Research
Administrators
Forum
Wendy M. Epley, ECoP® – EAR & ITAR
June 19, 2015
Wendy M. Epley
Export Compliance Professional (ECoP®) – EAR & ITAR
Import & Export Compliance Officer
Office of Compliance & Risk Management
285 Mercer Street, 5th Floor
New York, New York 10003
Direct: (212) 998 – 6884
Email: [email protected]
Why Do We Need A Regulatory Trade Compliance Officer?
•
NYU is a Global University
•
NYU is affected by more than just U.S. laws
and regulations
•
Regulatory trade affects more than just
research
•
Not all research is Fundamental
•
“Deemed Export” rule
•
“Exporting” affects tangible and intangible
items
19-June-2015
3
Regulatory Trade Compliance Partners
Office of the
President
Information
Technology
Services
Office of
General
Counsel
Office of
Sponsored
Programs
Sponsored
Programs
Administration
Import &
Export
Compliance
Officer
Procurement
Logistics
Environmental
Health & Safety
Internal Audit
Office of
Global
Services
19-June-2015
Continuously Adding Partners
4
Help Is On The Way!
19-June-2015
•
Website – Topic Specific Pages
•
iLearn Training Modules
•
Specialized Training
•
Personal Attention
•
CITI Program (www.citiprogram.org)
5
Introduction to
Export Controls
EAR vs. ITAR
EAR = Export Administration Regulations
ITAR = International Traffic in Arms Regulations
CCL = Commerce Control List
5-digita Alphanumeric sequence
(e.g., 7A994, 5D103, 3C600, EAR99)
USML = U.S. Munitions List
Roman numeral sequence
(e.g., VII(i), XI(d), IV(e))
DoC = Department of Commerce
BIS = Bureau of Industry & Security
DoS = Department of State
DDTC = Directorate of Defense Trade Controls
Items may or may not require a license – it depends.
Items will always require a license, even for transits
through international waters.
19-June-2015
7
The “Deemed Export” Rule
“The export of technology or source code (except encryption
source code) is “deemed” to take place when it is released to a
foreign national within the United States.” (§734.2(b)(2)(ii))
•
Applies to foreign nationals of all countries
o
o
o
A Foreign National / Foreign Person is someone who is not a U.S. Citizen, U.S.
Permanent Resident, or Protected under Refugee / Asylum status.
Applies to entities who are not a U.S. company as well as foreign governments and their
agencies.
Deemed export authorization required for encryption technology when a U.S. person
intends to provide technical assistance to foreign nationals using source code.
•
Not just a U.S. regulation
•
Affects all NYU campuses and global sites
•
Can affect grad students dissertation / thesis
•
Can affect staffing for departments and research projects
19-June-2015
8
The “Cloud”
BIS: Provision of cloud computing services is not subject to export controls
•
The provider of the cloud computing service is only providing a service; not exporting.
•
The could provider in the US generally is not the exporter of any data that users place on and retrieve
from the online account. (Provider does not receive ‘primary benefit of the transaction’)
•
The cloud provider does not need a “deemed export” license for foreign national IT administrators who
service and maintain the systems.
The cloud user would be the exporter and is 100% responsible for any export violation.
19-June-2015
9
Embargoed Countries
•
Embargoed Countries: Cuba, Iran, N. Korea, Sudan, Syria.
•
May 29, 2015 – Cuba removed from U.S. Department of State’s
Terrorist List.
•
Embargoes prohibit ALL imports and exports without government
authorization, including services.
•
NYU personnel traveling to Iran.
•
Research and Academic activities taking place in or near
embargoed countries.
19-June-2015
10
International Travel
•
Restrictions / Prohibitions from the U.S.
•
•
•
•
•
Restrictions / Prohibitions from other countries.
•
•
•
•
Taking University-owned Laptops
Research data
Source code / object code
ITSR / CACR
Importing - animals / animal products / vitamins or Rx
Encryption technology
Required certifications / analysis
ATA Carnets
•
•
•
Almost all types of goods can be transported under the ATA Carnet
Used for goods that are exported temporarily and then re-imported
85 countries and territories located in Europe, North America, South
America, Asia, Africa and Oceania
19-June-2015
11
Exclusions for Universities
Published Information (EAR) / Public Domain (ITAR)
• “technology” or “software” has been made available to the public without restrictions upon its
further dissemination through various sources available to the public without restriction.
• Published encryption software remains subject to the EAR unless the object code meets the
criteria specified in the regulations. (§740.13(e))
• Technical data or software, whether or not developed with government funding, is not in the public
domain if it has been made available to the public without an authorization from DDTC. (§120.11)
Education Information
• Not subject to the EAR if it is released by instruction in catalog courses and associated teaching
laboratories of academic institutions. (§734.9)
• Dissertation research is subject to regulations of “university based research.” (§734.8(b))
19-June-2015
12
Exclusions for Universities
Fundamental Research Exclusion (FRE)
• §734.8(c) and §120.49(c) – “Technology” that Arises During, or Results from, Fundamental
Research.
