

conduct classified work on campus or store classified information (either physically or on campus IT infrastructure)

Scenario #3• A PI receives a subcontract award from a defense

contractor to conduct applied research on military satellites. There is a flow-down clause in the award barring foreign nationals from working on the project. Is this project eligible for the Fundamental Research Exclusion (FRE) under export control regulations?

• NO! Even though applied research is eligible under the FRE, the clause restricting research participants undermines the exclusion.

Scenario #4• A researcher agrees to a project that has a

classified component. While the researcher’s work is non-classified, the project award requires sponsor review and approval before publication. Is this project eligible for the FRE?

• NO! Clauses allowing for long review delays or requiring approval for publication is not fundamental research according to export control regulations.

Scenario #5• Is the “NASA Restrictions on Funding Activity

with the Peoples Republic of China (1852.225-71)” a foreign national restriction?

• Not necessarily. This is a funding restriction, not a participation restriction. However, many EAR space technologies (and all ITAR space technologies) are controlled to China.

Proposal Stage

• RPS screenings• Export classifications and proposal review• SOW reviews

Award Stage

• Contract clause review• License submittal• Technology Control Plan implementation• Personnel: International collaboration, foreign national participation, H1-B attestations

Project Duration

• International travel review• International shipments• License approval and implementation• Restricted research contingency plans

Project Closeout

• Publication review• Hardware disposal• Cybersecurity protocols (wiped electronics)• License return

Export Controls – Proposal Development and Submission

• Proposal Stage• PSR Form

• Assists PI and OEC in determining export control concerns as early as possible

• Strategic planning for licensing, shipping, and referrals to the FCRPCR

• Red flags:• International collaboration (requires RPS screening)• Military sponsors• Publication restrictions or CUI designations• Security clearances or other access requirements• Engagement with OFAC countries

Additional guidance available on the OEC website: “Working with the Office of Contracts and Grants”

Export Controls – Award Stage

• Contract award negotiationClauses with export control implications

• Export Control Certifications• Accessing Export Controlled Material• Physical and Information Security (Cybersecurity)• Employee Restrictions

• Exemptions may be available for full-time employees of the University, but does not apply to undergraduate, graduate or post-doc students

• Publication restrictions• Referral to University of Colorado Boulder Restricted

Research Committee

Export Controls – Award Stage• Red Flags – Contracts and Grants

• Large international travel budget (international collaboration/field research)

• International shipping budget• Restriction on participation• SOW for testing or manufacturing rather than research

• Licensable activities• International shipment of controlled equipment or technology• Services to foreign nationals for the design, development and use of

controlled equipment or technology• Collaboration with foreign nationals on controlled technology or hardware

in the United States• Engagement with any OFAC sanctioned country

Export Controls – Award Stage• Technology Control Plans (TCPs)

• Security requirements to meet specific award clauses and University policies

• Physical Security• Controlled lab space• Personnel identification and restricted party screening• Item and information marking, secure storage• Training requirements

• Information (IT) Security• Restricted server access• Virtual machines• Digital storage

• Important: A TCP is NOT an export license. A TCP secures hardware, software and information. It does not authorize export!

H1-B Reviews• CU Boulder H1-B Export Control Attestation

• Certification from US employer that visa worker will or will not have licensable access to controlled technology

• Department of Homeland Security (DHS) requirement• Part of H1-B and O-1 visa applications

• Effective September 2017 – CU Boulder moved from paper-based worksheet to online submission and review process

• Visual Compliance I-129 First Time Log-In Guide• Visual Compliance I-129 User Guide

Visiting Scholars• Export controls also apply to visiting scholars!

• Will visiting scholar have access to controlled technology?

• Will visiting scholar have access to intellectual property?• Generally not applicable to guest lecturers

• Export Controls Visiting Scientist Agreement• Online process• Allows OEC to review activity and determine compliance

requirements• RPS• Licensing• Access needs

Export Controls Review Process

Export Assessment and Follow Up Actions

Export Requirements

Participants and Access

Needs

Technology Classification and Level of

Control

Award Review Outcomes• OEC reviews concerns – determines no export control issues present and

OCG can accept that award• Award clauses are acceptable• Export control requirements are already in place (e.g. TCP)

• OEC reviews concerns – determines that the award requires further action but OCG can accept award

• Requires future TCP creation• License submittal for physical exports or collaboration in later project stage

• OEC reviews concerns – determines that award requires further action before OCG can accept award

• License required for immediate exports or immediate foreign collaboration• Restricted, Proprietary, and Classified Research Committee and awaiting

response

• OEC reviews concerns – encounters a hard stop (very rare)• Clauses or requirements are too restrictive/burdensome, PI does not accept• Lab/facility cannot accommodate security requirements• Denied or otherwise restricted parties are involved

Scenario #6• A PI receives an award from DARPA. The SOW states that

the PI will be using Unmanned Aerial Vehicles (UAV) classified as EAR controlled. The PI will need to export the UAVs and associated equipment to India for two field tests. There are no publication restrictions.

