Export Control Program Level 3 Training ITAR Information

Export Control Program Level 3 Training ITAR Information Management University of Wisconsin - Madison Tom Demke Export Control Compliance Officer SSEC Quality & Safety Manager Rev. -, 11/17/10, TAD 1

Export Control - Level 3 Training Agenda 1. What Is ITAR? 2. Why Do We Care About ITAR? 3. Definitions 4. a. Fundamental Research Exemption b. Public Domain c. Deemed Export d. US Persons Compliance a. Meetings w/ ITAR Information b. Means of Transferring Information c. Verbal Information d. Managing ITAR Paper Documents e. Managing ITAR Electronic Information f. Non-Disclosure Agreements g. Helpful Hints Rev. -, 11/17/10, TAD 2

Export Control - Level 3 Training WHAT IS ITAR? • International Traffic in Arms Regulations - 22 CFR 120 • Regulated by the US State Department • Purpose - Control the export of military equipment & information regarding military equipment • US Munitions List describes the equipment included under ITAR Rev. -, 11/17/10, TAD 3

Export Control - Level 3 Training WHY DO WE CARE ABOUT ITAR? • Controls exportation of arms to non-US persons • Exportation is defined as the transfer of equipment, goods, information or data • • Exportation can occur within the US - conferences, seminars Arms includes items such as: • Guidance systems for missiles - Category IV • IR focal plane arrays (detectors) - Category XII • Weaponized biological agents - Category XIV • Satellites & equipment on satellites - Category XV • Can include H/W, S/W, info, data, services, chemicals, biologicals • Responsibility to comply lies with individual, not UW • It is the individual’s responsibility to ensure they are not transferring ITAR-sensitive goods or data to non-US persons Rev. -, 11/17/10, TAD 4

Export Control - Level 3 Training Definitions Rev. -, 11/17/10, TAD 5

Export Control - Level 3 Training FUNDAMENTAL RESEARCH EXEMPTION • Fundamental Research Exemption • • Because of the multi-national nature of institutions like the UW, universities have been given an exemption from ITAR to conduct fundamental research that is in the public domain PI or PM needs to assess export control needs @ beginning of project Rev. -, 11/17/10, TAD 6

Export Control - Level 3 Training PUBLIC DOMAIN • Articles in trade journals, talks at seminars, poster sessions • Publishing information to the library or a publiclyaccessible website is considered acceptable c i l b u P n i a m o D • Public Domain: Information which is published & generally accessible or available to the public • Items/information in the public domain are not subject to export control • Publish “early & often” Rev. -, 11/17/10, TAD 7

Export Control - Level 3 Training PUBLIC DOMAIN (cont. ) • DO NOT accept limitations to publishing in the project contract • Public domain status cannot be claimed for information subject to a non-disclosure agreement (NDA) • Pay particular attention when working with industry partners Rev. -, 11/17/10, TAD 8

Export Control - Level 3 Training DEEMED EXPORT • Transfer of technology, including use of equipment, that has certain export restrictions to a foreign national in the US • This can include controlled information transferred to a foreign national at a conference within the US Rev. -, 11/17/10, TAD 9

Export Control - Level 3 Training US PERSON Status US Person U. S. citizen Yes U. S. national Yes Alien w/ green card (lawful permanent resident) Yes Alien lawfully admitted for temporary residence Yes (protected individual) Alien w/ work/study visa No Foreign visitors attending conferences/workshops No Alien admitted as a refugee Yes (protected individual) Alien granted asylum Yes (protected individual) Illegal alien No • Corporations, business associations, partnerships or other organizations incorporated to do business in US • Governmental entities Rev. -, 11/17/10, TAD 10

Export Control - Level 3 Training Compliance Rev. -, 11/17/10, TAD 11

Export Control - Level 3 Training PURPOSE (of the following measures) • Assure compliance with regulations • Prevent need for getting an export license • Prevent inadvertent transfer of controlled information to a foreign national Rev. -, 11/17/10, TAD 12

Export Control - Level 3 Training MEETINGS w/ ITAR INFORMATION Meetings Held Here • Reasonable notice to participants prior to meeting that ITARsensitive information will be discussed • Advise participants at beginning of meeting & just before ITAR-sensitive information is discussed • Only US Persons attend the ITAR session • Record of ITAR session • Who attended • What ITAR material was discussed • Forward record to your organization’s export control POC Rev. -, 11/17/10, TAD 13

