Export Control Guidance & Procedures

COMMODITY JURISDICTION DETERMINATION REQUESTS

As ITAR determinations govern licensing and authorization requirements for foreign national access, as well as transfers and exports, UChicago must ensure that all “defense articles” (equipment, materials, technical data and software that appear on the United States Munitions List) are properly identified and treated as such. The process of determining whether an item is controlled as a defense article under the USML is called “jurisdictional determination,” because it is a process of determining whether they are controlled under the jurisdiction of the Department of State’s Directorate of Defense Trade Controls (DDTC’s), International Traffic in Arms Regulations (ITAR).  Items may not be exported by any means, including access by foreign nationals within the U.S., until jurisdictional determination is confirmed.

When a clear jurisdictional determination cannot be made from the facts at hand (i.e., there is an ambiguity as to whether the item may be alternatively controlled by the Department of Commerce as “dual use” or not controlled at all), UChicago will apply for a Commodity Jurisdiction (“CJ”) from DDTC. A CJ is a letter to DDTC requesting that the agency opine on the proper jurisdiction of an item, i.e. whether it is covered under the USML (and if so, under which Category) or falls under Commerce Department control. CJs are potentially complex documents that require significant preparation, the results of which can have significant implications for Chicago’s current and future endeavors.

USML CATEGORIZATIONS

Once an item has been determined to fall under ITAR jurisdiction, its USML category must be identified. A defense article’s categorization has important implications for Chicago in terms of potential licensing requirements or export restrictions, so categorizations must be performed precisely. For example, an asterisk next to a category’s subparagraph denotes Significant Military Equipment (SME) which carries special licensing provisions and/or reporting.

ECCN CLASSIFICATIONS

Items which do not fall under ITAR jurisdiction are controlled by the Department of Commerce (DOC), Bureau of Industry and Security (BIS), under the Export Administration Regulations (EAR). These items require EAR classification prior to export.

EAR classification is the exercise of understanding where an item or technology falls in the Commerce Control List (CCL). The CCL describes “dual-use” items as those items that may be considered for commercial or military use. A classification will determine whether an export license is required based on the destination of the item or technology.

There are three ways to classify an item:

1. UChicago may self-classify;
2. use a classification provided by a manufacturer, if available/applicable;
3. or seek a formal classification from BIS.

For self-classifications of items that are under the jurisdiction of BIS, the employee would locate an Export Classification Number (ECCN) on the CCL. The employee would first review categories 0 through 9 on the CCL which cover areas such as electronics, lasers, computers, sensors, aviation and marine applications, encryption, telecommunications, etc. Categories are then further divided into product groups A through E such as components, test equipment, materials, software, and technology. Once the category and product group have been determined, one may determine which ECCN heading and subheading will apply to the item by reviewing the characteristics of the item being classified. The ECCN will explain possible related export controls, possible license exceptions, and the reason for control. The reason for control in combination with the destination of the item will determine licensing requirements.

The TCP is a documented set of procedures that generally includes but is not limited to the following areas: responsible parties for implementing the TCP; physical controls (laboratory security); IT controls (data file/computer access security); deemed export license requirements (as potentially applicable to foreign nationals who Chicago believes should have authorized access but for whom the items are otherwise restricted); protocols for sharing and transferring the items with other authorized parties outside the scope of Chicago’s laboratories; and any other requirements concerning screening, personnel authorization, labeling of items as controlled and time frame for which the TCP is applicable.

Note that in cases where a U.S. Government agency wishes to review a TCP as part of a licensing procedure or as part of an audit process, the PI and/or administrator in charge of implementing the TCP shall notify the Export Control Office of such a request so that appropriate oversight is in place.

A TCP may include:

1. A commitment to export control compliance;
2. Identification of the applicable export controls and items or technologies subject to the controls;
3. Identification and nationality of each individual who will have access to the controlled item or technology;
4. Training and awareness for all authorized personnel, certified by each person;
5. Project Description;
6. Personnel screening measures for granting access to the controlled item/technology;
7. Appropriate security measures for disposal of the item/technology when use is complete;
8. A description of the agreed upon security measures to control the item/technology, including as appropriate:

