2022 Export Compliance Refresher Mississippi State
CM
Published · 27 slides · 0 views
1 / 1
Description
2022 Export Compliance Refresher Mississippi State University Office of Research Compliance Security 1 Program updates The Office of Research Compliance and Security (ORCS) is located on campus at 236 Famous Maroon Band St, we will be
Related Topics
Share
Embed code
Download this presentation From Below
"2022 Export Compliance Refresher Mississippi State" is the property of its rightful owner. Permission is granted to download and print the materials on this website for personal, non-commercial use only, and to display it on your personal computer provided you do not modify the materials and that you retain all copyright notices contained in the materials. By downloading content from our website, you accept the terms of this agreement.
Presentation Transcript
01
2022 Export Compliance Refresher Mississippi State University Office of Research Compliance & Security 1<br>
02
Program updates The Office of Research Compliance and Security (ORC&S) is located on campus at 236 Famous Maroon Band St, we will be moving to the new ORED building located in the Research Park late 2022.
The Data Security position has moved to ITS to manage CUI, NIST, and CMMC for all of MSU.
The Facility Security Officer position has changed to Research Security Officer to align with new and emerging requirements.
ORC&S added a Senior Research Security Analyst position that will specialize in foreign influence. 2<br>
The Data Security position has moved to ITS to manage CUI, NIST, and CMMC for all of MSU.
The Facility Security Officer position has changed to Research Security Officer to align with new and emerging requirements.
ORC&S added a Senior Research Security Analyst position that will specialize in foreign influence. 2<br>
03
Welcome to Export Compliance Refresher The goal of this presentation is to refresh your awareness of the Export Compliance Regulations – EAR, ITAR & OFAC.
This presentation should only be taken by those personnel who have completed the initial online CITI training and are due for their 2-year refresher training.
This presentation does not count for initial training.
References:
MSU Export Policy 70.04
National Archives CUI Program
15 CFR Bureau of Industry and Security (BIS)
31 CFR Office of Foreign Assets Control (OFAC)
22 CFR Department of State 3<br>
This presentation should only be taken by those personnel who have completed the initial online CITI training and are due for their 2-year refresher training.
This presentation does not count for initial training.
References:
MSU Export Policy 70.04
National Archives CUI Program
15 CFR Bureau of Industry and Security (BIS)
31 CFR Office of Foreign Assets Control (OFAC)
22 CFR Department of State 3<br>
04
Back to Basics Not everything is “ITAR” controlled... The blanket term is “Export Controlled” which covers ITAR and EAR. There are lots of exceptions in the EAR, so it can be export controlled in the EAR and potentionally have no control requirements. We must classify the item/article, technology, and usage in order to know.
The best place to start is to ask the sponsor or manufacturer what ITAR category it is or what ECCN covers it. Please engage the Export Control Officer for help. 4 Start Define the activity. Is it controlled? Who has jurisdiction ITAR or EAR? ITAR Regs EAR Regs Not controlled Yes No<br>
The best place to start is to ask the sponsor or manufacturer what ITAR category it is or what ECCN covers it. Please engage the Export Control Officer for help. 4 Start Define the activity. Is it controlled? Who has jurisdiction ITAR or EAR? ITAR Regs EAR Regs Not controlled Yes No<br>
05
What exactly are we talking about? Controlled equipment?
It doesn’t matter who owns it or how long it has been in our possession. If it is “controlled” we have to determine if it is in an ITAR category, or it has an EAR/Export Control Classification Number (ECCN). The classification tells us how to control it. Equipment controls determine which countries can have access it. Classification also tells us if a license is required for shipments outside the U.S.
Data control requirements?
This can be as easy as applying permission on a folder all the way to NIST SP 800-171. Each project is individually evaluated to determine the proper level of controls needed. Controlled Unclassified Information (CUI) is a defining factor for all projects, especially if there is a NIST SP 800-171/DFAR 252.204-7012 contractual requirement. The NIST requirement is cumbersome and the only place that currently meets this requirement is the High Performance Computing Collaboratory (HPC2) and they have a thorough Acceptable Use Policy. The new term you will hear is CMMC and it is based in NIST.
Personnel restrictions?
