Advisory Guidance

Collaborating and consulting are an integral, and certainly encouraged, aspect of life here at The University of Chicago (“UChicago”); however, consulting and collaborating frequently implicate export control concerns.

Under U.S. export control regulations an “export” is any transmission of controlled items, information, or services (including their associated materials) to a non-U.S. person. A “U.S. person” is defined as a U.S. entity or citizen – a person lawfully admitted for permanent residence in the U.S. (i.e., green card holder), or a person who is a protected individual under the Immigration and Naturalization Act (i.e., certain classes of asylees).

The application of export control regulations is much broader than simply the shipment of a tangible item across the U.S. boarder. In fact, the definition of export includes the transfer of controlled information or services to foreign nationals even when the transfer takes place within U.S. – a deemed export. Deemed exports are particularly relevant to university research because of the nature of the university setting and the necessary and encouraged exchange of information.

An “export” (including a “deemed export”) may occur through:

• a demonstration;
• oral briefing;
• telephone call or message;
• laboratory or plant visit;
• presenting at conferences and meetings;
• faxes or letters;
• hand-carried documents, hardware or drawings;
• design reviews;
• exchanging electronic communication (including emails and text messages); or
• posting non-public data on the Internet or the Intranet;

The Office of Foreign Assets Control (“OFAC”) maintains lists of Specially Designated Terrorists and Specially Designated Nationals, Blocked Persons, and Sanctioned Countries, with whom U.S. persons are prohibited from engaging in any transactions, regardless if the person or entity is a “U.S. person” or a “foreign person.” Transfers of any items, information, or services to individuals, entities, or countries on these lists are prohibited without the prior approval of OFAC. Such lists must be regularly screened to ensure that UChicago does not engage in a transaction with these barred entities and persons.

Export control risks are especially acute when dealing with Chinese persons or entities. Please consult “Activities in China and Export Controls.”

All personnel are encouraged to contact the Manager of Export Control Compliance (MECC) for guidance and evaluation prior to collaborating with a foreign person or entity. The MECC can assist staff and faculty with:

• the screening of potential collaborators using Visual Compliance™;
• determining whether an export license is required;
• determining whether a license exception applies;
• filing a license application (if required); and
• maintaining appropriate records

Working with the Manager of Export Control Compliance well ahead of collaborating with a foreign person or entity is the best way to ensure that your will not run afoul of export control laws and/or regulations. If you have any questions or concerns, please contact the Manager of Export Control Compliance (contact information at bottom of page)

Per U.S. export control regulations/laws, an “export” is any oral, written, electronic or visual disclosure of a controlled commodity, technology or software/codes to a foreign entity or individual, this includes presenting at international conferences or meetings. 

As a conference presenter and a student/faculty member of The University of Chicago (“UChicago”), it is important to ensure that any material that you present at a conference or meeting is in the “public domain” or is “fundamental research.”    Generally, information is in the “public domain” if it is published and generally accessible or available to the public.  “Fundamental research” includes basic or applied research in science and/or engineering at an accredited institution of higher learning in the United States where the resulting information, in some cases, is ordinarily published and shared broadly in the scientific community and, in other cases, where the resulting information has been or is about to be published.  

In both instances, information that is in the “public domain” or is “fundamental research,” information is published if it appears in periodicals, books, print, electronic or any other media available for general distribution to any member of the public or to those that would be interested in the in a scientific or engineering discipline.

Additionally, export control restrictions do not apply to information released at open conferences.  A conference is “open” if all technically qualified members of the public are eligible to attend and attendees are permitted to take notes or otherwise make a personal record (but not necessarily a recording) of the proceedings and presentations. Access to the information must be free or for a fee that does not exceed the cost to produce and distribute the material or hold the conference (including a reasonable profit).

