comments re category xii (27 may 2015) - final

BEFORE THE

Department of State Washington, DC

To: Directorate, Defense Trade Controls, Department of State (DDTC)

COMMENTS OF MATTHEW J. LANCASTER

Introduction

1. These observations relate to the proposed control of technical data, defense services, software, and technology under proposed revisions to United States Munitions List (USML) Category XII – Fire Control, Range Finder, Optical and Guidance and Control Equipment (hereinafter “USML Cat. XII”). 2. This set of comments first probes the potential forward and reverse implications of USML Cat. XII(f); then recommends some alternative language to obtain the assumed goal. BACKGROUND

The Asterisk 3. USML Cat. XII(f), upon initial inspection, appears to resemble most of its counterparts in other USML categories having already undergone complete transformation to publication as part of the President’s Export Control Reform initiative (ECR):

RIN 1400-AD32 Public Notice 9110

In the Matter of Proposed Rule Amendment to the International Traffic in Arms Regulations: Revision of U.S. Munitions List Category XII

Comments re Proposed Category XII Matthew J. Lancaster of 28 May 27, 2015

*(f) Technical data (as defined in § 120.10 of this subchapter) and defense services (as defined in § 120.9 of this subchapter) directly related to the defense articles enumerated in paragraphs (a) through (e) of this category. (See § 125.4 of this subchapter for exemptions.) (MT for technical data and defense services related to articles designated as such.)

4. In fact, I read this paragraph more than a half dozen times before realizing it myself for the first time that USML Cat. XII(f) opens with an asterisk (*). 5. ITAR § 121.1(b)(3) notes:

Significant military equipment. An asterisk may precede an entry in a U.S. Munitions List category. The asterisk means the enumerated defense article is deemed to be “Significant Military Equipment” to the extent specified in §120.7 of this subchapter. Note that technical data directly related to the manufacture or production of any defense articles enumerated in any category designated as Significant Military Equipment (SME) is also designated as SME. [italics in original].

6. Does DDTC intend for all technical data (to include software) and defense services classifying under USML Cat. XII(f) to be treated as SME? 7. If so, USML Cat. XII(f) will be almost singularly unique among its counterparts. 8. USML Cat. XII(f), if SME, would also be unique in that neither USML Cat. XII(d) nor USML Cat. XII(e) contain any SME, which would mean that technical data (to include software) and defense services for such non-SME hardware would itself be SME. 9. As a side note, it is also interesting that USML Cat. XII(e)(15), which appears to capture certain classified hardware, is not designated SME. 10. I could find no other similar entry on the USML which is not designated SME. 11. My interest was dually piqued upon reading Note to paragraph (e), which would appear to make such USML Cat. XII classified hardware “subject to the EAR when, prior

Comments re Proposed Category XII Matthew J. Lancaster of 28 May 27, 2015 to export, reexport, retransfer, or temporary import, they are integrated into and included as an integral part of an item subject to the EAR, and cannot be removed without destruction or damage to the article or render the item inoperable.” 12. But back to my initial point, I believe that USML Cat. XII(f) has been designated SME in error, but wish to draw DDTC attention to the supposed mistake in order to rectify it prior to publication. Are the Reverse Implications for the Phrase “directly related to” Intended and Correct?

13. Note 1 to paragraph (f) under USML Cat. XII(f) states:

Technical data and defense services directly related to image intensifier tubes [(IITs)] and specially designed parts and components therefor controlled in paragraph (c)(1) of this category, infrared focal plane arrays (IRFPAs) and detector elements therefor controlled in paragraph (c)(2) of this category, integrated IRFPA dewar cooler assemblies (IDCAs) controlled in paragraph (c)(9) of this category, wafers incorporating IRFPA or ROIC structures controlled in paragraph (e)(3) of this category, and specially designed readout integrated circuits (ROICs) controlled in paragraphs (e)(4) and (5) of this category, remain subject to the ITAR even if the technical data or defense services could also apply to items subject to the EAR. [emphasis added].

14. In sum, Note 1 to paragraph (f) says that “technical data [(to include software)] and defense services directly related to [certain defense articles] remain subject to the ITAR even if the technical data or defense services could also apply to items subject to the EAR.” 15. The reverse implication of Note 1 to paragraph (f) is that technical data (to include software) and defense services directly related to all other USML Cat. XII defense articles do not remain subject to the ITAR if (especially if?!) the technical data (to include software) or defense services could also apply to items subject to the EAR. 16. Furthermore, the reverse implication of Note 1 to paragraph (f) is that technical data (to include software) and defense services directly related to all other USML defense articles – across the board – do not remain subject to the ITAR if the technical

Comments re Proposed Category XII Matthew J. Lancaster of 28 May 27, 2015 data (to include software) or defense services could also apply to items subject to the EAR. 17. In sum, a possible reading of Note 1 to paragraph (f) is that a hidden definition for the phrase “directly related to” exists in the reverse implication of Note 1 to paragraph (f), which is that with respect to technical data (to include software) and defense services, if it could also apply to items subject to the EAR, it does not remain subject to the ITAR. 18. While the reverse implication of Note 1 to paragraph (f), with its hidden definition for the phrase “directly related to”, would bring much-needed clarity and simplicity to the ITAR, it would also transform the phrase “directly related to” into a more liberal release mechanism than that embodied by the definition of the phrase “specially designed” at ITAR § 120.41, and I find it difficult to believe, without more, that DDTC intended this result to issue by virtue of USML Cat. XII. 19. Did DDTC write Note 1 to paragraph (f) with the intention that a reverse implication should be drawn from Note 1 to paragraph (f) and applied to the rest of the USML with respect to the intersection of the phrase “directly related to” with technical data (to include software) and defense services? 20. If not, did DDTC write Note 1 to paragraph (f) with the intention that a reverse implication should be drawn from Note 1 to paragraph (f) and applied to the rest of USML Cat. XII with respect to the intersection of the phrase “directly related to” with technical data (to include software) and defense services? 21. If not, why did DDTC write Note 1 to paragraph (f)? 22. Some, including me, have repeatedly urged DDTC to distinguish the application of the term “directly related to” from the definition of “specially designed”; USML Cat. XII demands it. 23. Rather than navigate the issue via promulgation of a labyrinth of notes (each subject to interpretation), I recommend that DDTC deals with the issue more directly.

Comments re Proposed Category XII Matthew J. Lancaster of 28 May 27, 2015 24. With the exception of revised USML Category IX, DDTC appears to be hesitant to dismantle the old structure for the catch-all listing for technical data and defense services in each USML category. 25. I recommend DDTC shuffle off this stifling coil so that clarity can be brought to the type of control I believe DDTC envisioned in writing Note 1 to paragraph (f). 26. My recommendation is to integrate Note 1 to paragraph (f) into USML Cat. XII(f) as follows:

(f)(1) Technical data (as defined in § 120.10 of this subchapter) specially designed for and defense services (as defined in § 120.9 of this subchapter) directly related to the defense articles enumerated in paragraphs (a) through (e) of this category. (See § 125.4 of this subchapter for exemptions.) (MT for technical data and defense services related to articles designated as such.) (2) Technical data (as defined in § 120.10 of this subchapter) directly related to the defense articles enumerated in paragraphs (c)(1), (c)(2), (c)(9) or (e)(3)-(5) of this category. (See § 125.4 of this subchapter for exemptions.) (MT for technical data and defense services related to articles designated as such.)