This can be driving by the controlled equipment classification. It can also be an explicit requirement in the Statement of Work. For example, we can have DoD award that identifies the research as ITAR Category VII, Ground Vehicles. ITAR is restricted to U.S. Person’s only. This statement will be accompanied by several DFARS clauses. There are potential exemptions, but they are not covered in this training.
Publication restrictions?
Don’t confuse review with approval. Most sponsors require a copy of a publication to review which is not a restriction. If they require their approval before you can publish, then it is a restriction. The most common example is DFARS 252.204-7000 Disclosure of Information; however, DOE and NASA have their own versions. 5<br>
It doesn’t matter who owns it or how long it has been in our possession. If it is “controlled” we have to determine if it is in an ITAR category, or it has an EAR/Export Control Classification Number (ECCN). The classification tells us how to control it. Equipment controls determine which countries can have access it. Classification also tells us if a license is required for shipments outside the U.S.
Data control requirements?
This can be as easy as applying permission on a folder all the way to NIST SP 800-171. Each project is individually evaluated to determine the proper level of controls needed. Controlled Unclassified Information (CUI) is a defining factor for all projects, especially if there is a NIST SP 800-171/DFAR 252.204-7012 contractual requirement. The NIST requirement is cumbersome and the only place that currently meets this requirement is the High Performance Computing Collaboratory (HPC2) and they have a thorough Acceptable Use Policy. The new term you will hear is CMMC and it is based in NIST.
Personnel restrictions?
This can be driving by the controlled equipment classification. It can also be an explicit requirement in the Statement of Work. For example, we can have DoD award that identifies the research as ITAR Category VII, Ground Vehicles. ITAR is restricted to U.S. Person’s only. This statement will be accompanied by several DFARS clauses. There are potential exemptions, but they are not covered in this training.
Publication restrictions?
Don’t confuse review with approval. Most sponsors require a copy of a publication to review which is not a restriction. If they require their approval before you can publish, then it is a restriction. The most common example is DFARS 252.204-7000 Disclosure of Information; however, DOE and NASA have their own versions. 5<br>
06
What is an Export? Transfer of controlled technology, information, equipment, software or services to a foreign person in the U.S. or abroad by any means.
For example:
actual shipment outside the US
visual inspection in or outside the US
written or oral disclosure<br>
For example:
actual shipment outside the US
visual inspection in or outside the US
written or oral disclosure<br>
07
Why do we have Export Laws? Restrict exports of goods and technology that could contribute to the military potential of adversaries
Prevent proliferation of weapons of mass destruction (nuclear, biological, chemical)
Prevent terrorism
Comply with U.S. trade agreements and trade sanctions against other nations 4<br>
Prevent proliferation of weapons of mass destruction (nuclear, biological, chemical)
Prevent terrorism
Comply with U.S. trade agreements and trade sanctions against other nations 4<br>
08
Why do Export Laws seem so complicated?? Depending on your specific program it can be governed by 1 of 3 different Departments of Government:
State Department: International Traffic in Arms Regulations (ITAR), which pertain to inherently military technologies
Commerce Department: Export Administration Regulations (EAR), which pertain to “dual use” technologies (civilian or military use)
Treasury Department, Office of Foreign Assets Control (OFAC): Prohibits certain transactions with countries subject to boycotts, trade sanctions and embargoes 8<br>
State Department: International Traffic in Arms Regulations (ITAR), which pertain to inherently military technologies
Commerce Department: Export Administration Regulations (EAR), which pertain to “dual use” technologies (civilian or military use)
Treasury Department, Office of Foreign Assets Control (OFAC): Prohibits certain transactions with countries subject to boycotts, trade sanctions and embargoes 8<br>
09
ITAR or the International Traffic in Arms Regulations is administered by the U.S. Department of State – Directorate of Defense Trade Controls (DDTC)
ITAR is based upon the AECA (The Arms Export Control Act), 22 USC 2778 & the International Economic Emergency Powers Act: 50 USC 1701-1707
The actual ITAR regulations that provide the governance of ITAR are found in 22 CFR 120-130 Chapter I, Subchapter M, Parts 120-130
ITAR governs Classified and Unclassified Defense Articles, Defense Services, Technical Data, Significant Military Equipment (as defined in ITAR 22 CFR 120) and items designed and developed, adapted, or modified in any manner for military use.<br>
