Tom Demke Export Control Compliance Officer SSEC Quality & Safety Manager

1. Export Control Program Level 3 Training ITAR Information Management University of Wisconsin - Madison Tom Demke Export Control Compliance Officer SSEC Quality & Safety Manager

2. Export Control - Level 3 Training • Agenda • What Is ITAR? • Why Do We Care About ITAR? • Definitions • Fundamental Research Exemption • Public Domain • Deemed Export • US Persons • Compliance • Meetings w/ ITAR Information • Means of Transferring Information • Verbal Information • Managing ITAR Paper Documents • Managing ITAR Electronic Information • Non-Disclosure Agreements • Helpful Hints

3. Export Control - Level 3 Training WHAT IS ITAR? • International Traffic in Arms Regulations - 22CFR 120 • Regulated by the US State Department • Purpose - Control the export of military equipment & information regarding military equipment • US Munitions List describes the equipment included under ITAR

4. Export Control - Level 3 Training WHY DO WE CARE ABOUT ITAR? • Controls exportation of arms to non-US persons • Exportation is defined as the transfer of equipment, goods, information or data • Exportation can occur within the US - conferences, seminars • Arms includes items such as: • Guidance systems for missiles - Category IV • IR focal plane arrays (detectors) - Category XII • Weaponized biological agents - Category XIV • Satellites & equipment on satellites - Category XV • Can include H/W, S/W, info, data, services, chemicals, biologicals • Responsibility to comply lies with individual, not UW • It is the individual’s responsibility to ensure they are not transferring ITAR-sensitive goods or data to non-US persons

5. Export Control - Level 3 Training Definitions

6. Export Control - Level 3 Training FUNDAMENTAL RESEARCH EXEMPTION • Fundamental Research Exemption • Because of the multi-national nature of institutions like the UW, universities have been given an exemption from ITAR to conduct fundamental research that is in the public domain • PI or PM needs to assess export control needs @ beginning of project

7. PUBLIC DOMAIN Public Domain Export Control - Level 3 Training • Articles in trade journals, talks at seminars, poster sessions • Public Domain: Information which is published & generally accessible or available to the public • Publishing information to the library or a publicly-accessible website is considered acceptable • Items/information in the public domain are not subject to export control • Publish “early & often”

8. Export Control - Level 3 Training PUBLIC DOMAIN (cont.) • DO NOTaccept limitations to publishing in the project contract • Public domain status cannot be claimed for information subject to a non-disclosure agreement (NDA) • Pay particular attention when working with industry partners

9. Export Control - Level 3 Training DEEMED EXPORT • Transfer of technology, including use of equipment, that has certain export restrictions to a foreign national in the US • This can include controlled information transferred to a foreign national at a conference within the US

10. Export Control - Level 3 Training US PERSON • Corporations, business associations, partnerships or other organizations incorporated to do business in US • Governmental entities

11. Export Control - Level 3 Training Compliance

12. Export Control - Level 3 Training PURPOSE (of the following measures) • Assure compliance with regulations • Prevent need for getting an export license • Prevent inadvertent transfer of controlled information to a foreign national

13. Export Control - Level 3 Training MEETINGS w/ ITAR INFORMATION Meetings Held Here • Reasonable notice to participants prior to meeting that ITAR-sensitive information will be discussed • Advise participants at beginning of meeting & just before ITAR-sensitive information is discussed • Only US Persons attend the ITAR session • Record of ITAR session • Who attended • What ITAR material was discussed • Forward record to your organization’s export control POC

14. Export Control - Level 3 Training MEETINGS w/ ITAR INFORMATION (cont.) Meetings Held Elsewhere • Only US Persons attend the ITAR session • Contact organizational POC or UW ECCO if you have ITAR-related concerns before or after attending a meeting

15. Export Control - Level 3 Training MEETINGS w/ ITAR INFORMATION (cont.) What Can Be Presented • Information in the Public Domain • Released materials (previously cleared for presentation) • New materials (exhaust 1st two bullets before presenting new materials) • Review Team - Each organization should have a review team, if you have questions about what you can present

16. Means of Information Transfer Verbal (or somehow exposed to it) Printed (paper) Documents Electronic Information Use again? Be aware of export requirements Encrypt or place in a password-protected folder Shred Send to librarian Export Control - Level 3 Training MEANS OF TRANSFERRING INFORMATION

17. Export Control - Level 3 Training VERBAL INFORMATION • Person transferring the information is responsible for ensuring that his/her audience can receive the information • Make sure the receivers are US Persons

18. Export Control - Level 3 Training MANAGING ITAR PAPER DOCUMENTS • Authorized individuals may check out documents • US Persons • Exempted persons ITAR Sensitive • Maintain in a locked cabinet w/ a designated librarian • Documents to be returned when no longer needed • Log of documents kept • Name of document, when received & from whom • Documents are stamped • While in use, documents need to be maintained in a manner to prevent inadvertent export

19. Export Control - Level 3 Training MANAGING ITAR ELECTRONIC INFORMATION • Documents, data, software • Files, folders or repositories should be marked ITAR-sensitive • Verify with source if unsure whether information is ITAR • Take special care when using wireless to transfer files

20. Export Control - Level 3 Training MANAGING ELECTRONIC INFO - PERSONNEL GUIDELINES • Recipient is responsible for destroying (delete & empty trash or temporary files) or encrypting the document • Use proper encryption tool • Password of sufficient complexity; do not use existing passwords • After use, either properly delete or re-encrypt them • Remove temporary files created by the application • Unencrypted Files Containing ITAR Information • DO NOT leave unencrypted files unattended on your computer • DO NOT leave unencrypted files in public areas or areas where other users may have access (i.e., shared machines, ftp server, My Documents directory if synced to the Windows server) • DO NOT leave unencrypted files where they may be backed up • DO NOT e-mail unencrypted files

21. Export Control - Level 3 Training NON-DISCLOSURE AGREEMENTS (NDAs) • NDAs may be used in an ITAR-related project • However, because you have a NDA does not mean you have an ITAR • Public domain status cannot be claimed for information subject to a NDA • Talk to your PI or PM whether the subject information is really needed • Individuals do not sign NDAs, the UW does • Forward requests for NDAs to department administration • Department administration forwards the NDA to UW Legal for review & signature

22. Export Control - Level 3 Training HELPFUL HINTS • Ensure ITAR-sensitive paper & electronic information are secure • ITAR-sensitive information should be labeled • However, verify if you are unsure • All ITAR-sensitive information that we have contact with should have its origin outside of the UW • We should not be the original source for any ITAR-related data • Notify management of issues • Publication restrictions • NDA’s • ITAR sessions at meetings • Limit contact with ITAR-sensitive information • DO NOT supply ITAR-sensitive information to a person unless you know they are a US Person or exempt person