Are the Reverse Implications for “Software” Intended and Correct? 27. Note 2 to paragraph (f) under USML Cat. XII(f) begins:

Software and technical data include: 28. ITAR § 120.10(a)(4) defines technical data to include software, as defined at ITAR § 120.45(f), directly related to defense articles. 29. By listing software and technical data separately in the opening of Note 2 to paragraph (f), DDTC appears to ignore that the ITAR definition of technical data includes software. 30. By ignoring that the ITAR definition of technical data includes software in the opening of Note 2 to paragraph (f), DDTC appears to be making a unique distinction.

Comments re Proposed Category XII Matthew J. Lancaster of 28 May 27, 2015 31. The reverse implication of the unique distinction is that, with respect to USML Cat. XII(f), technical data does not include software. 32. As noted in Line 3., above, USML Cat. XII(f) appears to resemble most of its counterparts in other USML categories having already undergone complete transformation to publication as part of ECR. 33. As such, the reverse implication of the unique distinction for software versus technical data made in the opening of Note 2 to paragraph (f) could be extended to all other post-ECR USML categories. 34. Did DDTC write the opening to Note 2 to paragraph (f) with the intention that a reverse implication should be drawn from the opening of Note 2 to paragraph (f) and applied to the post-ECR USML with respect to software being excluded from consideration when the term “technical data” is used on its own? 35. If not, did DDTC write the opening to Note 2 to paragraph (f) with the intention that a reverse implication should be drawn from the opening of Note 2 to paragraph (f) and applied to the rest of USML Cat. XII with respect to software being excluded from consideration when the term “technical data” is used on its own? 36. If not, why did DDTC separately call out software from technical data in the opening to Note 2 to paragraph (f)? 37. For reasons described in greater detail below, my ultimate recommendation is to strike the opening to Note 2 to paragraph (f); however, if the opening to Note 2 to paragraph (f) is retained, my recommendation would be to modify in one of two ways. 38. Either: Software and other technical data include: 39. Or: Software and tTechnical data includes:


Are the Reverse Implications for “Technical Data” Intended and Correct? 40. Paragraph A of Note 2 to paragraph (f) states that technical data includes:

Design or manufacturing process descriptions (e.g., steps, sequences, conditions, parameters) for lasers described in paragraphs (b)(6) and (b)(9) through (13) of this category, IITs controlled in paragraph (c)(1) of this category and their parts and components controlled in paragraph (e)(2) of this category (including tube sealing techniques, interface techniques within the vacuum space for photocathodes, microchannel plates, phosphor screens, input glass-window faceplates, input or output fiber optics (e.g., inverter)), IRFPAs and detector elements therefor controlled in paragraph (c)(2) of this category, integrated IRFPA dewar cooler assemblies (IDCAs) controlled in paragraph (c)(9) of this category, wafers incorporating structures for an IRFPA and detector elements therefor controlled in paragraph (c)(2) or structures for ROICs controlled in paragraph (e)(4) or (5) of this category, and specially designed ROICs controlled in paragraphs (e)(4) and (5) of this category (including bonding or mating (e.g., hybridization of IRFPA detectors and ROICs), prediction or optimization of IRFPAs or ROICs at cryogenic temperatures, junction formation, passivation).

41. In sum, paragraph A of Note 2 to paragraph (f) states that technical data includes “design or manufacturing process descriptions (e.g., steps, sequences, conditions, parameters) for [certain defense articles].” 42. The reverse implication of paragraph A to Note 2 to paragraph (f) is that DDTC does not perceive design or manufacturing process descriptions to fall within the definition of technical data at ITAR § 120.10. 43. ITAR § 120.10(a)(1) defines technical data to include:

Information… which is required for the design, development, production, manufacture, assembly, operation, repair, testing, maintenance or modification of defense articles.

44. Did DDTC write paragraph A of Note 2 to paragraph (f) with the perspective that design or manufacturing process descriptions do not fall within the definition of technical data at ITAR § 120.10? 45. If not, why did DDTC write paragraph A of Note 2 to paragraph (f)?

Comments re Proposed Category XII Matthew J. Lancaster of 28 May 27, 2015 46. I do not believe DDTC wrote paragraph A of Note 2 to paragraph (f) intending to imply that, generally, design or manufacturing process descriptions fall outside the ITAR definition of technical data. 47. Rather, I believe DDTC was trying to, for the most part, fashion a carve-out to a carve-out, which became muddy in the multiple draft iterations of USML Cat. XII which were likely to have been circulated internally prior to the publication of this Proposed Rule. 48. As such, and for additional reasons described in greater detail below, my recommendation is to incorporate this carve-out to a carve-out into the definition of technical data in ITAR § 120.10. 49. Also, Note to paragraph A of Note 2 to paragraph (f) states:

Technical data does not include information directly related to basic operating instructions, testing results, incorporating or integrating IRFPAs into higher level [sic] packaged assemblies not enumerated in this category, or external interface control documentation associated with such assemblies or assemblies subject to the EAR, provided such information does not include design methodology, engineering analysis, or manufacturing know-how for a USML controlled [sic] IRFPA.

50. In partial summary, Note to paragraph A of Note 2 to paragraph (f) states that, insofar as no information on design methodology, engineering analysis, or manufacturing know-how for a USML-controlled IRFPA (hereinafter collectively referred to as “DEM4IRFPA”) is involved, information directly related to incorporating or integrating IRFPAs into higher-level packaged assemblies not enumerated in USML Cat. XII is not ITAR-controlled. 51. A reverse implication of Note to paragraph A of Note 2 to paragraph (f) is that information directly related to incorporating or integrating IRFPAs into higher-level packaged assemblies enumerated in other USML categories is not ITAR-controlled. 52. Did DDTC write paragraph A of Note 2 to paragraph (f) intending to imply that information directly related to incorporating or integrating IRFPAs into higher-level packaged assemblies enumerated in other USML categories is not ITAR-controlled?