ITAR is based upon the AECA (The Arms Export Control Act), 22 USC 2778 & the International Economic Emergency Powers Act: 50 USC 1701-1707
The actual ITAR regulations that provide the governance of ITAR are found in 22 CFR 120-130 Chapter I, Subchapter M, Parts 120-130
ITAR governs Classified and Unclassified Defense Articles, Defense Services, Technical Data, Significant Military Equipment (as defined in ITAR 22 CFR 120) and items designed and developed, adapted, or modified in any manner for military use.<br>
10
Why do we have ITAR?? The US government restricts the release of strategically important technology and products for the purpose of:
Limiting Weapons of Mass Destruction (WMD) proliferation
Preventing our adversaries from obtaining the capability to threaten US national security
Ensuring U.S. allies have the best equipment and know-how
Preventing supply shortages of critical materials
Supporting US foreign policy (human rights, trade sanctions, embargoes) 10<br>
Limiting Weapons of Mass Destruction (WMD) proliferation
Preventing our adversaries from obtaining the capability to threaten US national security
Ensuring U.S. allies have the best equipment and know-how
Preventing supply shortages of critical materials
Supporting US foreign policy (human rights, trade sanctions, embargoes) 10<br>
11
ITAR vs EAR 11<br>
12
At the University of Michigan, a research fellow shipped an MRI coil to Iran without a license. The research fellow was not aware he needed it, but even without demonstrable intent, the research fellow was criminally prosecuted for the shipment and subjected to civil penalties as well. 12<br>
13
At the University of Tennessee a former professor of electrical engineering, served four years in prison for committing conspiracy, wire fraud and 15 counts of exporting “defense articles and services” without a license. Among other violations, he unlawfully traveled to China with a laptop containing sensitive Department of Defense files and employed an Iranian and a Chinese graduate student in his lab without securing the required federal licenses. 13<br>
14
At the University of Massachusetts at Lowell, researchers exported an atmospheric sensing device, antenna and cables valued at slightly more than $200,000 to Pakistan’s Space and Upper Atmosphere Research Commission. Because the university did not secure a license for the shipment to the Pakistani commission — which is on the bureau’s entity list of individuals, businesses and government and private organizations that are subject to licensing requirements — the university was fined $100,000. 14<br>
15
15 Academic Cases<br>
16
Common Terms 1 Deemed Export - The release or transmission of controlled information, technology or source code that is subject to export control to a foreign national inside the U.S. This can be via discussions with students, graduate students, visitors or foreign researchers. Such a release of controlled information is considered to be an export to the foreign national’s home country.
Fundamental Research – As defined by the National Security Decision Directive 189 (NSDD 189), fundamental research is any “basic and applied research in science and engineering, the results of which are ordinarily published and shared broadly within the scientific community…” Information that results from Fundamental Research is not subject to export control. However, if a company, college or university accepts any type of restriction on a contract or project, be it on publication rights, dissemination of results, etc., the fundamental research exemption will not apply. Also known as Fundamental Research Exemption (FRE). 16<br>
Fundamental Research – As defined by the National Security Decision Directive 189 (NSDD 189), fundamental research is any “basic and applied research in science and engineering, the results of which are ordinarily published and shared broadly within the scientific community…” Information that results from Fundamental Research is not subject to export control. However, if a company, college or university accepts any type of restriction on a contract or project, be it on publication rights, dissemination of results, etc., the fundamental research exemption will not apply. Also known as Fundamental Research Exemption (FRE). 16<br>
17
Common Terms 2 Technology Control Plan (TCP) – The TCP is an internal university compliance document that is prepared by ORC&S with heavy input from the PI. It states the type of export-controlled information associated with a research project, and security measures to be taken by the PI to ensure access to the export-controlled information is controlled and managed. The TCP is signed by the PI and all who are working on the project. Once the TCP is in place it is the responsibility of the PI to ensure that all the security measures listed to safeguard the controlled information or technology are enforced.
