Export ComplianceRobert Bienkowski

21 June 2016

Presentation to COD

1

In a nutshell

If you want to send certain things tocertain foreign persons, places or countries,

then you may need a license from the government.

2

Objectives

•Review the vocabulary of export compliance•Discuss the various regulations that control exports•Discuss implications of export compliance for universities and faculty •Begin a discussion of why CMU needs an Export Compliance program

and how it might be organized

3

“Export” is a verb and a noun

•Verb: To send or take controlled tangible items, software, or information out of the United States in any manner (including hand carried), to transfer ownership or control of controlled tangible items, software, or information to a foreign person, or to disclose information about controlled items, software, or information to a foreign government or foreign person.•Noun: The controlled tangible item, software or information being

sent or taken out of the United States. Stanford website

4

Non-US Persons/Foreign Persons

•Visiting scholars holding F-1 or J-1 visas•Employees holding H1-B visas•Businesses, corporations, groups or agencies not

incorporated in the US

5

Export Control - definition

The array of federal regulations that apply to the export of funds or certain technologies (including information as well as materials or products) to non-US destinations, non-US organizations or to persons in the US or abroad who are neither US citizens nor permanent residents, nor “protected immigrants.”

Adrian Shelton, UNC

6

Underlying Structure of the Regulations

There are 3 lists •One list (EAR) deals with “dual use” items that have military and

nonmilitary uses•Another list (ITAR) deals with things that have military uses •The third list (OFAC) contains names of persons, places such as

companies or institutes, and countries that are restricted from receiving any exports without a license

7

Government Agencies & Regulations

•Department of Commerce – Export Administration Regulations (EAR)• Dual use items

•Department of State – International Traffic in Arms Regulations (ITAR)• Military use

•Department of the Treasury – Office of Foreign Asset Control (OFAC)• Persons, places, countries

8

Purposes of the Regulations

1. Control proliferation of certain military technologies

2. Control proliferation of some nonmilitary technologies that may have military applications (“dual use”)

3. Protect US commercial technology advantages

4. Enforce State Department opposition to flow of money to embargoed countries, entities and persons

9

National Security

Economics

Foreign Policy

The regulations and the things and persons on the lists change frequently. For example:• International Traffic in Arms: Revisions to Definition of Export and

Related Definitions•…amends the CCL entry that controls certain human and zoonotic

pathogens and toxins by adding two viruses that were not previously identified on the AG 'List of Human and Animal Pathogens and Toxins for Export Control' •Recent changes to master list of Specially Designated Nationals and

Blocked Persons• Designation of Tariq Gidar Group, aka TGG, ... as a Specially Designated

Global Terrorist

10

On the one hand, we recently learned that…

11

WCVB5/Boston

On the other hand…

12

• The primary U.S. trade embargo targeting Iran remains in place. It prohibits U.S. citizens from investing directly in Iran, and denies Iranian banks the ability to clear U.S. dollars through New York or do business with American financial institutions.

• Sanctions covering military technology, terrorism and human rights all remain in force. Together, they effect a wide range of industries, including aviation.

• Tehran-based Mahan Air remains on the U.S. sanctions list. The U.S. Treasury has accused the airline of providing support to Iran's Quds Force, an elite division of the country's Revolutionary Guards.

• In March, the U.S. Treasury sanctioned individuals who had attempted to conduct business with Mahan Air. It also accused the airline of transporting Iranian military forces into Syria.

Bottom line

•One should not assume anything about the logic of the regulations or their interpretation.

Boeing can sell airplanes to Iran but GM cannot sell Chevies.•When asking whether something, someone, or someplace is subject

to export controls, the most current lists should be consulted.

13

Universities’ Security Blanket - The Fundamental Research Exemption (FRE)Because any information, technological or otherwise, that is publicly available is not subject to the Export Administration Regulations (EAR) (except for encryption object code and source code in electronic form or media) and thus does not require a license, "fundamental research" is not subject to the EAR and does not require a license.

14

Fundamental Research

"Fundamental research" is basic and applied research in science and engineering where the resulting information is ordinarily published and shared broadly within the scientific community. It is distinguished from proprietary research and from industrial development, design, production, and product utilizations, the results of which ordinarily are restricted for proprietary and/or specific national security reasons. Normally, the results of "fundamental research" are published in scientific literature, thus making it publicly available. Research which is intended for publication, whether it is ever accepted by scientific journals or not, is considered to be "fundamental research." A large segment of academic research is considered "fundamental research."

15

Deemed Exports – The Land Mine of Export ControlRelease of controlled technology to a foreign person in the U.S. is "deemed" to be an export to the person’s country of nationality.Typical organizations using deemed export licenses include universities, high technology research and development institutions, bio-chemical firms, as well as the medical and computer sectors.

So, a professor giving a graduate seminar about her work on nanotubes may be exporting information.