• Personnel Identification: Individuals participating in the project may be required to wear a badge, special card, or other similar device indicating their access to designated project areas. Physical movement into and out of a designated project area may be logged.
• Electronic Security: Project computers, networks, and electronic transmissions should be secured and monitored through User Ids, password controls, 128-bit Secure Sockets Layer encryption or other federally approved encryption technology. Database access should be managed via a Virtual Private Network.
• Laboratory Compartmentalization: Project operation may be limited to secured laboratory areas physically shielded from access or observation by unauthorized individuals.
• Time Blocking: Project operation may be restricted to secure time blocks when unauthorized individuals cannot observe or access the controlled equipment, data, or technology
• Marking: Export controlled equipment, data, or technology must be clearly identified and marked as export-controlled.
• Physical Security/Locked Storage: Tangible items accompanying controlled equipment, data, or technology, such as equipment, associated operating manuals, and schematic diagrams should be stored in rooms with key-controlled access. Soft and hardcopy data, lab notebooks, reports, and other research materials should be stored in rooms with key-controlled access.  The controlled equipment, data, or technology, itself should be stored in rooms with key-controlled access.
• Confidential Communications: discussions about the project must be limited to the identified and authorized project participants, and only in areas where unauthorized individuals are not present.  Discussions with third party sub-contractors must occur only under signed agreements which fully respect the non-U.S. citizen limitations for such disclosures.

Export controlled data and information must be transmitted in a safe and consistent manner. Electronic communications and databases managed by UChicago are managed via a type of Virtual Private Network (“VPN”), specifically a Secure Socket layer (“SSL”) which limits access to authorized users only and facilitates exchanges between those authorized users while encrypting (128 bit encryption) any data sent via Internet.

Helpful Tips

When transmitting export controlled data electronically, please consider the following:

• Password protect, encrypt, or remove all controlled data from any communications before transmitting
• Only transmit controlled data via voice or fax where there is reasonable assurance that access is limited to authorized persons;
• Detect exfiltration of data using firewalls, router policies, intrusion prevention/detection systems, or host-based security services;
• Transfer controlled information only on a need to know basis; and
• Ensure that anti-virus, anti-spyware, and personal firewall software is properly installed and activated

Under U.S. export control regulations an “export” can include the transmission of export controlled data via electronic communication. Improperly using devices/systems such as cloud servers, shared databases, or online databases to store data may result in an export violation.

Several export control requirements are applicable when collaborating with potential research partners:

1. When drafting or planning to sign a Memorandum of Understanding (MOU) or Memorandum of Agreement (MOA) with a potential non-US research partner that does not directly fall under the auspices of URA, the faculty member planning to enter into such an Agreement must alert the Export Control Administrator so that any export control implications to the proposed Agreement can be evaluated in advance
2. Prior to signing such an Agreement, UChicago shall screen such entity and signatories against the U.S. Government’s watch lists to ensure that potential partners are not listed.
3. MOUs or MOAs may contemplate the exchange of export controlled items or data that drive the collaborative research. Because the export of such items or their receipt into UChicago’s laboratories potentially has export control implications, these implications must be identified at the earliest opportunity so that the parties can plan accordingly. In certain cases, where the research is predicated on the receipt of (or access to) an export controlled item that requires prior government approval through a license or authorization, it is important that the parties take this contingency into account either in the MOU/MOA process or in a subsequent writing. UChicago cannot bind itself to a contractual obligation without acknowledging the need to fulfill a regulatory condition without which the program cannot proceed as intended.
4. Subsequent amendments to the MOU/MOA must proceed according to the same evaluation process, to the extent they subsequently alter the terms of the initial MOU/MOA or where the parties/signatories change over time.
5. When the MOU/MOA contemplates concurrent or subsequent Non-Disclosure Agreements (NDAs) and/or the receipt of export controlled items or data, contact URA to determine the precise export control language that shall be inserted into the NDA. The purpose of this language will be to alert Chicago in advance of a party’s intention to provide export controlled items, so that Chicago can determine the correct handling and disposition of such items consistent with control requirements or, where appropriate, decline acceptance of these items.

URA is responsible for determining whether an agreement, award or contract contains or triggers export control restrictions. In general, UChicago does not accept restrictions in its awards or contracts that would restrict UChicago faculty members, students and administrators who are not U.S. persons from access to research and research results which would otherwise remain unrestricted under the Fundamental Research Exclusion (FRE). However, exception to this policy may occur, requiring export control analysis. For example, ITAR content or tools associated with fundamental research trigger certain access restrictions. International collaborative research may also trigger limitations to the FRE.

