Embed Size (px)
Citation preview
11
EXPORT CONTROLS & SANCTIONS COMPLIANCEBasics & Clauses…
David BradyDirector and Facilities Security OfficerOffice of Export and Secure Research ComplianceVirginia Tech
Erica KroppOffice of Research Administration & AdvancementUniversity of Maryland Center for Environmental Science
June 22, 2009
22
Beware The Traps
Work your way through the FAR and other clauses and avoid the trap of export controls – don’t get ensnared. Ask questions early (internal routing forms). Look for clauses and other “red flags” in the
scope of work, the RFP and/or BAA. Look for the same in the resulting T’s & C’s of
the award.
33
What are Export Control Laws
US laws that regulate the distribution to foreign nationals and foreign countries of strategically important products, services and information for reasons of foreign policy and national security.
Export control laws apply to all activities – not just sponsored research projects.
44
US Export Control - Responsible Agencies
Most export controls and embargo issues fall under the jurisdiction of the following agencies: Department of State Department of Commerce Department of Treasury
55
Department of State
International Traffic in Arms Regulations (ITAR) – 22 CFR Parts 120-130 Regulates military, space, or defense-
related articles, technologies, and services
United States Munitions List (USML) Directorate of Defense Trade Controls
(DDTC)
66
Department of Commerce
Export Administration Regulations (EAR) – 15 CFR Parts 730-774 Regulates commercial and “dual use”
products and technologies; primarily civil use
Commerce Control List (CCL) Bureau of Industry and Security (BIS)
77
Department of Treasury
Office of Foreign Assets Controls (OFAC) – 31 CFR Parts 500-599 Prohibits transactions with countries subject to
trade sanctions and embargoes Administers and enforces economic and trade
sanctions based on US foreign policy and national security goals
Maintains the Specially Designated Nationals (SDN) and blocked persons list
88
Implications of Export & Sanctions Laws
No effect on most university research Potential impact on
Ability of foreign students or researchers to participate in research involving a controlled technology (mostly under ITAR)
Ability to provide services (including training in the use of controlled equipment) to foreign persons (ITAR, EAR, OFAC)
Ability to send controlled equipment to foreign countries (ITAR, EAR, and OFAC)
99
Implications of Export & Sanctions Laws
Factor that can extend award negotiation time – may involve institutional decisions
Factor to be considered if/when accepting another parties information
Likely to require additional internal review processes
Time and resources – can effect project schedules – even after the award
PI’s need to be involved
1010
University Strategy
Protect the fundamental research exclusion by negotiating the elimination of all contractual clauses that restrict university control of publications or limit access to or participation in research.
1111
Review of Proposals and Awards
Add questions to internal proposal routing form
Use an award review check list for research administrators
Establish an internal process for both the determination of applicable exclusion or obtaining a license
Develop/ find a dedicated resourceDocument all export determinations
1212
Some Early Stage Red Flag Items
Does the Project involve: Shipping equipment or biological
materials to a foreign country? Collaborating with foreign colleagues in
foreign countries? Foreign visitors to your labs? Training foreign nationals in using
equipment? Working with a country subject to US
sanctions? Traveling to a foreign country?
1313
More Red Flag Items
Use of another parties proprietary information?
Is the sponsor a foreign entity?
Do the terms of the RFP/BAA, etc. require: Sponsor approval rights over publications? Sponsor approval of the participation of
foreign nationals?
Is the RFP marked “Export Controlled”?
1414
Potential Problem Clause Topics
IP/Data Rights Publications/Information Dissemination Confidentiality Clauses/Agreements Export Control Security Restrictions on use of foreign nationals on
research projects Deliverables
1515
Problem Clause
DFAR 252.204-7000 Disclosure of Information – requires APPROVAL
When the Contractor will have access to or generate unclassified information that may be sensitive and inappropriate for public release , include the clause DFARS 252.204-7000.
Destroys fundamental research exclusion
1616
Problem Clause
DISCLOSURE OF INFORMATION (Dec 1991) The Contractor shall not release to anyone outside the
Contractor’s organization any unclassified information, regardless of medium (e.g., film, tape, document) pertaining to any part of this contract or any program related to this contract, unless— The Contracting Officer has given prior written
approval; or The information is otherwise in the public domain
before the date of release Requests for approval shall identify the specific
information to be released, the medium to be used, and the purpose of the release. The Contractor shall submit its request to the Contracting Officer at least 45 days before the proposed date for release.
1717
Problem Clause
Often gets included by default- mandatory flow-down clause
Strategies for dealing with DFAR 252.204-7000 in flow-down contracts Satisfy the clause with Contracting
Officer’s prior written authorization Inject self-destruct clause Insert “substantially similar” clause with
no pub restriction for university subcontract
Set up separate contract direct from government w/o clause
18
DoD Policy Memorandum on Contracted Fundamental Research (26 June 2008)
Contracted fundamental research should not be restricted, however, some applied research may be restricted:
In exceptional circumstances With approval of agency head
Can be invoked to remove DFAR 252.204-7000 Disclosure of Information clause if:
Contracted fundamental research defined by: 6.1 funds (Basic Research) 6.2 funds (Applied Research)
1919
New DFAR Export Clauses
252.204-7008 Requirements for Contracts Involving Export-Controlled Items.