All members working on a controlled project must:
1. Be current on export training (CITI or refresher not to exceed 2 yr)
2. Provide citizenship documents to ORC&S, and
3. Sign the applicable NdA and TCP acknowledgement before working or charging time to the contract/fund number. 17<br>
All members working on a controlled project must:
1. Be current on export training (CITI or refresher not to exceed 2 yr)
2. Provide citizenship documents to ORC&S, and
3. Sign the applicable NdA and TCP acknowledgement before working or charging time to the contract/fund number. 17<br>
18
Common Terms 3 Technical Data – For ITAR purposes: Information, other than software as defined in 22 CFR 120.10(4), which is required for the design, development, production, manufacture, assembly, operation, repair, testing, maintenance or modification of defense articles. For EAR purposes: an export of technology that is required for the “development, production or use” of items on the Commerce Control List is controlled according to the provisions in each product category.
Technology - Technical information beyond general and basic marketing materials about a controlled commodity. The term does not refer to the controlled equipment/commodity itself, or to the type of information contained in publicly available user manuals. Rather, the terms "technology" and "technical data" mean specific information necessary for the “development”, “production”, or “use” of a commodity, and usually takes the form of blueprints, drawings, photographs, plans, diagrams, models, formulae, tables, engineering specifications, and documentation. The "deemed export" rules apply to the transfer of such technical information to foreign nationals inside the U.S. 18<br>
Technology - Technical information beyond general and basic marketing materials about a controlled commodity. The term does not refer to the controlled equipment/commodity itself, or to the type of information contained in publicly available user manuals. Rather, the terms "technology" and "technical data" mean specific information necessary for the “development”, “production”, or “use” of a commodity, and usually takes the form of blueprints, drawings, photographs, plans, diagrams, models, formulae, tables, engineering specifications, and documentation. The "deemed export" rules apply to the transfer of such technical information to foreign nationals inside the U.S. 18<br>
19
22 CFR § 126.1 - Prohibited exports, imports, and sales to or from certain countries (reg excerpt) It is the policy of the United States to deny licenses and other approvals for exports and imports of defense articles and defense services, destined for or originating in certain countries. The exemptions provided in this subchapter, or when the recipient is a U.S. government department or agency, do not apply with respect to defense articles or defense services originating in or for export to any proscribed countries, areas, or persons.
Exports or temporary imports of defense articles or defense services to countries that the Secretary of State has determined to be State Sponsors of Terrorism are prohibited under the ITAR. Exports to countries that the Secretary of State has determined and certified to Congress, pursuant to section 40A of the Arms Export Control Act (22 U.S.C. 2781) and Executive Order 13637, are not cooperating fully with United States antiterrorism efforts are subject to the policy specified in paragraph (a) of this section. The Secretary of State makes such determinations and certifications annually. 19<br>
Exports or temporary imports of defense articles or defense services to countries that the Secretary of State has determined to be State Sponsors of Terrorism are prohibited under the ITAR. Exports to countries that the Secretary of State has determined and certified to Congress, pursuant to section 40A of the Arms Export Control Act (22 U.S.C. 2781) and Executive Order 13637, are not cooperating fully with United States antiterrorism efforts are subject to the policy specified in paragraph (a) of this section. The Secretary of State makes such determinations and certifications annually. 19<br>
20
ITAR Prohibited Countries (126.1): 1. Afghanistan 2. Belarus (no exceptions) 3. China (no exceptions) 4. Central African Republic 5. Cuba (no exceptions) 6. Cyprus 7. Democratic Republic of Congo 8. Eritrea 9. Haiti 10.Iran (no exceptions) 11.Iraq 12.Lebanon 13.Libya 14.Myanmar (formerly Burma, no exceptions) 15.North Korea (no exceptions) 16.Russia (new as of 03/08/2021) 17.Somalia 18.South Sudan 19.Sudan 20.Syria (no exceptions) 21.Venezuela (no exceptions) 22.Zimbabwe Ref 22 CFR 126.1 for listed exceptions, current as of 1/3/2022<br>
21
Top 10 Common Issues for Universities – Export Compliance* Sharing controlled information with foreign nationals in the U.S.