All UChicago personnel are encouraged to contact the Manager of Export Control Compliance (“MECC”) for guidance and evaluation prior to attending or participating in an international conference.  The MECC will provide support for attendance or participation in conferences affiliated with University work.   The MECC can assist in the following:

• the screening of potential collaborators using Visual Compliance™;
• determining whether the conference is “open”
• determining what information may be shared without a license
• determining whether an export license is required; and
• maintaining appropriate records

U.S. export control regulations define “export” as both a physical shipment of a tangible item out of the U.S. as well as the transmission of export controlled information and software via electronic communications. Such electronic communications include sending export controlled information to a foreign person or entity, either in or outside of the United States territory by fax, email, text, or instant message. The University of Chicago (“UChicago”) is committed to complying with all U.S. export control regulations/laws.  Therefore, as an employee, student, principal investigator, or fellow of UChicago, you need to be aware of your responsibilities under U.S. export control regulations/laws.

Export controlled data and information must be transmitted in a safe and consistent manner. Electronic communications and databases managed by UChicago are managed via a type of Virtual Private Network (“VPN”)  specifically a Secure Socket layer (“SSL”) which limits access to authorized users only and facilitates exchanges between those authorized users while encrypting (128 bit encryption) any data sent via Internet.

Helpful Tips

When transmitting export controlled data electronically, please consider the following:

• Password protect, encrypt, or remove all controlled data from any communications before transmitting
• Only transmit controlled data via voice or fax where there is reasonable assurance that access is limited to authorized persons;
• Detect exfiltration of data using firewalls, router policies, intrusion prevention/detection systems, or host-based security services;
• Transfer controlled information only on a need to know basis; and
• Ensure that anti-virus, anti-spyware, and personal firewall software is properly installed and activated

Under U.S. export control regulations an “export” can include the transmission of export controlled data via electronic communication. Improperly using devices/systems such as cloud servers, shared databases, or online databases to store data may also result in an export. The University of Chicago (“UChicago”) is committed to complying with all U.S. export control regulations/laws.  Therefore, as an employee, student, principal investigator, or fellow of UChicago, you need to be aware of your responsibilities under U.S. export control laws.

Mobile Devices

Storage of export controlled materials on laptops or removable storage devices such as USB drives, external portable hard drives, CDs/DVDs, etc. should be avoided, in lieu of storage on isolated UChicago servers.  However, if you must use these storage devices, it is imperative to maintain the integrity of those devices so that prohibited person cannot gain access to the controlled data stored on them. 

All export-controlled information must be encrypted if stored on any mobile storage device. The preferred encryption tools are PGP or GPG although WinZip or 7-Zip may also be used, if a strong password is used, and that the password is transmitted securely and independently from the transmission of the export-controlled data.

Additionally, if you plan to take your laptop to a foreign country, it is best to ensure that there is no export controlled data saved to the hard drive.  Instead, ask your department if it can provide you with a “clean” laptop and leave your controlled research data in the U.S. If you are unsure if your data may be export controlled, please contact the Manager of Export Control Compliance

Cloud Computing

Cloud computing or the use of virtual clouds involves the use or sharing of computers, hardware, software, servers, storage facilities, and/or computational functionalities virtually linked by and through the internet.  Storage of export controlled data on virtual clouds should be avoided; all such materials should be stored on isolated UChicago servers. 

With cloud services, the user may not know the physical location of the server, through which countries the data is routed before getting to the server, or whether any other deemed exports are occurring while the data is with the cloud service provider (“CSP”).  Despite their actions with a customer’s data, CSPs are not the "exporter" of that data.  The customer is ultimately responsible for export control compliance of any such data because the customer receives the primary benefit of the transaction.