Comments re Proposed Category XII Matthew J. Lancaster of 28 May 27, 2015 53. I believe DDTC did write paragraph A of Note 2 to paragraph (f) intending to imply that information directly related to incorporating or integrating IRFPAs into higher-level packaged assemblies enumerated in other USML categories is not ITAR-controlled. 54. I also believe DDTC did not go far enough in its exclusion. 55. The exclusion only takes into account incorporation and integration activities, and neglects to address lifecycle support for such products. 56. As such, and for additional reasons described in greater detail below, my recommendation is to incorporate an expanded notion of this carve-out into the definition of technical data in ITAR § 120.10. 57. Also in partial summary, Note to paragraph A of Note 2 to paragraph (f) also states that, insofar as no DEM4IRFPA is involved, external interface control documentation (ICD) associated with non-USML-Cat.-XII, yet USML-enumerated, higher-level packaged assemblies incorporating or integrating IRFPAs is not ITAR-controlled technical data. 58. A reverse implication of Note to paragraph A of Note 2 to paragraph (f) is that external ICD associated with higher-level packaged assemblies incorporating or integrating IRFPAs enumerated in other USML categories is not ITAR-controlled. 59. Did DDTC write paragraph A of Note 2 to paragraph (f) intending to imply that external ICD associated with higher-level packaged assemblies incorporating or integrating IRFPAs enumerated in other USML categories is not ITAR-controlled? 60. I believe DDTC did write paragraph A of Note 2 to paragraph (f) intending to imply that external ICD associated with higher-level packaged assemblies incorporating or integrating IRFPAs enumerated in other USML categories is not ITAR-controlled. 61. I also believe that this type of broad carve-out is not best represented by being buried in a note to a single USML category.

Comments re Proposed Category XII Matthew J. Lancaster of 28 May 27, 2015 62. As such, and for additional reasons described in greater detail below, my recommendation is to incorporate this carve-out into the definition of technical data in ITAR § 120.10. 63. Also in partial summary, Note to paragraph A of Note 2 to paragraph (f) also states that, insofar as no DEM4IRFPA is involved, external ICD associated with assemblies subject to the EAR is not ITAR-controlled. 64. A reverse implication of Note to paragraph A of Note 2 to paragraph (f) is that external ICD associated with EAR-controlled assemblies contains or constitutes information that a reasonable person might construe to be ITAR-controlled technical data, and that, regardless, such external ICD containing or constituting ITAR-controlled technical data is not ITAR-controlled. 65. Did DDTC write paragraph A of Note 2 to paragraph (f) intending to imply that external ICD associated with EAR-controlled assemblies generally contains or constitutes ITAR-controlled technical data, and, furthermore, that, regardless of whether such external ICD contains or constitutes ITAR-controlled technical data, it is not ITAR-controlled? 66. If so, should such a significant proclamation impacting the ITAR definition of technical data appear in a paragraph to a note in a single USML category? 67. This is where the verbiage begins to become incredibly confusing for me. 68. Why do we need a statement in the USML that external ICD for EAR-controlled assemblies is not ITAR-controlled? 69. I believe we do not. 70. As such, my recommendation is to strike this verbiage.

Comments re Proposed Category XII Matthew J. Lancaster of 28 May 27, 2015 71. Also in partial summary, Note to paragraph A of Note 2 to paragraph (f) also states that, insofar as no DEM4IRFPA is involved, all information related to basic operating instructions and testing results is not ITAR-controlled technical data. 72. Did DDTC write paragraph A of Note 2 to paragraph (f) intending to imply that all information related to basic operating instructions and testing results is not ITAR-controlled technical data? 73. If so, should such a significant proclamation impacting the ITAR definition of technical data appear in a paragraph to a note in a single USML category? 74. I do not believe DDTC intends to imply that all information related to basic operating instructions and testing results is not ITAR-controlled technical data. 75. Rather, I believe that DDTC intended to exclude from the ITAR definition of technical data basic operating instructions and testing results for IFRPAs in higher-level packaged assemblies not enumerated in USML Cat. XII. 76. I believe this exclusion is achieved by incorporating the entire lifecycle of the product into a slightly broader exclusion, which I prefer to capture in the definition of technical data in ITAR § 120.10. 77. As such, my recommendation is to combine paragraph A to Note 2 to paragraph (f) and Note to paragraph A of Note 2 to paragraph (f) into slightly expanded verbiage in the definition of technical data in ITAR § 120.10, as follows:

(a) Technical data means, for purposes of this subchapter: (1) Information, other than software as defined in §120.10(a)(4), which is required for the design, development, production, manufacture, assembly, operation, repair, testing, maintenance or modification of defense articles. This includes information in the form of blueprints, drawings, photographs, plans, instructions or documentation. … (b) The definition in paragraph (a) of this section does not include: …


(4) provided such information does not include design methodology, engineering analysis, or manufacturing know-how for an infrared focal plane array (IRFPA) in Category XII of part 121 of this subchapter, information directly related to the entire lifecycle for: (i) IRFPAs in higher-level packaged assemblies not in Category XII of part 121 of this subchapter; or (ii) external interface control documentation for higher-level packaged assemblies not in Category XII of part 121 of this subchapter; or (5) provided such information does not include design or manufacturing process descriptions (e.g., steps, sequences, conditions, parameters), information directly related to the entire lifecycle for:…

Are the Reverse Implications for Tune-up/Tone-down (TUTD) Software Intended and Correct?

78. Paragraph B of Note 2 to paragraph (f) states:

Software that converts an article controlled in this category into an item subject to the EAR or an item subject to the EAR into an article controlled in this category [(herein referred to as “tune-up/tone-down software” or “TUTD software”)] is directly related to the defense article controlled in this category. When a defense article has been converted into an item subject to the EAR through [TUTD] software, the presence of the [TUTD] software that prevents the item from meeting or exceeding a USML control parameter does not make the item subject to the ITAR.

79. In sum, when TUTD software is involved with a USML Cat. XII defense article, the TUTD software is ITAR-controlled. 80. Also in sum, when TUTD software is used to tone-down a defense article to below ITAR control parameters, the former defense article becomes an EAR-controlled item, despite the continuing presence of TUTD software in the toned-down item. 81. The first sentence of paragraph B to Note 2 to paragraph (f) calls out “this category” three (3) times, but the second sentence of paragraph B to Note 2 to paragraph (f) does not call out or reference USML Cat. XII at all.

Comments re Proposed Category XII Matthew J. Lancaster of 28 May 27, 2015 82. As such, the reverse implication is that the second sentence of paragraph B to Note 2 to paragraph (f) applies to all of the USML. 83. Does DDTC intend for the second sentence of paragraph B of Note 2 to paragraph (f) to be applied as interpretive guidance for all other defense articles on the USML to which TUTD software has been applied? 84. If not, should DDTC reference USML Cat. XII in the second sentence of paragraph B of Note 2? 85. If so, should such a significant policy announcement (Reverse See-Through Rule) for all TUTD software appear in a paragraph to a note in a single USML category? 86. I very much like the idea of a Reverse See-Through Rule for all TUTD software. 87. It is my recommendation that such a proclamation, if intended, be more prominently displayed. 88. As such, as described further below, I recommend incorporation of this Reverse See-Through Rule into the ITAR definition of software at ITAR § 120.45(f). 89. I would additionally recommend establishing that either an existing exemption applies (e.g., ITAR § 125.4(b)(5)) or creating a new exemption for the maintenance (e.g., updates, bug fixes) of TUTD software in an EAR-controlled item. 90. Also, the reverse implication of the first sentence could be that TUTD software involved with defense articles in any other USML category is not “directly related to the defense article controlled in” any other category (i.e., that all other TUTD software is not ITAR-controlled). 91. Does DDTC intend for the first sentence of paragraph B of Note 2 to paragraph (f) to be construed to mean that TUTD software involved with defense articles in any other USML category is not ITAR-controlled?