Misusing the fundamental research exemption
Inadvertently disclosing controlled information
Forgetting to monitor the transfer of your foreign national employees
Forgetting to screen end users even if the export is EAR 99
Misclassifying information & items
Assuming a third party has the export control responsibility
Failing to document your compliance properly
Not understanding the nuances of export control reform
Not having enough funding for training and export staff
* From Higher Education Webinar dated August 18, 2015, “ Top Ten Export Control Issues for Colleges and Universities” presented by Baker Donelson, Doreen Edelman, Esq., and Klint Alexander, Esq. 21<br>
Misusing the fundamental research exemption
Inadvertently disclosing controlled information
Forgetting to monitor the transfer of your foreign national employees
Forgetting to screen end users even if the export is EAR 99
Misclassifying information & items
Assuming a third party has the export control responsibility
Failing to document your compliance properly
Not understanding the nuances of export control reform
Not having enough funding for training and export staff
* From Higher Education Webinar dated August 18, 2015, “ Top Ten Export Control Issues for Colleges and Universities” presented by Baker Donelson, Doreen Edelman, Esq., and Klint Alexander, Esq. 21<br>
22
Dissertation & Thesis use: ORC&S has worked with The Graduate School to develop questions on the graduate application form to help identify controlled information that requires permission from the sponsor prior to public release. Publication restrictions can take many forms, typically, this comes from a contractual obligation in the DFARS 252.204-7000 clause.
If a student wishes to utilize any data or information that was derived from a controlled project in a dissertation or thesis, permission must be obtained from the contract sponsor prior to the use of the controlled information or data.
Obtain permission early (allow for 45-60 days for approval) from the applicable contract authority, and get it in writing! 22<br>
If a student wishes to utilize any data or information that was derived from a controlled project in a dissertation or thesis, permission must be obtained from the contract sponsor prior to the use of the controlled information or data.
Obtain permission early (allow for 45-60 days for approval) from the applicable contract authority, and get it in writing! 22<br>
23
Penalties 23<br>
24
Final Thoughts Know who can or cannot work on a controlled project.
Know who you can and cannot discuss/share project information – Deemed export rule.
If in doubt, keep discussions to your specific project/task group
Protect information from unauthorized disclosure.
Remember security requirements are connected to the data, information, results and technology from a controlled research project UNLESS the contract sponsor has previously approved otherwise.
If you have any questions contact your respective PI, Co-PI or ORC&S. 24<br>
Know who you can and cannot discuss/share project information – Deemed export rule.
If in doubt, keep discussions to your specific project/task group
Protect information from unauthorized disclosure.
Remember security requirements are connected to the data, information, results and technology from a controlled research project UNLESS the contract sponsor has previously approved otherwise.
If you have any questions contact your respective PI, Co-PI or ORC&S. 24<br>
25
Reporting a Violation When individuals intentionally provide incomplete or incorrect information in the grant funding process or misappropriate trade secrets or export-controlled equipment/ materials/ information.
You can directly contact the Export Control Officer or anyone in the Office of Research Compliance and Security.
Anonymous Submissions can be made on the MSU Ethics Point website, https://secure.ethicspoint.com/domain/media/en/gui/24520/index.html
Click: Make a Report Research Research Security/Export Control 25<br>
You can directly contact the Export Control Officer or anyone in the Office of Research Compliance and Security.
Anonymous Submissions can be made on the MSU Ethics Point website, https://secure.ethicspoint.com/domain/media/en/gui/24520/index.html
Click: Make a Report Research Research Security/Export Control 25<br>
26
Contact info 26<br>
27
Certificate of Completion Please print and fill out this slide after completing the 2022 Export Control Refresher training. Scan and attach it to an e-mail to ResearchSecurity@ors.msstate.edu
I have completed the Mississippi State University Office of Research Compliance & Security 2022 Export Control Refresher briefing and understand my role in protecting controlled information from unauthorized disclosure.
Employee Signature: ____________________________________
Printed Name: _________________________________________
Net ID: _________________
Date : __________________ 27<br>
I have completed the Mississippi State University Office of Research Compliance & Security 2022 Export Control Refresher briefing and understand my role in protecting controlled information from unauthorized disclosure.
Employee Signature: ____________________________________
Printed Name: _________________________________________
Net ID: _________________
Date : __________________ 27<br>