Further, in certain cases, a sponsor’s intention with regard to export controls or the control implication of a particular clause or set of clauses may be ambiguous as to Chicago’s export control responsibilities. For example, this may occur with respect to “flow down” restrictions in a subcontract, or vague or open-ended publication and/or citizenship limitations. In this case, where such ambiguities arise or assistance is required in negotiating out a particular clause, it is incumbent upon URA to resolve the matter prior to committing to the obligation or accepting its financial benefits. For any questions concerning applicable export controls under a particular agreement of contract, please contact URA.

Because the transfer of technology and/or materials pursuant to a Material Transfer Agreement (MTA) may trigger export control requirements, URA’s Contracting team shall work directly with the Export Control Office to proactively identify and resolve export control requirements associated with an MTA. Such requirements may be triggered when the activity contemplates an  international transfer or is domestic within the U.S., but UChicago has knowledge that the item will be re-exported by the receiving party.

As applicable to the transaction at hand, the Material Transfer Agreement shall take into account necessary export control provisions that include but are not limited to notification of export control status (ITAR or EAR) as well as general end use/user restrictions and applicable destination control statements.

Note that incoming NDA’s (where UChicago is requested to sign another party’s confidentiality agreement covering the receipt of proprietary items or data) must likewise be reviewed and provisioned for export control purposes. As the potential modification of another party’s Confidentiality Agreement can take additional time, URA’s Contracting team shall be alerted as soon as possible to a pending Agreement so as to allow sufficient opportunity for timely evaluation.

1. REVIEW & REGISTER YOUR TRAVEL - We strongly encourage all university faculty, staff and students to review and register their foreign travel, in case of possible emergencies (ex. global pandemic outbreaks, terrorist attacks, or regional ‘acts of god’). Travel should also be booked through the university system to best keep compliant with certain agency requirements on Conflicts of Interest.
   • Review travel conditions: https://travel.state.gov/content/travel/en/traveladvisories/traveladvisories.html/
   • Register foreign travel for emergencies: https://traveler.uchicago.edu/
   • Book travel: https://traveltoolkit.uchicago.edu/
     • Fly America Act: All travelers to be reimbursed by federal grants or contracts are required to use U.S. flag airline services.
2. PROTECT YOUR DEVICES AND DATA - Technical espionage and theft are real and present dangers, especially for Researchers while travelling abroad. Travel to High and Low risk countries alike requires special consideration and preparation.
   • Contact IT Services-
     • For help with computer preparations for travel
     • For assistance on protecting mobile devices
     • For best practices regarding IT when abroad (https://uchicago.service-now.com/it?id=kb_article&kb=KB06000431)  
3. CONSULT YOUR EXPORT CONTROL OFFICE -"Export" means to send or take regulated tangible items, software or information out of the United States in any manner, including international handcarries. Unlike the export of information resulting from fundamental research, the export of tangible items such as laptops and other digital storage devices are always subject to U.S. export control regulations. Similarly, the encryption technology contained in most digital storage devices is always subject to U.S. export controls. Depending on the destination and the technology contained in one’s device, an export license may be required. Travel without an export license when required is a violation of federal law.
   • Document your export compliance and asses that your electronic device complies with the "Tools of the Trade" license exemption, with the UChicago TMP Certification here.
   • The University Export Control Officer must be contacted to review and approve ANY export (transmission, shipment, hand carry) of UC-owned or controlled property, services or export controlled information when:
     • The export is to Iran, Cuba, Syria, (North) Sudan, North Korea or the Crimea Region of the Ukraine;
     • The export involves a US Restricted Party;
     • The export is for ITAR-controlled defense articles, ITAR software, and ITAR technical data.  ITAR-controlled articles, software, and technical data are directly related to specific military systems, missile applications, and certain satellites or spacecraft. All ITAR-listed items require a State Department license for transfers to foreign countries and their nationals, including foreign nationals in the US.

• ​​Consult the Export Control Office while planning foreign travel with questions to help determine-
  • Are any of your collaborator parties/entities on a US Restricted Party list?
  • Do the items you’re taking overseas require a license?
    • If you need to purchase supplies and materials for use overseas, the procurement office highly recommends having these items shipped directly overseas.
• Confirm any special circumstances with the Export Control Office for your foreign travel; some examples--
  • China: a special travel situation
    • Travelers to the People's Republic of China have experienced a wide variety of issues.
    • Access to services that we take for granted like Gmail and other Google apps, Wikipedia, and Yahoo Web Mail are often blocked altogether or filtered.
    • Skype connections may be monitored by the government.
    • Those using VPNs reported that they are often cut off for hours at a time.
    • Hotel staff and government officials can access hotel room safes, so don't expect that a computer or mobile device left in a hotel safe will be secure.
  • Russia: a special travel situation
    • Current sanctions prohibit exportation, reexportation, sale, or supplying directly or indirectly any U.S. dollar-denominated banknotes (ie. U.S. currency) to any person located in the Russian Federation.
• Contact: exportcontrol@lists.uchicago.edu

To ensure quick and timely responses to export control question and concerns, the University has established a central export control email, exportcontrol@lists.uchicago.edu. Please direct any questions or concerns regarding current or planned foreign travel activities to this email.