Comments re Proposed Category XII Matthew J. Lancaster of 28 May 27, 2015 92. If so, should such a significant proclamation impacting the ITAR definition of software (or technical data) appear in a paragraph to a note in a single USML category? 93 I do not believe DDTC intends to imply that TUTUD software involved with defense articles in any other USML category is not ITAR-controlled. 94. To the contrary, I believe DDTC is likely more inclined to adopt a default position that all TUTD software is, on its face, ITAR-controlled. 95. I also believe that this inclination is better captured in a more prominent display as part of the ITAR definition of software at ITAR § 120.45(f). 96. As such, I recommend that paragraph B of note 2 to paragraph (f) be incorporated into the ITAR definition of software at ITAR § 120.45(f), as follows:

§120.45 End-items, components, accessories, attachments, parts, firmware, software, systems, and equipment. … (f) Software includes but is not limited to the system functional design, logic flow, algorithms, application programs, operating systems, and support software for design, implementation, test, operation, diagnosis and repair. A person who intends to export only software should, unless it is specifically enumerated in §121.1 of this subchapter (e.g., USML Category XIII(b)), apply for a technical data license pursuant to part 125 of this subchapter. Software that converts a defense article into an item described in the EAR or an item described in the EAR into a defense article is directly related to the defense article. When a defense article has been converted into an item described in the EAR through software, the presence of the software that prevents the item from meeting or exceeding a USML control parameter does not make the item subject to the ITAR.

Are the Reverse Implications for USML Category IX Intended and Correct? 97. Paragraph C of Note 2 to paragraph (f) states:

EO/IR simulation or projection system software that replicates via simulation either the output data or information provided by any article controlled in this category, a radiometrically calibrated spectral signature


of any article controlled in this subchapter, volumetric effects of plumes or military operational obscurants, or countermeasure effects.

98. USML Category IX, generally, covers military training equipment and training, and, more specifically, its lists include: targets having an infrared signature that mimics a specific defense article, other item, or person; infrared scene generators; certain simulators and; software and associated databases not elsewhere enumerated on the USML used to model or simulate certain trainers, battle management, military test scenarios/models, or effects of weapons enumerated on the USML. 99. The reverse implication of paragraph C of Note 2 to paragraph (f) is that, in order to avoid significant overlap, DDTC intends to significantly descope USML Category IX. 100. While in the framework of ECR, generally, DDTC has committed to rewrite of USML Category XIII(a) commensurate with the final issuance of USML Cat. XII, the overall impact of the final issuance of USML Cat. XII to the rest of the USML is less well-advertised. 101. Does DDTC intend to significantly descope USML Category IX at the time of final issuance of USML Cat. XII in order to reconcile the significant overlap brought about by paragraph C of Note 2 to paragraph (f)? 102. My recommendation is to migrate the substance of paragraph C of Note 2 to paragraph (f) to USML Category IX, as follows:

Category IX—Military Training Equipment and Training … (b) Simulators, as follows: … (2)-(3) [Reserved] (3) EO/IR simulation or projection system software and associated databases that replicate via simulation: (i) the output data or information provided by any article controlled in USML Category XII; (ii) a radiometrically calibrated spectral signature of any article controlled in this subchapter; or


(iii) volumetric effects of plumes or military operational obscurants or countermeasure effects; or … (e) Technical data (see §120.10 of this subchapter) and defense services (see §120.9 of this subchapter): … (2) Directly related to the software and associated databases enumerated in paragraphs (b)(3) and (b)(4) of this category even if no defense articles are used or transferred; or

Are the Reverse Implications for “Defense Services” and “Software” Intended and Correct?

103. Note 3 to paragraph (f) states:

Technology for incorporating or integrating IRFPAs into permanent encapsulated sensor assemblies subject to the EAR, or integrating such assemblies into an item subject to the EAR, and integrating IITs into an item subject to the EAR, including integrating items subject to the EAR into foreign military commodities outside the United States, is subject to the EAR.

104. The ITAR does not define “technology” in ITAR § 120.10. 105. “Technology” is defined in Part 772 of the EAR as:

Specific information necessary for the “development”, “production”, or “use” of a product. The information takes the form of “technical data” or “technical assistance”. Controlled “technology” is defined in the General Technology Note and in the Commerce Control List (Supplement No. 1 to part 774 of the EAR). “Technology” also is specific information necessary for any of the following: operation, installation (including on-site installation), maintenance (checking), repair, overhaul, refurbishing, or other terms specified in ECCNs on the CCL that control “technology.” N.B.: Technical assistance--May take forms such as instruction, skills training, working knowledge, consulting services. NOTE 1: “Technical assistance” may involve transfer of “technical data”. NOTE 2: “Technology” not elsewhere specified on the CCL is designated as EAR99, unless the “technology” is subject to the exclusive jurisdiction of another U.S. Government agency (see § 734.3(b)(1)) or is otherwise not


subject to the EAR (see § 734.4(b)(2) [sic] and (b)(3) and §§ 734.7 through 734.11 of the EAR). [italics in original].

106. The Bureau of Industry and Security, Department of Commerce (BIS) has stated that the “EAR does not control services” (see Exhibit 1). 107. The definition of “technology” in the EAR includes references to “technical assistance,” and it is plausible that “technical assistance” under the EAR may be confused with providing a service (see ITAR § 120.9) under the ITAR, but the definitions of “technical assistance” in the EAR and “defense service” in the ITAR are not aligned. 108. Under the EAR, it is important to recognize that “technical assistance,” according to the EAR definition of “technology,” is a form of information (the second sentence of the EAR’s definition of “technology is: “The information takes the form of ‘technical data’ or ‘technical assistance’”). 109. “Technical data” is defined in Part 772 of the EAR as certain types of information, as follows:

May take forms such as blueprints, plans, diagrams, models, formulae, tables, engineering designs and specifications, manuals and instructions written or recorded on other media or devices such as disk, tape, read-only memories.

110. But the EAR definition of “technical data” does not necessarily encompass all forms of EAR-controlled information. 111. EAR-controlled information may extend beyond the EAR definition of “technical data” to all information which is not: 1) either subject to the exclusive jurisdiction of another U.S. Government agency, or; 2) publicly available (see Part 772 of the EAR, Note 2 to the definition of “technology” and Part 734.3(b)(2) and (b)(3)). 112. As such, “technology” as defined in the EAR does not necessarily capture services which do not convey information, and the clarification from BIS states clearly that it does not.