Before entering into an agreement with a CSP, first check with the Information Technology Services department to see what resources are already available.  If no other resources are available to meet your needs, before entering into an agreement with the CSP, ask the following:

• where are the servers and routers located;
• what measures does the CSP have in place to prevent unauthorized foreign nationals from accessing controlled technology and software wherever located;
• does or will the CSP employ foreign nationals for account maintenance; and
• will data ever be transferred out of the country

Shared Databases

Storing export controlled data in shared files or shared databases (multi-user) in lieu of isolated UChicago servers should be avoided.  In such cases where controlled data will be run on a shared/multi-user system, the following additional guidelines apply:

• the directories containing the software shall be access controlled so that only its designated user(s) as approved by the PI will have read, write and execute permissions. All others shall have no access permissions;
• the shared system shall have audit logging enabled, and the audit logs shall be backed up;
• the shared system shall be managed solely by U.S. Persons, as defined in the export regulations. All users with privileges must be U.S. Persons; and 
• only U.S. Persons shall have unescorted physical access to the shared system.

Working with the Manager of Export Control Compliance, before using any of the above mechanism to store export controlled data, is the best way to ensure that you will not run afoul of export control laws and/or regulations. 

When traveling internationally as an employee, student, principal investigator, or fellow of The University of Chicago (“UChicago”), you need to know your responsibilities under U.S. export control regulations.  Traveling abroad and taking certain items, providing certain services, or meeting with certain people can present export control problems. This document provides guidance on how to avoid running afoul of U.S. export control regulations when traveling internationally.

Travel to most countries does not present an export control problem; however, travel to some countries may present a problem.  However, those issues can easily be addressed, if we create and maintain records, which demonstrate that the travel was exempt from the export control regulations. Even so, when an export control license is required for travel, it is crucial that we obtain it prior to the trip as violations of U.S. export control laws carry severe civil and criminal penalties for both UChicago and the offending individual.

Please review the information below to learn about activity specific restrictions.

Restricted Parties

Certain foreign parties – including specific people, businesses, research institutions, universities, government and private organizations, and other types of legal persons – may be subject to federal U.S. prohibitions.  Such prohibitions may include prohibitions on research collaborations, and may require specific licensing, even for educational exchange.  Such prohibitions are specified on several federally maintained restrictive lists.  It is important to review these lists and understand compliance responsibilities and limitations before collaborating, or sponsoring an employee or visiting scholar of a university listed therein.  UChicago uses Visual Compliance™ to expedite screening of the restrictive party lists. 

Sanctioned Countries

Educational exchange, including travel to any entity on any of the restrictive lists has specific license requirements and exemptions typically do not apply; the government has a policy of denial for licensing many of the entities on the lists.  Before you travel, visit both The Office of Foreign Assets Control’s (“OFAC”) and The Bureau of Industry and Security’s (“BIS”) websites to determine whether you will be visiting a sanctioned country, or contact the Manager of Export Control Compliance (“MECC”) for further guidance.

Purpose of the Trip

Presentations & Seminars: In general, travel outside of the U.S. to attend a conference - not to present - does not require an export control license. However, if you present at a conference, the material must be limited to topics that are not related to export-controlled items or technologies, unless that information is already in the public domain. Open seminars are usually not problematic unless they take place in a sanctioned country or involve restricted parties. Exchanges of technical information including academic discussions could require a license.

Foreign Collaborations & Exchanges of Technical Information: Publically available information or fundamental research can be shared with foreign colleagues as long as the recipients are not employees or representatives of the government of a sanctioned country, or restricted parties. This collaboration includes normal academic peer-review or publishing processes.

Research & Instruction Outside of the U.S.: Research and course instruction conducted outside of the U.S. may not qualify for the fundamental research exclusion and therefore may require an export control license. For instance, when interacting with foreign persons, you cannot provide a “defense service” which includes providing technical “know-how” related to the design, development, production, manufacturer, assembly, operation, repair, testing, maintenance or modification of a defense article or dual-use technology.  Export control regulations may apply until the work is published or is otherwise in the public domain. Before teaching a course or disclosing information outside of the U.S. it is important to ensure that the information is not subject to export control laws and regulations.

Furnishing Financial Assistance:  OFAC regulations prohibit providing material financial assistance or anything of value, including services, to any blocked or sanctioned country, individual, entity or organization, including a government agency of a sanctioned country. This can involve subcontracts, international vendors or payments to research participants. For example, a professional presentation, whether or not it contains materials controlled under International Traffic in Arms Regulations (“ITAR”) or Export Administration Regulations (“EAR”), is a “service” and “something of value” provided to the recipient audience, under OFAC regulations.  Contact the MECC for guidance and clearance before proceeding with this type of transaction.