252.204-7009 Requirements Regarding Potential Access to Export-Controlled Items.
2020
New DFAR Export Clauses
DFAR 252.204-7009: If project goes export controlled, only Contracting Officer can terminate
DFAR 252.204-7009 and DFARS 252.204-7000 Disc of Information in same contract - problematic!
2121
New DFAR Clauses
Shifts compliance burden to university
Requires monitoring to know when notification is required if Contractor is expected to generate export controlled information, or materials are to be generated
2222
NASA Export Clause
NASAFAR 1852.225-70 Export Licenses (and Alternate I)
Places export compliance burden on university
Alternate I: authorizes export of technical data IAW ITAR license exemption
2323
Problem Clause?
ARL 52.004-4400 FOREIGN NATIONALS PERFORMING UNDER CONTRACT (Feb 2002)
In accordance with Title 8 U.S.C. 1324a, local Foreign Disclosure Officers (FDOs) may approve access by foreign nationals working on unclassified public domain contracts for the duration of the contract, provided the foreign nationals have appropriate work authorization documentation.
In those instances where foreign nationals are required to perform under any resultant contract and employment eligibility documentation was not submitted with an awardee’s proposal, the employment eligibility documentation specified at 8 CFR 24a.2 shall be submitted to the Contracting Officer at least two weeks prior to the foreign national’s performance for review and approval. Awardees not employing foreign nationals in performance of any resultant contract may disregard this clause.
2424
Problem Clause?
DARPA / IARPA BAA clause
Publication ApprovalIt is anticipated that much of the research funded under this Program will be unclassified contracted fundamental research. However, there is the possibility that some research results from this Program may require a pre-publication review if it is determined that the release of such information may result in the disclosure of sensitive information. Any award resulting from such a determination may include a requirement to obtain IARPA's permission before publishing any information on the research. A determination will be made based on the proposed work and any necessary provisions will be reflected in contract negotiations.
2525
Strategies
Negotiate out – why in? Clarify in writing (add to clause?) that
reason for list is verification of employment documents – NOT program reason for limited access
Modify to just submission of names/info Modify to limit approval only when
access to secured federal facility
2626
Problem Clause
AFRL 5327.9002 Provisions and clauses. (a) Insert the clause at 5352.227-9000, Export-Controlled Data Restrictions, substantially as written, in Section I when the acquisition involves export controlled data.
This shows up if project involves export controlled or sensitive but unclassified information from DoD
2727
Other Potentially Restrictive Clauses
Rights in Data - Get the right alternate (e.g. FAR 52.227-14 Alt IV)
Beware the “Special Works” – Need to specify/distinguish applicability
Other Transaction Agreements – look for special language
2828
Right in Data - FAR
Rights in Data – General, FAR 52.227-14
Use with Alternate IV – for contracts for basic or applied research to be performed solely by universities & colleges
Allowable, but need permission if subcontractor from industry or we subcontract to industry
2929
Beware “Special Works”
What is it…Rights in Data-Special Works FAR 52.227-17
Government has unlimited rights to all technical data and software
No copyright/ ownership to university Government permission to release any data
first produced under the contract Requires indemnification
3030
Beware “Special Works”
Why is it there? Intended for production or compilation of
data for the government’s internal use or need to limit distribution
Inserted if software is a specific deliverable
3131
Special Works Alternative
Request deletion if no software deliverable. If there is, request deletion of Part (e)
indemnification and, Add section that provides permission to
use, release, reproduce, publish any data first produced in the performance of your contract.
Distinguish applicability if 52.227-14 is included in the contract.
3232
Other Transaction Agreements
“OTA” is not a grant or a contract or a cooperative agreement
Not subject to FAR or OMB Circulars! Do not require Bayh-Dole Act rights! Case by case negotiations
3333
Homegrown Federal Clauses: Problem Phrases
No foreign national may work on this project (with/or without prior approval).
This project will generate export controlled technology. Foreign nationals may not have access without appropriate licenses from the State or Commerce Department.
This project requires access to export controlled technology or controlled unclassified (CUI) information.
3434
Strategies for nonDoD Federal Sponsors
FAR 27.404-4 Contractor’s release, publication, and use of data. (a) In contracts for basic or applied research with
universities or colleges, agencies shall not place any restrictions on the conduct of or reporting on the results of unclassified basic or applied research, except as provided in applicable U.S. statutes. However, agencies may restrict the release or disclosure of computer software that is or is intended to be developed to the point of practical application (including for agency distribution under established programs). This is not considered a restriction on the reporting of the results of basic or applied research.
3535
Private Sponsor Clauses
Beware Language that States the Project IS Export Controlled – Compliance with Export Control Laws OK
Freedom to Publish is Key to Keeping Activity within the Fundamental Research Exclusion
Confidentiality Agreements Include Notice to you of any Information
Provided that Company deems Export Controlled
Include Option to Refuse
36
Thinking of Accepting Export-Controlled Research?