Export Control - Level 3 Training MEETINGS w/ ITAR INFORMATION (cont. ) Meetings Held Elsewhere • Only US Persons attend the ITAR session • Contact organizational POC or UW ECCO if you have ITARrelated concerns before or after attending a meeting Rev. -, 11/17/10, TAD 14

Export Control - Level 3 Training MEETINGS w/ ITAR INFORMATION (cont. ) What Can Be Presented • Information in the Public Domain • Released materials (previously cleared for presentation) • New materials (exhaust 1 st two bullets before presenting new materials) • Can Be Discussed Cannot Be Discussed “What” “How” - defense service Specs & requirements Design trade studies Schedule, cost, status Procurement sensitive issues General drawings Design decisions Data expected (type, rate, timeliness) Technical problems & solutions Review Team - Each organization should have a review team, if you have questions about what you can present Rev. -, 11/17/10, TAD 15

Export Control - Level 3 Training MEANS OF TRANSFERRING INFORMATION Means of Information Transfer Verbal (or somehow exposed to it) Be aware of export requirements Printed (paper) Documents Electronic Information Use again? Encrypt or place in a passwordprotected folder Shred Send to librarian Rev. -, 11/17/10, TAD 16

Export Control - Level 3 Training VERBAL INFORMATION • Person transferring the information is responsible for ensuring that his/her audience can receive the information • Make sure the receivers are US Persons Rev. -, 11/17/10, TAD 17

Export Control - Level 3 Training MANAGING ITAR PAPER DOCUMENTS ITAR Sensiti ve • Maintain in a locked cabinet w/ a designated librarian • Authorized individuals may check out documents • US Persons • Exempted persons • Documents to be returned when no longer needed • Log of documents kept • Name of document, when received & from whom • Documents are stamped Rev. -, 11/17/10, TAD • While in use, documents need to be maintained in a manner to prevent inadvertent export 18

Export Control - Level 3 Training MANAGING ITAR ELECTRONIC INFORMATION • Documents, data, software • Files, folders or repositories should be marked ITAR-sensitive • Verify with source if unsure whether information is ITAR Type Of Electronic Information Downloaded Documents / Presentations Reviewed Information / Documents / Presentations Downloaded Electronic Files (data, software for evaluation, software for modification, restricted information) Issues • Means Of Control • • • Take special care Not downloaded; not printed Only US Persons or exempt persons shall use this information Maintain files locally (on user’s computer) as encrypted files Delete all non-encrypted files (temporary files, trash, e-mails) Large datasets or multiple users - contact IT • Protection during data processing runsfiles requiring computer clusters when using wireless to transfer 19 - contact IT • Rev. -, 11/17/10, TAD If printed, maintain paper copy in library as noted for paper documents

Export Control - Level 3 Training MANAGING ELECTRONIC INFO - PERSONNEL GUIDELINES • Recipient is responsible for destroying (delete & empty trash or temporary files) or encrypting the document • Use proper encryption tool • Password of sufficient complexity; do not use existing passwords • After use, either properly delete or re-encrypt them • Remove temporary files created by the application • Unencrypted Files Containing ITAR Information • DO NOT leave unencrypted files unattended on your computer • DO NOT leave unencrypted files in public areas or areas where other users may have access (i. e. , shared machines, ftp server, My Documents directory if synced to the Windows server) • DO NOT leave unencrypted files where they may be backed up • DO NOT e-mail unencrypted files Rev. -, 11/17/10, TAD 20

Export Control - Level 3 Training NON-DISCLOSURE AGREEMENTS (NDAs) • NDAs may be used in an ITAR-related project • However, because you have a NDA does not mean you have an ITAR • Public domain status cannot be claimed for information subject to a NDA • Talk to your PI or PM whether the subject information is really needed • Individuals do not sign NDAs, the UW does • Forward requests for NDAs to department administration • Department administration forwards the NDA to UW Legal for review & signature Rev. -, 11/17/10, TAD 21

Export Control - Level 3 Training HELPFUL HINTS • Ensure ITAR-sensitive paper & electronic information are secure • ITAR-sensitive information should be labeled • • All ITAR-sensitive information that we have contact with should have its origin outside of the UW • • However, verify if you are unsure We should not be the original source for any ITAR-related data Notify management of issues • Publication restrictions • NDA’s • ITAR sessions at meetings • Limit contact with ITAR-sensitive information • DO NOT supply ITAR-sensitive information to a person unless you know they are a US Person or exempt person Rev. -, 11/17/10, TAD 22