Export of Equipment or Data

Any tangible items that you take to a foreign country are considered “exports” by the U.S. Government, even if you are planning to bring the items back upon your return. 

Even the technical information located on your laptop’s hard drive is considered to be an export of technology/technical data, once the laptop or notebook leaves the U.S. If you are traveling abroad with your laptop or any other electronic devices, these items along with the underlying technology, any data on your device, proprietary information, confidential records, and encryption software are all subject to U.S. export control regulations.  Some foreign governments have regulations that permit the seizure of travelers’ computers and the review of their contents. 

You need to comply with U.S. export regulations whenever you take such equipment and data outside of the U.S.  Items that could have a “dual-use” (both commercial and military or proliferation applications), proprietary information, or items that are considered defense articles (even if used in an academic or research environment) are generally prohibited from export without an export control license.  Export control regulations will generally not restrain you from taking commercially available laptop computers and standard software to most countries. 

Further, items may be exempt from the license under the temporary export exception (TMP) as a “tool of trade.”  To qualify for the “tool of trade” exception, the export must:

1. Remain under the effective control of the exporter (or the exporter’s employees) by retaining physical possession of the equipment at all times or securing the item in a secure environment;
2. Consist only of reasonable equipment of the trade (equipment that people in your discipline would generally recognize as a ”tool of trade”);
3. Not be to an embargoed country (Cuba, Iran, North Korea, Syria or Sudan);
4. Be carried with the exporter or shipped ahead within 30 days of exporter’s travel
5. Be data that is within the public domain; and
6. Be for less than one (1) year. 

You should not take ANY of the following items, abroad, without first obtaining specific advice from the MECC:

1. UChicago-owned scientific equipment (other than a sanitized laptop computer, PDA or electronic storage device);
2. Data or information received under an obligation of confidentiality including private information about research subjects;
3. Data or analyses that result from a project for which there are contractual constraints on the dissemination of the research results;
4. Devices, equipment or computer software received with restrictions on export to or on access by foreign nationals;
5. Devices, systems or software that was specifically designed or modified for military or space applications; or
6. Classified information

If U.S. Customs and Border Protection officials suspect that a regulated item or defense article has been exported without a license, they may, for example, on your return examine files and software on your laptop computer as well as your baggage. For this reason, international travelers are encouraged to “sanitize” electronic devices by removing all non-essential data prior to leaving the United States. Inspectors in other countries may detain and copy your hard drive. Alternate safeguard methods include taking a blank laptop with only public domain files needed for the specific international trip or encrypting and then e-mailing to yourself any information you may need while overseas. Do not retrieve the e-mail until you have reached your destination, and remember you will need to remove it completely prior to returning to the U.S. or prior to crossing any international border.

Helpful Tips

When traveling internationally: 

• Use your best judgment in communicating with foreign nationals, and be alert to situations that may result in inadvertent, inappropriate, or illegal disclosure of controlled information or data;
• Avoid situations that lead to providing advice or assistance outside of fundamental research parameters; 
• Do not discuss controlled or sensitive information (for example, proprietary information that you may happen to have) in public places; 
• Always keep controlled or sensitive items, information, or data secure; 
• Maintain a “need-to-know” policy when discussing work related information with others; 
• Do not leave equipment, documents, or data in your hotel safe.

Working with the Manager of Export Control Compliance well ahead of your international trip is the best way to ensure that your travel is permitted and/or that your materials and data can be taken abroad without a license or without violating export control laws and/or regulations. 

(1)     The proprietary/confidential information can be either in hardcopy or in electronic form

(2)     “Effective Control” is defined as retaining physical possession of the item, or securing the item in such an environment as a hotel safe, bonded warehouse, or a locked or guarded exhibition facility. 

