Bureau Of Industry And Security Issues New Guidance To Academic Institutions On Complying With U.S. Export Controls

On August 14, 2024, the U.S. Department of Commerce's Bureau of Industry and Security (BIS) published two new export compliance resources for the academic community: (1) a compliance note on voluntary self-disclosure trends and (2) a compendium of export compliance resources. These new resources are being issued in connection with the Academic Outreach Initiative that BIS has recently launched and are intended to assist academic institutions in understanding and complying with U.S. export controls and in protecting the security of their research.

U.S. Export Controls and Sanctions Regulations for Universities

The United States Export Administration Laws and Regulations are a set of federal regulations that restrict the release of certain U.S.-origin sensitive items, information and software to foreign nationals located both in the United States and abroad in order to protect U.S. national security interests and foreign policy objectives. The U.S. export controls system consists of two primary sets of export control regulations: (1) the Export Administration Regulations (EAR); and (2) the International Traffic in Arms Regulations (ITAR). The EAR regulates "dual-use" technologies that can be used for both civilian and defense purposes, while the ITAR regulates the export of defense-related articles and services.

In addition to the export controls, the U.S. also maintains multiple economic sanctions programs. These are generally divided into comprehensive (countrywide) and targeted (list-based) sanctions.

Violations and Penalties of the U.S. Export Controls

Penalties for noncompliance with U.S. export controls are severe. If an export control violation is determined by an investigating agency, an individual may be subject to civil and criminal penalties. The civil penalties are a strict liability offense, meaning that knowledge of a violation is not a requirement for a civil penalty to be issued.

The EAR and the ITAR

BIS administers U.S. laws, regulations and policies governing the export, reexport¹ and transfer (in-country) of commodities, software and technology falling under the jurisdiction of the EAR. These regulated items have commercial uses that can also be used in conventional arms, weapons of mass destruction, terrorist activities or human rights abuses and less sensitive military items. Generally, all items of U.S. origin are subject to classification under the EAR.

If an item (commodity, software or technology) is EAR-controlled, it may require an export license based upon: (1) the technical characteristics of the item, (2) the destination country, (3) the end user and/or (4) the end use, if no exceptions apply. Even low-technology consumer goods may require a license if the proposed (re)export is to an embargoed country, an end user of concern or in support of a prohibited end use.

The U.S. Department of State's Directorate of Defense Trade Controls (DDTC) administers the ITAR and has authority over defense-related articles and services. All ITAR-controlled items (i.e., defense- related technology, information, source code, object code, material, items and equipment) require an ITAR license for export.

Common University Exclusions

There are three principal exclusions from the export controls commonly utilized by universities:

1. Public domain/publicly available information (i.e., materials available in newspapers, libraries or presented at publicly available conferences and trade shows, publicly available technology or software, websites accessible to the public for free and without the host's knowledge or control of who visits the site, and published patents);
2. Educational information (i.e., information concerning general scientific, mathematical or engineering principles commonly taught in schools, colleges and universities); and
3. Fundamental research (i.e., basic or applied research in science, mathematics and engineering where the resulting information is ordinarily published and shared broadly within the scientific community, and for which the researchers have not accepted restrictions for proprietary or national security reasons).

However, it is important to note that even in the conduct of fundamental research and instruction, an export control license may be required if the project involves a nondisclosure agreement covering the exchange of export-controlled information, access to export-controlled technology, a nonresearch function (e.g., a service agreement) where there is access to export-controlled technology, or access to ITAR-controlled equipment. Any institution wishing to employ one of the above exceptions should therefore seek advice from experienced counsel familiar with U.S. export controls before proceeding.

Economic Sanctions

In addition to the export controls discussed above, the U.S. implements various other country-specific regulations to control exports to certain countries around the world. Specifically, the U.S. Treasury Department's Office of Foreign Assets Control (OFAC) administers embargos and economic sanctions programs. As with the export controls discussed above, the U.S. sanctions regulations carry strict liability.

