"Deemed export" laws restrict sharing information with foreign nationals.

Heightened Security for Information Sharing 

Among the many new security restrictions that have surfaced in the United States in recent years, one area that universities and educational institutions need to watch closely are laws that limit whether foreign nationals working or studying at U.S. universities may be exposed to secret or sophisticated technology, otherwise referred to as "deemed exports." Foreign nationals are identified essentially as all persons who are not U.S. citizens or permanent residents. This includes visiting scholars and foreign students.

This issue first became a significant concern for Americans back in the 1950s when attention focused on a talented foreign student who had studied aerospace engineering and mathematics at the Massachusetts Institute of Technology (MIT) and the California Institute of Technology (Caltech). That student, Qian Xuesen, later became the "father" of China's nuclear weapons program. The U.S. government has since recognized that little difference exists between exposing a foreign engineer, or even an intern, to sensitive technical data and putting that data directly into the hands of foreign governments. U.S. laws have increased regulations regarding deemed exports, and relevant agencies are now beginning to impose large fines and criminal penalties that can cause companies and universities public embarrassment.

Some experts in this area are estimating that federal agents plan to make between 40 and 60 visits to research universities in the upcoming months to investigate deemed exports (Flanagan & Carnegie, 2004). In 2004 the Department of Defense issued a troubling report concluding that the Department of Commerce's Bureau of Industry and Security (BIS) does not have "adequate processes to identify unclassified export-controlled technology and to prevent unauthorized disclosure to foreign nationals" (United States Department of Defense [U.S.D.O.D.], 2004). The report also stated that at least two government contractors and one university granted foreign nationals access to unclassified export-controlled technology without an export license or other authorized approval or exemption. The report criticized universities that were relying on the terms of contracts with the government in addressing access by foreign nationals and were not examining their practices in light of the deemed export laws and regulations.

The two federal agencies that administer most of the regulations by which deemed exports are controlled are the BIS and the Department of State's Office of Defense Trade Controls (ODTC). Unfortunately, having two different agencies oversee this one area causes a significant amount of confusion and makes the regulations difficult to understand, often duplicative and unnecessarily burdensome.

In a nutshell, the BIS propagates and administers the Export Administration Regulations (EAR), which cover dual-use exports. Any software or technology that is subject to the EAR and is released to a foreign national is considered an export to the home country of the foreign national and termed a deemed export (U.S.D.O.D., 2004). Software or technology can be exported by a visual inspection of U.S. equipment and facilities by foreign nationals, oral exchanges of information, or through the application of personal knowledge or technical expertise. These exports include those with both commercial and military or strategic uses as well as those with wholly civil uses. A release of controlled technology to a foreign national who is not a permanent resident of the United States is thus deemed an export. For this reason, American universities and colleges that employ foreign workers or admit foreign students to work on technology research must be conscious of the laws concerning deemed exports. These regulations apply to foreign nationals working for U.S. companies and universities both abroad and within the United States.

These deemed export laws are specifically aimed at foreign nationals and the knowledge and technological skills they may acquire while working and going to school in the United States. The concern is that this knowledge may go back to a foreign national's country of origin and eventually be used against the United States by an aggressive country. The regulations also cover disclosure to subcontractors and vendors who employ foreign nationals in the United States and to subcontractors and vendors located in other nations.

At least one university has been investigated during the past year for exposing foreign nationals to unclassified export-controlled technology without a proper license (U.S.D.O.D., 2004). The most restricted destinations are embargoed countries and those countries designated as supporting terrorist activities, including Cuba, Iran, Iraq, Libya, North Korea, Sudan, and Syria. However, many other nations of concern, including China and Russia, are also significantly restricted.

Universities that conduct research under contract for private corporations or under U.S. government sponsorship must be very familiar with deemed export requirements. Some of the nation's top research universities, including MIT, Carnegie Mellon and the University of Chicago, are taking steps to properly educate employees and faculty so that they are aware and can comply with regulations (Norris, Carr, & Keith, 2004).

If no conditions are placed on the research and the organization conducting the research intends to publish its findings in scientific literature, then the BIS considers the research to be fundamental and no license is required. However, if research is expected to be considered proprietary, a license will likely be required. This applies to both corporate and government sponsored research.