Think again Actions required:
• Red Flag Screening (EAR) • Commodity Jurisdiction/Classification
(EAR/ITAR)• Project-specific Technology Control Plan
(whether or not a foreign national is a participant in the project- a potential export control license situation exists)
• Training
37
Procedures: EAR Red Flag Screening http://www.bis.doc.gov/ExportManagementSystems/EMSGuidelines.html
Element 1: Denied Persons ScreenElement 2: Product/licensing ScreenSample Product/License MatrixElement 3: Diversion Risk ScreenElement 4: Nuclear ScreenElement 5: Missile ScreenElement 6: CBW ScreenElement 7: AntiBoycott ScreenElement 8: Informed letter/Entity List Screen
38
Procedures: Project Specific Technology Control Plan (TCP)
Required ElementsBased on best practices, contains required
elements from ITAR/EAR/AFAEA deemed export licenses
• Commodity Jurisdiction and Classification
• Physical Security Plan• Information Security Plan• Personnel Screening/ Training • Self Assessment
39
Institutional Commitment
University-wide Export Compliance Management System or Technology Control Plan specifies the university’s commitment to comply with export control laws
Procedures determine roles and responsibilities of Sponsored Programs, Research Compliance, Faculty, Purchasing, and the department and others in export controlled sponsored research
40
Commodity Jurisdiction and Classification
Under what law is the project restricted? Commodity Jurisdiction
ITAR/EAR/AFAEA/other What exactly in the project is restricted?
Technology Classification (with Sponsor and and/or Commerce/Energy/State)
Who can have access and who can’t? License/ license exception/exemption
determination
41
Commodity Jurisdiction & Classification-ITAR 22 CFR§120.6
Is the research “inherently military in character” or for a uniquely military purpose?
Is the research subject controlled on the Munitions List?
Does the research involve spacecraft or satellite technology (including Y-code GPS, ground telemetry)?
Will the research produce/modify a defense article (including software)?
Will foreign nationals have access to a defense article in the research?
42
Commodity Jurisdiction & Classification-EAR 15 CFR§§734.2, 5, 744.6, 772
Is the research in WMD, missile, or encryption technologies?
Will the research generate source code or “specific information necessary to develop, produce or use a product”?
If yes, does that product or software listed on the Commerce Control List?
43
TCP Commodity Jurisdiction and Classification
When in doubt- default to ITAR-controls 22 CFR§120.4
Resolve intellectual property issues Avoid “ITAR Contamination”
If an invention becomes defined as an ITAR “defense article” , it may prevent or prevent unrestricted use in other civilian applications without government authorization
44
Physical Security Plan
Minimum “One lock” principle- sometimes more
Use NISPOM as a guide unless cost is prohibitive Restricted area Closed area
Key control Visitor logs Escorts
45
Information Security Plan
Minimum “One Lock” principle Server folder access, firewalls, passwords/
backup to US Persons only server or BU harddrive
Clean desk policy, Central storage, locked storage container
Security marking Data discard/destruction Secure email/ mail policy
46
Information Security Plan
Securing data: Use secure web sites (https://)
SSL (Secure Sockets Layer) Use available tools to encrypt controlled files:
PGP (Pretty Good Privacy) Truecrypt Others
Destroying data: NISPOM compliant (e.g, Eraser)
47
Screening and Training
All personnel with access to controlled items: are screened for nationality and restricted party
lists are required to attend export training
Includes graduate students, undergraduate students, technicians, and IT managers
48
Procedures: Change of Export Status
Coordinate with Sponsored Programs: Change of Project Scope Change of project personnel/parties (e.g.,
subcontractors, grad students) Foreign Travel Visiting foreign scientists/others Shipping export controlled equipment/materials/
software overseas Notification of a potential export control violation
49
Procedures: Export Control Violations
If notified of/identify a potential export control violation: Remove foreign persons/foreign
nationals from access Secure the export control restricted
commodity, software, technology, or technical data
Contact Sponsored Programs or Compliance
50
Procedures: Contact by an Enforcement Agency
Ask to see a badge Cooperate with the investigator(s) Determine if the Facility Security Officer/ Legal Counsel
has been notified, if not direct the agent to them Notify OSP of your contact
You may need to establish more detailed guidance to deal with extra-regulatory requests for assistance
51
Self Assessment
Internal procedures- post award
Certifications
Internal audit
Enforcement agencies
5252
Now You Get Questions
May not always have immediate clear answers
May need further assessment Usually requires you to ask questions
in return May need to involve legal counsel…
5353
Keep Discussions In Context
There is a “Comfort Factor” with respect to Export Control Regulations & Compliance
Remain Focused on Research Results Provide Assurances Regarding Regulatory
Compliance Remember that maintaining the FRE
requires deliberate efforts; It cannot be assumed based on organizational status
5454
Additional Resources
Look to the case studies of clauses in Council on Governmental Relations/COGR web publication - www.cogr.edu/files/ExportControls.cfm
Look to a report of the AAU/COGR Task Force:“Restrictions on Research Awards: TROUBLESOME CLAUSES” - www.aau.edu/WorkArea/showcontent.aspx?id=1634&LangType=1033