Each U.S. sanctions program contains different provisions and prohibitions; however, they generally can be divided into comprehensive (countrywide) and targeted (list-based) sanctions. The U.S. administers comprehensive sanctions programs against Cuba, Iran, North Korea, Syria and the Crimea, Donetsk and Luhansk regions of Ukraine. The list-based sanctions programs target particular persons or activities, such as any transactions involving persons listed on OFAC's Specially Designated Nationals List and certain types of transactions involving persons listed on OFAC's Sectoral Sanctions Identifications List.

Non-U.S. persons can be liable under U.S. sanctions regulations for (1) taking actions within the U.S.; (2) causing, aiding and abetting, or conspiring with U.S. persons to violate U.S. sanctions; or (3) activities that occur within the U.S. (e.g., processing sanctioned country transactions through the U.S. financial system). Additionally, secondary sanctions do not require a U.S. nexus and may be imposed on non-U.S. persons directly or indirectly engaged in certain significant transactions relating to Russia, Iran, North Korea, Hong Kong and Syria. Finally, any person, including a non-U.S. person, that provides material support for persons designated or blocked pursuant to certain U.S. sanctions authorities can in certain cases themselves be subject to designation and blocking (although historically such designations have not been common).

Two New Export Compliance Resources for Academic Institutions

As part of the Academic Outreach Initiative, the Office of Export Enforcement has strongly encouraged voluntary self-disclosures (VSDs) from academic institutions that believe that they may have violated the EAR. The first of the two new resources, the compliance note, "Trends in Voluntary Self-Disclosures Related to Academia to Inform Improvements to Export Compliance Plans," details conduct commonly disclosed by academic institutions in VSDs over the past 10 years that constitutes export control violations. Specifically, BIS highlights the following export control risks for academic institutions:

• Unauthorized export of certain chemicals, microorganisms and toxins;
• Unauthorized export of items to a party listed on the Entity List;
• Unauthorized release of EAR-controlled technology to foreign national employees or students;
• Exports improperly using license exception TMP, which allows for the temporary export and reexport of various items subject to the EAR, as long as the items are returned no later than one year after export, reexport or transfer if not consumed or destroyed during the period of authorized use;
• Failure to file electronic export information in the Automated Export System; and
• Failure to maintain accurate export records.

The compliance note also highlights actions universities can take to address and prevent these violations, including enhanced training programs and improved internal controls.

The second resource, which is a compendium of resources, offers a comprehensive guide to export compliance tools, including informational and vetting resources, BIS-specific resources and examples of recent enforcement actions. Academic institutions should use these tools to integrate export control requirements into everyday operations for professors, students, staff and visitors, which in turn will help to minimize the risk of violations.

Conclusion

The Academic Outreach Initiative is intended to help academic institutions maintain an open, collaborative research environment in a way that also protects against national security risks.

Universities should be aware that BIS is taking seriously the risks associated with export control violations in the academic sphere, as evidenced by a recent settlement agreement with Indiana University. BIS imposed an administrative penalty on Indiana University related to exports by its Bloomington Drosophila Stock Center of fruit flies genetically modified to produce a subunit of a controlled toxin. These exports went to numerous research institutions and universities worldwide without the required export licenses. In the press release announcing the settlement, BIS cautioned, "Researchers should take note: even the smallest items, like a genetically modified fruit fly, can implicate chemical and biological weapons controls."

Universities should carefully review the new BIS resources, take note of the kinds of export compliance issues that are present in the academic setting, and take corrective actions, if necessary.

For More Information

If you have any questions about this Alert, please contact Katherine D. Brodie, Geoffrey M. Goodale, Brian S. Goldstein, Lauren E. Wyszomierski, any of the attorneys in our International Practice Group, any of the attorneys in our Education Industry Group or the attorney in the firm with whom you are regularly in contact.

Footnote

1. A "reexport" is the shipment or transmission of an item subject to the EAR from one foreign country (i.e., a country other than the United States) to another foreign country. In other words, U.S. jurisdiction follows U.S.-origin goods around the world.