A few areas are basically unaffected by EAR. Among these are any item that is "media," defined as the content of books, recordings, globes, newspapers, and the like. In a related exception, EAR does not reach "publicly available technology and software ... that are already published or will be published," that are the result of fundamental research, or that "are educational" or contained in certain patent applications (Export Administration Regulations, [E.A.R.] 2004).

For published material to be exempt from EAR, it must be "generally accessible to the interested public in any form." Publication may be in the medium "available for general distribution to any member of the public or to a community of persons interested in the subject matter, such as those in a scientific or engineering discipline, either free or at a price that does not exceed the cost of reproduction and distribution." The other exempted category of fundamental research is "basic and applied research in science and engineering, where the resulting information is ordinarily published and shared broadly within the scientific community" (EAR, 2004). Fundamental research differs from proprietary research and industrial development because the resulting information is ordinarily published, whereas the results of proprietary research and industrial development are ordinarily restricted for competitive or national security reasons. Corporate research is thus fundamental to the extent that researchers are allowed to publish it without restrictions or delay based on proprietary or security reasons. In addition to fundamental research, technology commonly taught in a university classroom setting need not be licensed, even if some students are from countries to whom domestic exporters are forbidden from selling goods.

In addition to the regulations under BIS, the ODTC also controls exports that could provide sensitive technology to hostile countries through its International Traffic in Arms Regulations (ITAR). These regulations apply only to defense articles on the U.S. Munitions List and to defense services (U.S. Department of State, n.d.). These regulations are stricter than EAR because exemptions are more limited. Every individual deemed export under the purview of the ITAR requires a license.

Both sets of regulations are functionally identical in their definition of the deemed export of non-proprietary information. ITAR's definition of exports includes the oral or visual disclosure or transfer of technical data, which includes the training of foreigners in the design and development of defense articles. If an item is on the Munitions List, any information required for its design, development, production, manufacture, assembly, operation, repair, testing, maintenance, or modification, including blueprints, drawings, photographs, plans, instructions, and documentation, may not be transferred without an export license (ITAR, 2004). Like the EAR, information concerning general scientific, mathematical, or engineering principles commonly taught in schools, colleges, and universities or information in the public domain is not included in ITAR. Information in the public domain likewise includes "fundamental research in science and engineering at accredited institutions of higher learning ... where the resulting information is ordinarily published" (EAR, 2004).

Penalties for Non-Compliance

Universities and other organizations that engage foreign nationals to work or study in various technological fields must be aware of the penalties associated with violating these regulations. Until recently, this area had been largely unheeded by companies and universities and only occasionally enforced by federal agencies, but in the post-9-11 world that is changing. Organizations caught violating the EAR and ITAR face fines of up to $10,000 for each unlicensed export of technology. Violations involving national security controls may also result in civil penalties of up to $1,000,000 per offense and the denial of export privileges, in addition to criminal penalties of up to five years in prison. Although this is an area previously under-enforced by federal agencies, over the past three years reported penalties imposed by BIS for export control violations reached $5.2 million (Pearl, 2004).

Other penalties include potential debarment from federal contracts and grants as well as severe damage to the university's reputation. In addition, responsible individuals and the university may face criminal penalties. Improved technology used by the Department of Homeland Security and enforcement agencies such as the Federal Bureau of Investigation (FBI) and State Department allow them to more readily identify organizations' failures to obtain the requisite export control licenses.

In addition to the ITAR and EAR, which theoretically cover any technology with military or strategic value, contract law also protects sensitive technology. If a government agency contracts with a university to conduct research benefiting the military, the contract will require secrecy with respect to certain countries' nationals. Breaching these terms could subject universities or companies to damages, and perhaps more devastatingly, prevent them from securing future contracts.

Recommendations

To ensure conformity with these requirements, academic institutions should educate employees about the regulations as part of the implementation of a formal compliance program. Foreign nationals must be informed about U.S. export controls that restrict their access to certain technical data. This information should include which types of technical data require specific authorization and which are available to all employees. Foreign national employees should be informed that any violation could result in penalties for both the organization as well as the employee for causing, aiding or abetting a violation. Also, foreign national employees should be warned that any unauthorized access to restricted technical data would be grounds for immediate termination of employment.