Comments re Proposed Category XII Matthew J. Lancaster of 28 May 27, 2015 113. On the other hand, the ITAR does not require furnishing of any information in order for a “defense service” to occur (see ITAR § 120.9(a)(1)). 114. It is also worth noting that the EAR definitions of “technology,” “technical assistance,” and “technical data” do not include software, whereas the ITAR definition of “technical data” (see ITAR § 120.10(a)(4)) includes software. 115. As such, by using the term “technology” in Note 3 to paragraph (f), and applying the definition of “technology” in the EAR (because the ITAR does not define “technology”), the reverse implication is that Note 3 to paragraph (f) does not exclude from ITAR jurisdiction pure services or software. 116. By using the term “technology” in Note 3 to paragraph (f), does DDTC intend to retain jurisdiction over pure services and software? 117. I do not believe DDTC intended to retain jurisdiction over pure services and software by virtue of its use of the term “technology” in Note 3 to paragraph (f). 118. In partial summary, Note 3 to paragraph (f) also states that technology for integrating permanent encapsulated sensor assemblies subject to the EAR into an item subject to the EAR is subject to the EAR. 119. To restate it in even simpler terms, it says that technology for integrating a certain EAR item into another certain EAR item is subject to the EAR. 120. A reverse implication is that technology for integrating other EAR items into other EAR items is subject to the ITAR. 121. Also, to provide contrast, Note 3 to paragraph (f) also states that technology for incorporating or integrating IRFPAs into permanent encapsulated sensor assemblies subject to the EAR is subject to the EAR. 122. Another reverse implication is that technology for incorporating permanent encapsulated sensor assemblies subject to the EAR into an item subject to the EAR is subject to the ITAR.

Comments re Proposed Category XII Matthew J. Lancaster of 28 May 27, 2015 123. Did DDTC intend to imply that technology for integrating EAR items into EAR items is ever subject to the ITAR? 124. If not, why did DDTC include this provision in Note 3 to paragraph (f)? 125. I do not believe DDTC intended to imply this absurd result. 126. I also believe it is unnecessary to state in any note to any USML category that technology for integrating EAR items together is subject to the EAR. 127. Did DDTC intend to imply that technology for incorporating permanent encapsulated sensor assemblies subject to the EAR into an item subject to the EAR is subject to the ITAR? 128. If not, why did DDTC couch technology in terms of “incorporating or integrating” only with respect to IRFPAs going into permanent encapsulated sensor assemblies subject to the EAR? 129. Did DDTC intend to imply that all other activity related to having IRFPAs in permanent encapsulated sensor assemblies subject to the EAR, such as maintenance and repair, is subject to the ITAR? 130. If not, why did DDTC couch technology only in terms of “incorporating or integrating” as subject to the EAR? 131. I believe that DDTC has fallen victim to drafting carve-outs against the background of broad regulatory language. 132. As such, my recommendation is to broaden the language to encompass lifecycle support with respect to the products, as further described below.

Comments re Proposed Category XII Matthew J. Lancaster of 28 May 27, 2015 133. Also in partial summary, Note 3 to paragraph (f) also states that integrating items subject to the EAR into foreign military commodities outside the US is subject to the EAR. 134. The ITAR does not define the terms “foreign military commodities” or “military commodity” in ITAR § 120.10. 135. The EAR defines the term “military commodity” in Part 772 of the EAR as:

An article, material, or supply that is described on the U.S. Munitions List (22 CFR Part 121) or on the Munitions List that is published by the Wassenaar Arrangement on Export Controls for Conventional Arms and Dual-Use Goods and Technologies, but does not include software, technology and any item listed in any ECCN for which the last three numerals are 018 or any item in the “600 series.”

136. In the EAR’s Commerce Control List (CCL) at Part 774, ECCN 0A919 describes EAR-controlled military commodities as military commodities produced and located outside the United States which are not subject to the ITAR, and which either: 1) incorporate certain cameras; 2) incorporate more than a certain amount of US-origin 600 series content, or; 3) are direct products of US-origin 600 series technology or software. 137. I believe it is fair to characterize ECCN 0A919 as describing “foreign military commodities.” 138. ECCN 0A919 currently contains a Related Controls description which states:

(1) “Military commodities” are subject to the export licensing jurisdiction of the Department of State if they incorporate items that are subject to the International Traffic in Arms Regulations (ITAR) (22 CFR Parts 120 - 130). (2) “Military commodities” described in this paragraph are subject to the export licensing jurisdiction of the Department of State if such commodities are described on the U.S. Munitions List (22 CFR Part 121) and are in the United States. (3) The furnishing of assistance (including training) to foreign persons, whether in the United States or abroad, in the design, development, engineering, manufacture, production, assembly, testing, repair, maintenance, modification, operation, demilitarization, destruction, processing, or use of defense articles that are subject to the ITAR [sic]; or the furnishing to foreign persons of any technical data controlled under 22 CFR 121.1 whether in the United States or abroad are


under the licensing jurisdiction of the Department of State. (4) Brokering activities (as defined in 22 CFR 129) of “military commodities” that are subject to the ITAR are under the licensing jurisdiction of the Department of State.

139. Of note, the above-referenced Related Controls paragraph has a circular reference with respect ECCN 0A919.a.1, and should more appropriately state “destruction, processing, or use of defense articles described on the U.S. Munitions List”; otherwise the Related Controls paragraph might suggest that DDTC has ceded controls over defense services to BIS, which is not likely because the EAR does not control services (see Line 106, above and Exhibit 1). 140. The EAR has no entry for a corresponding control for “technology” at what would be, presumably, ECCN 0E919. 141. As such, a reverse implication of Note 3 to paragraph (f) is that DDTC only intends to maintain jurisdiction over information related to the integration of EAR-controlled items into US-origin defense articles worldwide and all defense articles, regardless of origin, when those defense articles are in the US. 142. I believe this is a bad idea, but have nevertheless attempted to implement it in my recommend rewrite of the principle, as further described below. 143. Another reverse implication of Note 3 to paragraph (f) is that DDTC intends to maintain jurisdiction over pure services and software, even those related to the integration of EAR-controlled items into foreign military commodities outside the US. 144. I do not believe this was DDTC’s intent in using the term “technology.” 145. I believe DDTC intended to shift jurisdiction of certain services and technical data to the EAR. 146. As such, my recommendation includes adding verbiage to both the ITAR definitions of technical data at ITAR § 120.10 and defense service at ITAR § 120.9.