(3)     The list of embargoed countries changes periodically.  Please check with the Manager of Export Control Compliance for an updated list.

U.S. export control regulations restrict the access of certain sensitive materials and their associated data and technologies by certain foreign people and by people who have previously engaged in prohibited conduct.  In accordance with these regulations, The University of Chicago (“UChicago”) must identify and track all controlled data, material, and technologies that it procures. 

Whenever possible, UChicago prefers to rely on manufacturers and/or vendors to provide the export control status of items and software being obtained through a procurement activity. UChicago’s Supplement to Purchase Order (“STOP”) now includes a term requiring vendors to notify the university if procured material is controlled and to provide the Export Control Classification Number (“ECCN”) or US Munitions List (“USML”) prior to delivery.  Regardless of the purchasing mechanism, purchasers are required to request the category ECCN number or USML Category for any material, data, or technology they are procuring, if they have reason to believe the items will be subsequently exported.

Once the vendor has identified an item controlled by the International Traffic in Arms Regulations or Export Administration Regulations or should an export control notice be included with a procured item, please secure the identified material so that foreign persons may not have access to it. Then, forward the documentation to the Manager of Export Control Compliance (“MECC”) for guidance and clearance.

In cases where the vendor does not know the export control status of an item  or refuses to provide export control information to the University, contact the MECC before proceeding with the purchase so that an analysis can be performed to definitively establish the status of the material.

All personnel are encouraged to contact the MECC for guidance and evaluation with any questions or concerns regarding purchasing, as it relates to export control issues.  The MECC will provide support for any University purchase, including:

• reviewing export control language in purchasing contracts;
• determining if purchased material is controlled;
• determining whether an export license is required;
• determining whether a license exception applies;
• filing a license application; and
• maintaining appropriate records.

Working with the Manager of Export Control Compliance well ahead of your purchase is the best way to ensure that your procurement is the best way to ensure that you will not run afoul of export control laws and/or regulations.  

International shipping of certain items, technology, or software is subject to U.S. export control regulations.  All of The University of Chicago’s (“UChicago”) personnel, who engage in international shipping, must comply with all U.S. export control laws and regulations, or risk substantial penalties.  The Manager of Export Control Compliance (“MECC”) in University Research Administration is available to assist you in complying with all U.S. export control regulations. 

Under U.S. export control regulations, anything that leaves the US is an export, including tangible and intangible material, regardless of the purpose for the shipment.  Export control regulations apply to everyday consumer items that are purchased directly from manufacturers and to items purchased “off the shelf.” Shipment of technical information related to these items such as manuals, blueprints, diagrams, and unpublished research results are also controlled by export control regulations.  Generally, an export license is required to export items that are: (1) listed on the Commerce Control List (“CCL”) or the U.S. Munitions List (“USML”); (2) being exported to a restricted party/entity; or (3) being exported to an embargoed or sanctioned country.    

Before an item can be shipped internationally, it must be reviewed to determine if a license or other government approval is needed. The review includes determining:

• The item(s) export control classification or category;
• If the shipment is to an embargoed or sanctioned country;
• If the shipment to the destination country requires a license;
• The end-user; and
• If the end-use is prohibited.

Additionally, U.S. export control regulations require documentation of certain information when shipping internationally. A shipping forwarder can help with this documentation, but the forwarder will rely on the person ordering the delivery, for information about the shipment (and that person is legally responsible for the information contained therein).  The shipping forwarder will generally ask for the following information regarding the shipment’s destination and recipient:

• Destination port of entry.
• Time, origin of shipment, names of shipper and receiver
• Detailed description:  item name, grade, marking, Harmonized Tariff Schedule number, country of origin
• Quantity and value
• Type of export, reason for export
• Export control summary (No License Required, EAR exception, ITAR exemption, or license)
• Destination Control Statement

For most items, review will take only a few minutes.  All personnel are encouraged to contact the MECC for guidance and evaluation prior to shipping material internationally.  The MECC can assist shippers with:

• the screening of potential collaborators using Visual Compliance™;
• determining whether an export license is required;
• determining whether a license exception applies;
• filing a license application (if required); and
• maintaining appropriate records

Working with the Manager of Export Control Compliance well ahead of shipping items internationally is the best way to ensure that your materials and data can be shipped abroad without a license or without violating export control laws and/or regulations. 