• What are the potential export control actions?• Technology Control Plan for EAR UAVs• License approval required for hardware export

Scenario #7A PI receives an award with a contract clause restricting foreign national involvement without an export license – what are the University’s options when accepting the award/clause?

• Technology Control Plan – restricting access to only authorized US persons

• USG license authorizing export of technology to foreign national participants

Export Controls –Project Duration

• Restricted Research Contingency Plans• Contingency plans are required when publication

restrictions cannot be removed and restricted research is approved by FCRPCR

• Contingency plans ensure measure are in place to mitigate chances of Ph.D. dissertation or Master thesis from being embargoed, denied publication, or delay of degree completion

• Acknowledgement of Informed Consent confirms that all research participants understand requirements

Export Controls –Project Duration

International Shipments• Many exports, including items in furtherance of

fundamental research, require authorization for export outside of the United States

• Both permanent and temporary (returning) shipments apply

• Licensing can take up to 18 months to obtain!• OEC responsible for drafting and submitting license

application.

• In some cases, license exemptions apply. OEC will prepare appropriate paperwork.

Export Controls – Project Duration

International Shipments• Please contact the Office of Export Controls before

shipping internationally!• Restricted Party screenings still required even if

hardware is not controlled (remember UMASS Lowell!)

• OEC and other shipping partners can provide additional guidance as necessary.

• CU-Boulder Shipping and Mailing Services• EH&S• OCG Property

Scenario #8• A researcher needs to send satellite reaction wheels

for repair to an aerospace company in Toronto, Canada. The reaction wheels would return to the United States once repaired. Does the researcher need to contact the Office of Export Controls?

• YES! Canada is a foreign country, and the reaction wheels are likely controlled. In this case, OEC would conduct the restricted party screening of the Canadian company and then draft paperwork for the temporary export.

Export Controls –Project Duration

International Travel• OEC reviews international travel via Concur

Travel and Expenses System and OEC International Travel Portal

• High Risk Countries• Export Controlled Equipment

Export Controls –Project Duration

International TravelUniversity of Colorado High-Risk Countries

Afghanistan Iran North KoreaAlgeria Iraq SomaliaBurma Libya South SudanCentral African Mali SudanRepublicCuba Libya SyriaDemocratic Republic Niger YemenOf Congo

Export Controls –Project Duration

International Travel• “Hand Carry”

• Instruments and other equipment in checked baggage are still exports!

• May require license or exemption

• Loaner Laptops• In some cases, OEC and OIT may recommend a

“clean” laptop• OFAC countries• Active license or TCP

Export Controls –Project Close Out

• Hardware disposal, transfer or donations• In accordance with OCG Property Protocols and

TCP requirements

• Cybersecurity• Wiped electronics and server allocation

• USG licenses must be returned once exports or transfers are complete

Summary• USG regulates the exports of certain technology, hardware and services

under the ITAR, EAR, and OFAC• Licenses and access restrictions may apply

• Basic and applied research is not subject to export control regulations under the Fundamental Research Exclusion (FRE)

• FRE has specific criteria and can be undermined by clauses or requirements that restrict foreign nationals or publication

• Export control red flags include:• International sponsors and collaboration• Military and space-related technology• International shipments and travel

• The Office of Export Controls is the primary contact for export control concerns on campus. Feel free to contact us at any time!

Resources• Restricted Research

• CU Boulder Restricted, Proprietary, and Classified Research

• Academic Affairs Policy on Openness in Research

• Proposal/Award Guidance• “Determination of Restricted or Controlled Activities” PSR

Guidance• Technology Export Control Plan Guidance

• CU Boulder Office of Export Controls• OIT International Travel Loaner Laptop Request

Form

Contact InformationLinda Morris

Export Controls [email protected]

303.492.2889

Katherine MillsExport Controls Analyst

[email protected]

[email protected]