Comments re Proposed Category XII Matthew J. Lancaster of 28 May 27, 2015 147. And another reverse implication of Note 3 to paragraph (f) is that DDTC intends to maintain jurisdiction over all other technology, including that for incorporating into and maintenance and repair of EAR-controlled items in foreign military commodities outside the US. 148. I do not believe this was the intended result of Note 3 to paragraph (f), as discussed herein above and as further described below. 149. Should such a significant proclamation impacting the ITAR definition of technical data (and perhaps even defense services) appear in a paragraph to a note in a single USML category? 150. I recommend the principle be implemented via modification to the ITAR definitions of technical data at ITAR § 120.10 and defense service at ITAR § 120.9. 151. Moreover, is it the intent of DDTC to, on the one hand, maintain ITAR control over some technology (e.g., integration of EAR-controlled items into US-origin defense articles), but release closely related technology (e.g., integration of EAR-controlled items into foreign military commodities) all the way to classification under the EAR as EAR99? 152. As already stated herein, I believe this is a bad idea, but I nevertheless attempt to provide clearer language to bring it into effect via modification to the ITAR definitions of technical data at ITAR § 120.10 and defense service at ITAR § 120.9. 153. As such, I recommend Note 3 to paragraph (f) by implemented via modification to the ITAR definitions of technical data at ITAR § 120.10 and defense service at ITAR § 120.9 as follows:

§120.9 Defense service. (a) Defense service means: (1) The furnishing of assistance (including training) to foreign persons, whether in the United States or abroad in the design, development, engineering, manufacture, production, assembly, testing, repair, maintenance, modification, operation, demilitarization, destruction, processing or use of defense articles; …


(b) [Reserved] The definition in paragraph (a) of this section does not include: (1) The furnishing of assistance to foreign persons directly related to the entire lifecycle for: (i) infrared focal plane array (IRFPA) in permanent encapsulated sensor assemblies described in the EAR; (ii) image intensifier tubes (IITs) in an item described in the EAR; or (iii) items subject to the EAR in items described in ECCN 0A919. … §120.10 Technical data. (a) Technical data means, for purposes of this subchapter: (1) Information, other than software as defined in §120.10(a)(4), which is required for the design, development, production, manufacture, assembly, operation, repair, testing, maintenance or modification of defense articles. This includes information in the form of blueprints, drawings, photographs, plans, instructions or documentation. … (b) The definition in paragraph (a) of this section does not include: … (5) provided such information does not include design or manufacturing process descriptions (e.g., steps, sequences, conditions, parameters), information directly related to the entire lifecycle for: (i) IRFPA in permanent encapsulated sensor assemblies described in the EAR; or (ii) image intensifier tubes (IITs) in an item described in the EAR; or (6) information directly related to the entire lifecycle for items subject to the EAR in items described in ECCN 0A919; or…

Comments re Proposed Category XII Matthew J. Lancaster of 28 May 27, 2015 RECOMMENDATIONS 154. Please consider the above-described and following recommended revisions (recommended additions in bold red font; deletions in blue strikethrough font) for not only USML Cat. XII, but also, as applicable, for other parts of the ITAR. §120.9 Defense service. (a) Defense service means: (1) The furnishing of assistance (including training) to foreign persons, whether in the United States or abroad in the design, development, engineering, manufacture, production, assembly, testing, repair, maintenance, modification, operation, demilitarization, destruction, processing or use of defense articles; … (b) [Reserved] The definition in paragraph (a) of this section does not include: (1) The furnishing of assistance to foreign persons directly related to the entire lifecycle for: (i) infrared focal plane array (IRFPA) in permanent encapsulated sensor assemblies described in the EAR; (ii) image intensifier tubes (IITs) in an item described in the EAR; or (iii) items subject to the EAR in items described in ECCN 0A919. … §120.10 Technical data. (a) Technical data means, for purposes of this subchapter: (1) Information, other than software as defined in §120.10(a)(4), which is required for the design, development, production, manufacture, assembly, operation, repair, testing, maintenance or modification of defense articles. This includes information in the form of blueprints, drawings, photographs, plans, instructions or documentation. … (b) The definition in paragraph (a) of this section does not include:

Comments re Proposed Category XII Matthew J. Lancaster of 28 May 27, 2015 (1) information concerning general scientific, mathematical, or engineering principles commonly taught in schools, colleges, and universities;, or (2) information in the public domain as defined in §120.11 of this subchapter; or (3) telemetry data as defined in note 3 to Category XV(f) of part 121 of this subchapter;. (4) provided such information does not include design methodology, engineering analysis, or manufacturing know-how for an infrared focal plane array (IRFPA) in Category XII of part 121 of this subchapter, information directly related to the entire lifecycle for: (i) IRFPAs in higher-level packaged assemblies not in Category XII of part 121 of this subchapter; or (ii) external interface control documentation for higher-level packaged assemblies not in Category XII of part 121 of this subchapter; or (5) provided such information does not include design or manufacturing process descriptions (e.g., steps, sequences, conditions, parameters), information directly related to the entire lifecycle for: (i) IRFPA in permanent encapsulated sensor assemblies described in the EAR; or (ii) image intensifier tubes (IITs) in an item described in the EAR; or (6) information directly related to the entire lifecycle for items subject to the EAR in items described in ECCN 0A919; or It also does not include(7) basic marketing information on function or purpose or general system descriptions of defense articles. … §120.45 End-items, components, accessories, attachments, parts, firmware, software, systems, and equipment. … (f) Software includes but is not limited to the system functional design, logic flow, algorithms, application programs, operating systems, and support software for design, implementation, test, operation, diagnosis and repair. A person who intends to export only software should, unless it is specifically enumerated in §121.1 of this subchapter (e.g., USML Category XIII(b)), apply for a technical data license pursuant to part 125 of

Comments re Proposed Category XII Matthew J. Lancaster of 28 May 27, 2015 this subchapter. Software that converts a defense article into an item described in the EAR or an item described in the EAR into a defense article is directly related to the defense article. When a defense article has been converted into an item described in the EAR through software, the presence of the software that prevents the item from meeting or exceeding a USML control parameter does not make the item subject to the ITAR. Category description: Category IX—Military Training Equipment and Training … (b) Simulators, as follows: … (2)-(3) [Reserved] (3) EO/IR simulation or projection system software and associated databases that replicate via simulation: (i) the output data or information provided by any article controlled in USML Category XII; (ii) a radiometrically calibrated spectral signature of any article controlled in this subchapter; or (iii) volumetric effects of plumes or military operational obscurants or countermeasure effects; or … (e) Technical data (see §120.10 of this subchapter) and defense services (see §120.9 of this subchapter): … (2) Directly related to the software and associated databases enumerated in paragraphs (b)(3) and (b)(4) of this category even if no defense articles are used or transferred; or … USML Cat. XII: *(f)(1) Technical data (as defined in § 120.10 of this subchapter) specially designed for and defense services (as defined in § 120.9 of this subchapter) directly related to the defense articles enumerated in paragraphs (a) through (e) of this category. (See § 125.4 of this subchapter for exemptions.) (MT for technical data and defense services related to articles designated as such.) (2) Technical data (as defined in § 120.10 of this subchapter) directly related to the defense articles enumerated in paragraphs (c)(1), (c)(2), (c)(9) or (e)(3)-(5) of