Compliance audits and spot checks on the work areas and local storage media of affected foreign national employees to determine whether any unauthorized data has been copied, viewed or sent are a good idea. Of course, these audits should be conducted as part of a compliance program incorporating insights from various legal professionals, including experienced employment, privacy, and immigration counsel, to address such issues as workplace privacy and discrimination, as well as counsel experienced in export controls. Periodic "refresher" courses should be given to all employees who come in contact with restricted data in order to ensure full understanding of the access restrictions and to uncover and report any unauthorized disclosures.

What the Future May Hold

The future is likely to bring further restrictions, increased penalties and increased enforcement activity in an area viewed by many in government as crucial to the United States' national security. Increased focus on the threat posed by terrorist organizations and terrorist supporting and embargoed nations, continued concern about China, Russia and other nations co-opting U.S. technology to develop weapons dangerous to the U.S., combined with increasing trends toward international sharing of information between institutions and an understanding of the value of bringing the best and the brightest to U.S. institutions of higher learning as students and teachers will continue to create great tensions in this arena.

University, and research centers should expect continued review and tightening of regulations along with efforts by relevant agencies to streamline the process for review and obtaining licenses as the U.S. strives to protect national security and yet assist academic institutions and corporations in appropriate interaction with increasingly important foreign nationals. The increased focus on deemed exports will lead increasing numbers of academic institutions to implement compliance programs in this area to ensure full compliance with federal law.

The federal government will continue to be diligent to prevent a scenario similar to that of the aforementioned Chinese MIT student. After receiving his training at the Massachusetts Institute of Technology in rocket research and serving time in the U.S. Air Force working on America's ballistic missile program, Qian Xuesen returned to communist China in 1955 amid charges he was a spy. He quickly became the leading scientist in China's own effort to develop ballistic missiles and other rockets. Five years later, China successfully launched its first rocket--a Russian R-2 modified by Qian.

Author's Note: Bruce J. Casino is an attorney in the Washington D.C. office of the national law firm off Baker & Hostetler, LLP, practicing in the areas of white collar crime, export control and business litigation. He is an adjunct professor at The George Washington University Law School and is a member of the Board of Trustees of the University of Bridgeport. He can be reached at [e-mail] or [phone].

References

Bowman, G. W. (Winter 2004). E-mails, servers, and software: U.S. export controls for the modern era. Georgetown Journal of International Law, 35, 319-378.

Export Administration Regulations, 15. C.F.R. sec. 730.3 (2004). Retrieved

January 20, 2005 from http://www.access.gpo.giov/his/ index.html

Flanagan, P. & Carnegie, L. (2004 May 24). U.S. foreign trade controls-developments and prospects. Paper presented at the meeting of the Export Control Coordinators Organization 2004 Annual Training Seminar. Retrieved December 10, 2004 from http://supply.lanl.gov/property/ ecco/History/2004/2004ECCO TrainingSessionMinutes.pdf

International Traffic in Arms Regulations, 22 C.F.R. sec. 120 (2004). Retrieved December 10, 2004 from http://pmdtc.org/consolidated-itar.htm

Norris, J.T., Carr, C.T., & Keith, J.L. (24 September 2004). Briefing on "deemed exports" for faculty members and senior research staff. Massachusetts Institute of Technology. Office of Sponsored Programs. Retrieved December 10, 2004 from http://web.mit.edu/osp/www/

Pearl, J. (2004, July 30). The Iceman cometh: How to avoid being put on the 'spot.' The Corporate Counsellor, p. 3.

U.S. Department of Defense. Office of the Inspector General. (2004 March 25). Export controls: Export-controlled technology at contractor, university, and federally funded research and development center facilities (D-2004-061). Retrieved December 1, 2004 from http://www.didig.osd.mil/ audit/reports/

U.S. Department of Commerce. Bureau of Industry and Security. Policies and Regulations. Retrieved December 1, 2004 from http://www.bxa.doc.gov/ DeemedExports

U.S. Department of State. Directorate of Defense Trade Controls. Defense trade controls who we are. Retrieved December 1, 2004 from http://www.pmdtc.org/whoweare.htm