• “Fundamental research means basic or applied research in science and engineering, the results
of which ordinarily are published and shared broadly within the scientific community. This is
distinguished from proprietary research and from industrial development, design, production, and
product utilization, the results of which ordinarily are restricted for proprietary or national security
reasons.”
• 5 Criteria Must Be Met:
1. No Restrictions on Publication (verbal or written);
2. No Restrictions on Foreign Nationals (verbal or written);
3. Basic or Applied Research;
4. Research does not constitute “industrial development, design, production and product
utilization”; and
5. Is conducted at an accredited institution of higher learning in the United States.
19-June-2015
13
Restrictive Clauses
•
•
•
•
•
•
•
•
•
•
Certain research agreement provisions may negate the FRE.
Can be flowed-down from the Prime even though the work being performed applies to FRE.
Can affect grad students using material in thesis/dissertation and ultimately affect ability to graduate.
Can pose a hardship on supplying qualified talent to perform the research activities required.
Specific access and dissemination controls may be buried within the language of Federal Acquisition
Regulations (FARs), Defense Federal Acquisition Regulations (DFARs), and other agency-specific
regulations included as part of a prime contract or flowed down in a subcontract.
November 18, 2013 – New Rules & Regulations regarding DFARs in effect. Tighter controls and
requirements for safeguarding unclassified controlled technical information.
March 2014 – Department of Energy Acquisition Regulations (DEAR) to add export control
requirements, including subcontracts.
Foreign Military Financing and Defense Security Cooperation Agency (DSCA).
NASA China Disclosure. (Public Law 112-55, Section 539(a))
Restricted / Debarred Persons and Entities.
Restrictions can appear in BAA’s and other proposal submission announcements.
19-June-2015
14
Restrictive Clauses
Without limiting the generality of the foregoing, RECIPIENT
understands and acknowledges that DISCLOSER is subject to
regulation by agencies of the U.S. Government, including but
not limited to, the U.S. Department of Treasury which prohibit
the sale, export or diversion of products and technology to
certain countries, namely, Syria, North Korea, Burma
(Myanmar), Iran, Sudan and Cuba. RECIPIENT hereby
warrants that it shall not provide or sell, directly or indirectly,
INFORMATION to any party which it knows or reasonably
should know will resell or export the INFORMATION to parties
in the above named countries. Furthermore, any and all
obligations of DISCLOSER to provide INFORMATION, as well
as any other technical information and assistance, is subject to
United States laws and regulations which govern the license
and delivery of technology and products abroad by persons
subject to the jurisdiction of the United States, including without
limitation the Export Administration Act of 1979, as amended,
any successor legislation, and the Export Administration
Regulations issued by the Department of Commerce, Bureau of
Industry and Security. RECIPIENT agrees to cooperate with
DISCLOSER in order to maintain compliance with the
applicable export regulations.
19-June-2015
15
Risky Research
Research / Projects Types of Risk
• CyberIntelligence
• Travel to / Collaboration with Nationals of:
• Explosives
Afghanistan, Belarus, Burma, China, Ivory
• Marine Research beyond 12 nautical mile limit
Coast, Cyprus, Congo, Eritrea, Fiji, Haiti, Iraq,
• Nanotechnology
Krygyzstan, Lebanon, Liberia, Libya, Somalia,
• Navigation / Inertial Systems
Sri Lanka, Venezuela, Vietnam, Zimbabwe
• Use of optics / high-energy lasers
• Product innovations / Enhancements
• Travel to / Collaboration with Nationals of
• RADAR
embargoed countries: Cuba, Iran, Syria, Sudan,
• Remote Sensing
North Korea
• Satellites / Satellite Images / Satellite Data
List of Countries Subject to Change
• SBIR / STTR (small business innovation
research / tech transfer)
List is not inclusive
19-June-2015
16
Dual-Use Research of Concern
U.S. Government Policy for Oversight of Life Sciences Dual Use Research of Concern – released 3/2012; updated 2/2013
U.S. Government Policy for Institutional Oversight of Life Sciences Dual Use Research of Concern – effective 8/2015.
o
o
o
o
Applies to:
 all federal agencies
 institutions receiving federal funding
 institutions conducting research that meets the definition of DURC, regardless of funding source.
Limited to:
15 Select Agents / Toxins; 7 Categories of Experiments
Categories of Experiments (Effects)
Enhances the harmful consequences of the
o
Alters the host range or tropism of the agent or
agent or toxin.
toxin.
Disrupts immunity or the effectiveness of an
o
Enhances the susceptibility of a host population
to the agent or toxin.
immunization against the agent or toxin without
clinical and/or agricultural justification.
Confers to the agent or toxin resistance to
clinically and/or agriculturally useful prophylactic
or therapeutic interventions against that agent
or toxin or facilitates their ability to evade
detection methodologies.
Increases the stability, transmissibility, or the
ability to disseminate the agent or toxin.
19-June-2015
o
Generates or reconstitutes an eradicated or
extinct agent or toxin listed above.