Comments re Proposed Category XII Matthew J. Lancaster of 28 May 27, 2015 this category. (See § 125.4 of this subchapter for exemptions.) (MT for technical data and defense services related to articles designated as such.) Note 1 to paragraph (f): Technical data and defense services directly related to image intensifier tubes and specially designed parts and components therefor controlled in paragraph (c)(1) of this category, infrared focal plane arrays (IRFPAs) and detector elements therefor controlled in paragraph (c)(2) of this category, integrated IRFPA dewar cooler assemblies (IDCAs) controlled in paragraph (c)(9) of this category, wafers incorporating IRFPA or ROIC structures controlled in paragraph (e)(3) of this category, and specially designed readout integrated circuits (ROICs) controlled in paragraphs (e)(4) and (5) of this category, remain subject to the ITAR even if the technical data or defense services could also apply to items subject to the EAR. Note 2 to paragraph (f): Software and technical data include: A. Design or manufacturing process descriptions (e.g., steps, sequences, conditions, parameters) for lasers described in paragraphs (b)(6) and (b)(9) through (13) of this category, IITs controlled in paragraph (c)(1) of this category and their parts and components controlled in paragraph (e)(2) of this category (including tube sealing techniques, interface techniques within the vacuum space for photocathodes, microchannel plates, phosphor screens, input glass-window faceplates, input or output fiber optics (e.g., inverter)), IRFPAs and detector elements therefor controlled in paragraph (c)(2) of this category, integrated IRFPA dewar cooler assemblies (IDCAs) controlled in paragraph (c)(9) of this category, wafers incorporating structures for an IRFPA and detector elements therefor controlled in paragraph (c)(2) or structures for ROICs controlled in paragraph (e)(4) or (5) of this category, and specially designed ROICs controlled in paragraphs (e)(4) and (5) of this category (including bonding or mating (e.g., hybridization of IRFPA detectors and ROICs), prediction or optimization of IRFPAs or ROICs at cryogenic temperatures, junction formation, passivation). Note to paragraph A of note 2 to paragraph (f): Technical data does not include information directly related to basic operating instructions, testing results, incorporating or integrating IRFPAs into higher level packaged assemblies not enumerated in this category, or external interface control documentation associated with such assemblies or assemblies subject to the EAR, provided such information does not include design methodology, engineering analysis, or manufacturing know-how for a USML controlled IRFPA. B. Software that converts an article controlled in this category into an item subject to the EAR or an item subject to the EAR into an article controlled in this category is directly related to the defense article controlled in this category. When a defense article has been converted into an item subject to the EAR through software, the presence of the software that prevents the item from meeting or exceeding a USML control parameter does not make the item subject to the ITAR.

Comments re Proposed Category XII Matthew J. Lancaster of 28 May 27, 2015 C. EO/IR simulation or projection system software that replicates via simulation either the output data or information provided by any article controlled in this category, a radiometrically calibrated spectral signature of any article controlled in this subchapter, volumetric effects of plumes or military operational obscurants, or countermeasure effects. Note 3 to paragraph (f): Technology for incorporating or integrating IRFPAs into permanent encapsulated sensor assemblies subject to the EAR, or integrating such assemblies into an item subject to the EAR, and integrating IITs into an item subject to the EAR, including integrating items subject to the EAR into foreign military commodities outside the United States, is subject to the EAR. … Category XIII— Materials and Miscellaneous Articles (a) Cameras and specialized processing equipment therefor, photointerpretation, stereoscopic plotting, and photogrammetry equipment which are specifically designed, developed, modified, adapted, or configured for military purposes, and components specifically designed or modified therefor. [Reserved]

Matthew J. Lancaster PRIVATE CITIZEN

May 27, 2015

Exhibit 1

From: To: Subject: Date:

I lcllo \1auhew. I ha\e imbedded m} response and comments in the email below with /.

Please let me knov .. if)OU ha'e an> questions.

L.S. Department of Commerce

-----Original \1essage----From \1atthew Lancaster en~ 02.20154:31 P\1

To:~ Subject: RE: BETA Site Advisory Opinion Request

Good Afternoon

I hank )OU for taking the time \\.ith me on the phone today to ensure I understood the guidance provided below. It "as 'cry helpful.

During our discussion. our focus turned to Soft,\. are-as-a-Sen ice (SaaS) hosted by a cloud-based storefront. asserted that '"'hlle the Bl~ •\d\.isor} Opinion dated 'ovembcr 13, 2014 (the "Cloud Store AO") was helpful for o'"'ners of cloud-based storefronts. I had concerns that the ('loud Store AO did not necessaril> mean that companies providing SaaS to the cloud-based storefront provider (e.g. fell within the transaction described. In other words. I opined that a company. like . , providing SaaS, like for, say.- , to sell through --cloud-based storefronts had export obligations because wou d have kno~at-:dedio make available worldwide through the cloud-based storefront. You commented that thi'> might not be the case. since, in this scenario, t c transaction between and - occurs \\hOll} '"ithin the LS. so there is no export. Thereafter, - is not exporting per the Cloud Store AO.

I found this perspecti\e compelling.

t1 he cAR does not control services. In this case there is no export of software to the end user or- in the U.S. There was guidance given in the cloud computing advisory opinion of 1113/2009. In your company s scenario there could be a potential e'CpOrt taking place when the software to be hosted is sent to If - will host it on servers located outside of the U.S., then there would be an export to server hos~ion(s).

\\'e then discussed the fact that some SaaS, like is time-bombed. Lsers get a free~er

"hich a subscription must ~urchased in order to continue to access - · \\,hen an -u~er chooses to subscribe. - collects information on the user. I fat that time the user identifies himself with an address in a proscribed destination. what obligations docs . have to block the user's access to: I) future access to any . SaaS (including free content); and, 2) current and future access to . premium products?

matt7989

Highlight

matt7989

Highlight

'in other words, in thi<; no-export-has-happened environment of cloud-based storefronts, must • refuse service to an mdi\idual \\ho identifies him,clfwith an addrc% in a proscribed destination (e.g., Cuba) =11obtains an C\port license'>

rrhi!> is still a cloud based service rhere is no export to the end users. Before and after the trai l expires, there is no e\port of the software to the end user, therefore, no controllable e\ pOrt. But I \\ant to address the scenario ii there ''ere to be an export of software to the end user. We issued an ad\ isory

opinion on October 24. 2013 regarding time restricted EAR99 software posted on line. Please re\ ie\' •. It says the act of po-;ting software on the internet \\here it can be downloaded b)' anyone docs not establish "knowledge" of a prohibited export or reexport nor triggers any "red nags" necessitating the affirmative duty to inqu ire under the "Know your Customer" guidance provided in the l·AR. It goes on to address IP address collection by saying a \iolation would not occur ifthe IP address of the person downloading the software is collected by the software pro\ ider at the time of do'' nload and stored as a "footprint" m the machine code of the sofh"are provider's data base. BCT is not tracl-.ed or used for any purpose by the soft,\are pro\ ider.

/ I consulted my director "'ho signed these ad"isory opinions. She agreed with this assessment for EAR99 software sm:h as ) ours

I Rottom line is if)OU are mal-.ing )Ourselfa\\-are of the end users then you have "knowledge" to do something, but you are not obligated by the EAR to make yourself aware.

And. ''hat happens. if an)' thing. to II obligations if the user i'i still '"'ithin the trial period. but chooses to voluntaril> iden11I} himselfb) completing his u~er profile. indicating an address in a proscribed destination? \\.hat if he completes this user profile before the trial period is initiated (must he, at that point, be banned from the chat rooms - or should we keep him out of the discussion from the very beginning by maintain ing screens against IP addresses)?