A software export includes any release of software or source code (whether by electronic transmission or downloading), subject to U.S. export control regulations/laws, in a foreign country or to a foreign person.  The University of Chicago (“UChicago”) is committed to complying with all U.S. export control regulations/laws.  Therefore, as an employee, student, principal investigator, or fellow of UChicago, you need to be aware of your responsibilities under U.S. export control regulations/laws.

Software Licensing Transactions

In this instance, the software supplier enters into a software license agreement directly with each of its customers. The software supplier then transmits the software over the internet from the supplier's server to the customer's computer. If the customer is located outside of the United States, the transmission of that software from the supplier's server (located in the United States) to the computer of someone who is not located in the US or who is a foreign person, constitutes an export of that software.

Software Applications

In this instance, the supplier operating the on-line store authorizes third parties to develop software applications for distribution through the on-line store, and the operator then makes those third party software applications available for purchase by customers through the on-line store.  If the online store supplier’s server is located in the U.S., an export of a software application occurs whenever that software application is downloaded by a customer to a location outside of the U.S. or if the software is downloaded by a foreign person.  In these instances, the on-line supplier is treated as the "exporter.

With either software licenses or applications, the following compliance issues must be assessed before transmitting the software from the supplier to the customer:

• ensure that the customer is not located in, and will not transfer the software to any person or entity, located in, an embargoed or sanctioned country;
• screen the customer (and any other party to the software licensing transaction) against the various lists of prohibited and restricted parties; and
• obtain an “end-use” statement from the customer.

There is a lot of software, including open source software which is freely available for download without restriction from the internet. Such freely available software may be excluded from the export controls.  There are also many exceptions available for export of software.  Please consult the Manager of Export Control Compliance to see if any they options are available for your software. 

Working with the Manager of Export Control Compliance well ahead of transmitting software is the best way to ensure that your software can be shared without a license or without violating export control laws and/or regulations. 

Export controls are U.S. laws and regulations that govern the export of sensitive technology, services and information for foreign policy, national security, and global competitiveness reasons.  The Export Administration Regulations (“EAR”) and the International Traffic in Arms Regulations (“ITAR”) are the regulations that chiefly affect university study abroad programs.  Additionally, the Office of Foreign Assets Control (“OFAC”) maintains sanctions, embargos, and boycotts and of certain countries that affect such programs.

When participating in a study abroad program, as a student or faculty member you need to be aware of your responsibilities under U.S. export control regulations/laws.  Travel to most countries usually does not present an export control problem; however, each traveler should ensure that their destination is not subject to any sanctions or embargoes.  Please be aware that OFAC sanctions currently apply to Cuba, Iran, North Korea, Syria, Sudan and Libya.  If you plan to travel to any of these countries, please contact the Manager of Export Control Compliance (“MECC”) as soon as possible.  Restrictions apply to other countries, as well.  If restrictions exist on your destination, a license must be obtained and additional restrictions could also impact your travel.  The MECC can determine whether, in fact, a restriction applies to your intended study abroad program and travel.

Additionally, taking equipment, such as laptops and mobile devices may have export control implications and require a license.  You should not take ANY of the following items, abroad, without first obtaining specific advice from the MECC:

1. UChicago-owned equipment (other than a sanitized laptop computer, PDA or electronic storage device);
2. Devices, equipment or computer software received with restrictions on export to or on access by foreign nationals; or
3. Devices, systems or software that was specifically designed or modified for military or space applications.

Working with the MECC/Global Engagement well ahead of your study abroad experience is the best way to ensure that your travel, materials, and data can be taken/sent abroad without a license or without violating any export control laws and/or regulations

For additional information please consult the International Travel Memo.