Agents & Toxins
Marburg virus
Avian influenza virus (highly
pathogenic)
Bacillus anthracis
Reconstructed 1918
influenza virus
Botulinum neurotoxin
Rinderpest virus
Burkholderia mallei
Toxin-producing strains of
Clostridium botulinum
Burkholderia pseudomallei
Ebola virus
Foot-and-Mouth Disease virus
Variola major virus
Variola minor virus
Yersinia pestis
Francisella tularensis
17
Toxins & Agents
•
EHS policy & process to comply with additional requirements for transferring or receiving
select agents under U.S. laws and regulations.
•
Regulations differ depending on which agency has jurisdiction. (e.g., EAR, ITAR, HHS, FDA)
•
If the aggregate amount of toxin under control of the PI, treating physician or veterinarian, or
commercial manufacturer/distributor does not exceed the following amounts, an export
license is not required:
Abrin
Botulinum neurotoxins*
Conotoxins
100 mg
0.5 mg
100 mg
(Short, paralytic alpha conotoxins containing the following amino acid sequence X1
CCX2 PACGX3 X4 X5 X6 CX7 )
Diacetoxyscirpenol
Ricin
Saxitoxin
Staphylococcal enterotoxins (subtypes A-E)
1,000 mg
100 mg
100 mg
5 mg
T-2 toxin
Tetrodotoxin
1,000 mg
100 mg
ALL biological agents and toxins, regardless of amounts, MUST be registered
with the University’s EHS office BEFORE they are brought onto campus.
19-June-2015
18
Classified vs. Unclassified
Unclassified:
Classified:
A security classification assigned to official
information that does not warrant the assignment of
Confidential, Secret or Top Secret markings but
which is not publicly-releasable without
authorization.
Unclassified-Unlimited: Approved for public
release.
Any information or material that has been
determined by the U.S. Government, pursuant to an
executive order, statute, or regulation, to require
protection against unauthorized disclosure for
reasons of national security and any restricted data.
Security Clearance Required
Unclassified-Limited: Information exempt from
public release by Freedom Of Information Act
(FOIA) or other statutory authority.
19-June-2015
19
Shipping & Receiving / Logistics
•
What are you shipping?
o Is the item export controlled?
o Is it biological material or technology?
 Did you take required EHS training?
•
To Whom are you shipping?
o Do they appear on denied / restricted party list?
o Do they have proper clearances / authorizations?
•
Where are you shipping to?
o Check that the country does not have embargoes or other sanctions?
•
Do you have the correct ECCN & HTS?
•
Have you confirmed with NYU Logistics Department on other required documentation?
 Mislabeling the package or misrepresenting the classification of the item(s) being shipped is illegal.
 Reporting an incorrect export value on an SED is a violation of export regulations.
19-June-2015
20
Security
Includes physical security as well as items and information that may be a target for espionage activity.
•
•
•
•
•
Proprietary formulas and processes
Prototypes or blueprints
Research Data
Technical components and plans
Confidential documents
•
•
•
•
•
Access protocols
Passwords
Software (including source code)
Equipment specifications
Manufacturing plans
Foreign national employees / visitors are not permitted in export-controlled areas without:
prior export authorization; and
•
•
an escort from the host nation (U.S. citizen / permanent Resident); and
•
necessary badging or identification to be worn at all times while at the University.
19-June-2015
21
Penalties and Violations
NYU and Individuals – Liable
• Does not have to be a “knowing and willing”
violation
• Administrative (civil) violations as much as US
$250,000 per violation.
• Criminal violations as much as US $1 million per
violation.
• Loss of license, export privileges, deportation…
whatever the US government deems appropriate.
April 2013 – Umass Lowell Fined For Entity List Violations. $100,000; 2 Years Probation
March 2008 – University of Tennessee Professor John Reese Roth; 17 counts for violating
the Arms Export Control Act; 1 count of Conspiracy; 4 years federal prison.
19-June-2015
22
Criminal Cases
John Reese Roth, Ph.D.
University of Tennessee
Physics Professor
Andrey Bezrukov (aka Donald Healthfield)
Harvard’s Kennedy School of Government
Russian Spy
19-June-2015
Lidiya Gurveva (aka Cynthia Murphy)
Columbia University
Russian Spy
Ana Montes
John Hopkins University Student
Cuban Intelligence Service
Khalid Ali-M Aldawsari
Texas Tech University Student
Attempted Use of WMD for Jihad in 2011
Li Fengzhi
University of Denver
Chinese Intelligence Agent
23
Let’s Review
What ways can items be exported?
•
Phone, eMail, Texting, Eavesdropping, Physical Shipments, Conversations, Visually,
Lab Tours, Meetings
Who is considered a foreign national?
•
Persons who are not U.S. Citizens, Permanent Residents (Green Card holders), or
protected under the Refugee / Asylum status.
•
Entities who are not registered in the United States
•
Embassies and other foreign dignitaries on U.S. soil
Name the 5 countries that post the greatest concern?
•
Cuba, Syria, Sudan, Iran, North Korea
What types of activities may be considered export controlled?
•
Anything that cannot be freely shared, distributed, or published.
Why is traveling internationally a concern?
•
Encryption software on devices
•
Protection of IP / Research
Who will be held responsible for export violations?
•
All persons involved in the violation and the university
19-June-2015
24
19-June-2015
25