As .,tated abo\.e, since this i::. a 5aaS. if there is no export then the question is moot. Ho\.\ ever,) ou may want to contact Office ofl oreign Asset Controls at the Dept. ofTreasury. I believe they cover services to the embargoed countries.

I lo\\ e\ er. going to the scenario if there is an export of software to the end user. then at the time of e\port there ''a~ no "1-.no, ... tedge" then there i~ no" iolation C\en if during the trial period )'OU obtain "kno,.,.ledge" because of a voluntary disclosure by the end user. But there would be basis for blocking the subscription use after the 30 day period was O\er. The EAR does not obligate you to block chem from chat rooms (chatting onlinc would not be an e\port). If. h)'pothctically the same end user wanted to download another free trial of some ocher software offering )OUr compan} made available for free and anonymous download then you \\OUld not have "knowledge" of it. In ocher \\Ords. )OU are not obligated co find the end user and block them for soft,,are exports you mal-.e free and anonymous.

Thanl-. you for both your time and consideration regarding these questions and scenarios. As discussed on the phone. to date \\.e\.e been \Cl") consenative. and I don't want to recommend \\e drop any existing shields if co do so \\.Ou Id run contrar} to the intent of the LS regulators.

-----Ori ei nal \ 1essage-----F rom . Sent Iuesda), Janual") 27. 2015 10:22 A\1 To. Matthew Lancaster

Phone: ....

\1essage: .... seeks advice for three (3) questions:

I) Gi"en 'ote 4 to Categol) 5. Pan 2 to Supplement I to Pan 774 (the "CC'L"), are- books which come \\tth compact disks (CDs) "published" within the meaning of EAR Pan 734 7. and. as such, insofor as provided in accordance\\ ith EAR Pan 724.7(b). outside the scope of the EAR in accordance with EAR Pan 734.3(b)(3)?

// The book itself would ccnainly be public but if there is software on the CD then there could be something of control.

2) Docs 'ote 4 to Category 5. Pan 2 to the CCL (hereinafter referred to as "'\ote 4") extend to evaluation versions of so th' are \\hen the full 'ers1on definitive!) qualilic!> for e'clusion by operation of Note 4?

11Y cs, note 4 \\Ou Id appl)' to time bombed soft\\are but the publicly available provisions do not apply to trial version that expire. I his is a restriction on the use of the soil ware which is against publicly avai lable.

J) Is standalone software and Software-as-a-Service capability (SaaS) publicly available if readily available at one or more libraries open to the public or university libraries after having been made available to such libraries at a price" hich is not intended to e'cced the cost of reproduction and distribution?

11 I ha\e not heard of this method of making software publicly available because it usual! a found in libraries. not executable so fl ware. For cxamph!, the library may have a copy of gi .. en to them for users 10 use for their word processing needs. 1 his would not mean that is publicl:r a .. ailable. It is. ho,.,,ever. mass market soft,\are rhe test would be if someone could legally (without breal.mg a license agreement) ha"e a cop) of the soft,.,,arc from the libral) for their unrestricted use.

In CC1\ IS- . BIS determined that some orllllsoftware, including classifies for e\pon from the US as EAR99 - based. we believe, large!} on T\ote 4, which excludes an item that incorporates or u!>cs 'cryptography' from Category 5. Pan 2 controls if thc item's primary function or set of functions is not 'information sccurit)". including "applied geosciences mining drilling, atmospheric sampling I weather monitoring, mapping sur..e}ing. dams hydrolog)" (see http· ww\\ ,b1:,,doc i,:ov iode:-. php polic>-

i:uidance \;nCQ pl!On CnCQ ption-faqs l 'i) .

• bcltcvcs that earlier versions of arc also excluded from Category 5, Pan 2 controls, including, vel') lil.cly. evaluation copies of the same.

- publishei. books about the science, a One such book. for example, \\h1ch is entitled comes with two compact disl.s. One has a full} functional cop) of- oftware that e'pires 180 days after installation; the other has exercise data which does not expire. The c'crc1se data is used in conjunction \\ ith exercise chapters, ,.,,hi ch each contain two to four exerci-.cs showing how 10 accomplish a panicular GIS task in a realistic context, such as symbolizing and labeling maps. querying map!>, and geocoding addresses.

- eeks formal guidance from BIS to confirm our conclusion that ifan item is: I) excluded from Category 5, Part 2 of the CCL by operation of Note 4 to the same. and;

Yes. - 1s '\ote 4 software.

2) readil} available at one or more libraries open to the public or universit) libraries after having been made a\ailable to such libraries either for free or at a price that docs not exceed the cost of reproduction and distribution -

then the item is published within the meaning or EAR Part 734. 7 and outside the scope of the EAR in accordance

<)ubJect: F\\ . BET\ Site \d\ ISO!) Opinion Request

I lello Mauhe\-.. I have tried to answer your questions below. My answers are marked with a //. Please let me know if you have any questions. I am available tomorrow by phone, if needed.

-----Original \ 1essage-----I rom:

Good morning

Would one of you like to respond to this???

Thanks

l <) Department of Commerce Aureau of lndustrv and Securit't

, .. , .. , .. . bis.doc.gO\

-----Original ~tessagc-----From: BIS Website [mnil\Q'm:b site{, bis doc gov] Sent: Wednesday. Janual) 21, :WIS 8:45 PM lo: REGPolicy\Veb Subject: BE1 A Site Advi~ory Opinion Request

You ha\e a new submission.

Fir.,t 'ame: .... \tauhe\\

Last 'ame: ..... Lancaster

Email: .....

with F \R Part 734.3(b)(3}.

I it appears that the ofTered software does have restrictions on it, in that it is a trial version. It would not be considered published if there is a time restriction on the use of it.

Furthermore .• seeks BIS concurrence v .. ith respect to our application of,ote 4 to evaluation copies of software (espcciall> \\here the full version of the software definith-ely falls\\ ithin the Note 4 exclusion).

I/Yes, t\otc 4 can apply to the trial version.

see . Gi\cn Note 4 applicability, and given further the availability of

software at one or more libraries open to the public or university libraries, and that . strives to make such software available lo such institutions at a price which does not exceed the cost of reproduction and distribution, . clic\CS that such software is outside the scope of the EAR pursuant to EAR Part 734.3(b)(3). Furthermore, under these ~ame conditions . • believes this to be the case even with respect to SaaS . • seeks BIS confinnation of these position for softv,.are and SaaS ac; well.

I Making copies available at uni,ersily libraries is not available to anyone. For one. the general public does not have access 10 university libraric!> and computers. 'f hose are soil ware licenses available to students. If the full software is made available for anyone lo download online or take from public libraries then it could be considered public. The library method of making software pubhcl> available is less heard of since you can reach a much wider audience onhne

comments re category xii (27 may 2015) - final

Documents

usml categories

defense services

designated sme

proposed category

defense articles

munitions list category

enumerated defense article

nonsme hardware