16

Why are Export Controls important to universities?• Loss or misuse of universities’ intellectual property•National security concerns

17

FBI Whitepaper - 2011

18

The open environment of US campuses of higher education may be misused in order to:• Steal technical information or products• Bypass expensive research and development• Recruit individuals for espionage• Exploit the student visa program for improper purposes• Spread false information for political or other reasons

Examples of University Export Violations• University of Massachusetts at Lowell, received a $100,000 penalty from Bureau of Industry and Security (BIS).

The exports in this case were not controlled items-all were classified as EAR99 (low level concern), but the recipient of the items was on the BIS Entity List. 2013

• University of Michigan, Mohamad Nazemzadeh, who was a Research Fellow in the Neurology Department at the time of his arrest, was prosecuted for sending a medical device to Iran, in 2013.

• New York University-School of Medicine, three researchers were charged for sharing non-public information with Chinese companies about their NYU work conducted through a grant from the NIH to develop new M.R.I. technologies. 2013

• Georgia Institute of Technology allowed Internet users in 36 countries, including China, and Iran, to view sensitive information that was intended only for federal employees and contractors. This course included 14 PowerPoint slides and was uploaded to Georgia Tech's servers. State Dept determined that violations had occurred. 2009

• University of Tennessee –Knoxville professor John Reece Roth was sentenced to 4 years in prison for violating the Arms Export Control Act by conspiring to illegally export technical information. 2009.

• Texas Tech University professor Thomas Campbell Butler, M.D., was sentenced to 2 years in prison for illegally exporting the Yersinia pestis (bacterium that causes human plague), which is a controlled item under the EAR and cannot be exported without the required export licenses. 2004

19

What is our risk of not having an Export Control Compliance Program?•The risk of violating an export control regulation is probably small.

• Our total external funding for research is modest • All the universities on the previous list have several times more external funding than

CMU

• No concerns from survey last summer of labs for agents on the DURC list • No concerns from audit of sample of recent contracts

• In terms of compliance issues at CMU, my guess is:• Title IX >> Misconduct >> IRB >> Export Controls

20

What do we have to worry about at CMU?Generic Issues• Professors’ travels

• Where they go; where they shouldn’t (without a license)• What they take with them (especially laptops and tablets)• What they bring back; what they leave behind

• “Exports” to research collaborators in other countries• Stuff (such as samples) and ideas

• Visiting researchers• What they can see and hear (Deemed exports)

• Foreign students• What projects they can work on

• Contracts with restrictions• Publication• Embargoes (eg, doing business with Israel)

• Student travel• The unfortunate case of Glenn Duffie Shriver from GVSU

21

Calibrating our worries – Determining level of risk• The risk of a bad event has 2 independent

components:• The magnitude of the event• The probability of the event

22

Low probability/high magnitude events are called “Black Swans” or Never Events

Black Swan Event

•Even if the probability of a violation of Export Control Regulations is exceedingly low, the consequences of not having an organizational infrastructure can be severe.•Monetary penalty•Reputational loss

• So, as the government says…

23

Structure of an Export Compliance Program

1. Articulate and publish an export control compliance policy2. Identify an office at the university in charge of export control

training and compliance1. Conduct a needs analysis/risk assessment2. Establish SOPs

3. Determine who needs export training, what level of training is required, and how frequently the training should be delivered

1. who to ask 2. what to ask 3. when to ask about export compliance

4. Conduct audits to determine effectiveness of the program24

CMU already has a program…unfortunately it’s the other CMU

25

Current Export Compliance Program @ CMU

•3971

26

We do not have to reinvent the wheel

There are many resources available on the web – including from institutions in our peer group:

•Basic information•Training • SOPs

27

28

29

U of M Website

Penn has a very good set of materials

•Here is there flow chart for vetting research contracts

30

Mary Roy External Counsel

31

Answers are usually NO because most university research qualifies for the FRE – the Fundamental Research Exemption

Functions can be distributed among various offices

32

PIsResearch StaffORSRAsBAs

Training at CITIProgram.org can be tailored to a person’s responsibilities

33

Working with the lists

•One of the most daunting and labor-intensive aspects of determining whether shipping something or dealing with someone requires an export license is checking the lists at State, Commerce or Treasury and documenting what you did.• Fortunately, there’s an app for that.

34

Visual Compliance Research Edition (VCRE) is a modular export compliance solution, including…

VCRE Overview

Controlled Goods Classification and License

Determination

Restricted Party Screening

Audit, Reporting, and Dynamic Rescreening

International Trade Compliance Resources

35

Several Michigan universities and research institutes have collaborated to obtain a system license and split the yearly fee of ~$54k

In summary

There are three areas of concern in Export Compliance that we should be able to address with modest additional effort and expenditure:•Vetting foreign visitors•Vetting contracts• Foreign travel

36

Closing words paraphrased from the Federal Sentencing Guidelines

37

It is a general principle of compliance that when things go south:• Having policies and procedures and using them is a mitigating factor• Not having policies and procedures is an aggravating factor