International Conference Presentations and Seminars

International conferences can pose various export control risks, especially if you present at a conference. Presented and/or discussed material must be limited to topics that are not related to export-controlled items or technologies, unless that information is already in the "public domain" or is “fundamental research.” Information is considered in the “public domain” if it is published and generally accessible or available to the public. “Fundamental research” includes basic or applied research in science and/or engineering at an accredited institution of higher learning in the United States where the resulting information (in some cases), is ordinarily published and shared broadly in the scientific community, or (in other cases) where the resulting information has been or is about to be published.

In both instances, information is considered in the "public domain" or is "fundamental research," if it appears in periodicals, books, print, electronic or any other media available for general distribution to any member of the public, or to those that would be interested in such a scientific or engineering discipline.

Additionally, "Open" seminars are usually not problematic unless they take place in a sanctioned country or involve restricted parties. Exchanges of technical information, including academic discussions, could require a license. A conference is "open" if all technically qualified members of the public are eligible to attend, and attendees are permitted to take notes or otherwise make a personal record (but not necessarily a recording) of the proceedings and presentations. Access to the information must be free or for a fee that does not exceed the cost to produce and distribute the material or hold the conference (including a reasonable profit).

All UChicago personnel are encouraged to contact the ECO for guidance and evaluation prior to attending or participating in an international conference. The ECO can assist with the following:

• the screening of potential collaborators using Visual Compliance™;
• determining whether the conference is "open";
• determining what information may be shared without a license;
• determining whether an export license is required; and
• maintaining appropriate university records

Please contact the ECO for assistance at exportcontrol@lists.uchicago.edu.

Foreign Collaborations & Exchanges of Technical Information:

Publically available information or fundamental research can be shared with foreign colleagues as long as the recipients are not employees or representatives of the government of a sanctioned country, or restricted parties. This collaboration includes normal academic peer-review or publishing processes.

Research & Instruction Outside of the U.S.:

Research and course instruction conducted outside of the U.S. may not qualify for the fundamental research exclusion (FRE), and therefore may require an export control license. For instance, when interacting with foreign persons, you cannot provide a “defense service” which includes providing technical “know-how” related to the design, development, production, manufacturer, assembly, operation, repair, testing, maintenance or modification of a defense article or dual-use technology.  Export control regulations may apply until the work is published or is otherwise in the public domain. Before teaching a course or disclosing information outside of the U.S. it is important to ensure that the information is not subject to export control laws and regulations.

Furnishing Financial Assistance:

OFAC regulations prohibit providing material financial assistance or anything of value, including services, to any blocked or sanctioned country, individual, entity or organization, including a government agency of a sanctioned country. This can involve subcontracts, international vendors or payments to research participants. For example, a professional presentation, whether or not it contains materials controlled under International Traffic in Arms Regulations (“ITAR”) or Export Administration Regulations (“EAR”), is a “service” and “something of value” provided to the recipient audience, under OFAC regulations.  Contact the ECO for guidance and clearance before proceeding with this type of transaction.

If you are traveling abroad with your laptop or any other electronic devices, these items along with the underlying technology, any data on your device, proprietary information, confidential records, and encryption software are all subject to U.S. export control regulations.  Some foreign governments have regulations that permit the seizure of travelers’ computers and the review of their contents. 

You need to comply with U.S. export regulations whenever you take such equipment and data outside of the U.S.  Items that could have a “dual-use” (both commercial and military or proliferation applications), proprietary information, or items that are considered defense articles (even if used in an academic or research environment) are generally prohibited from export without an export control license.  Export control regulations will generally not restrain you from taking commercially available laptop computers and standard software to most countries. 

Further, items may be exempt from the license under the temporary export exception (TMP) as a “tool of trade.”  To qualify for the “tool of trade” exception, the export must:

• Remain under the effective control of the exporter (or the exporter’s employees) by retaining physical possession of the equipment at all times or securing the item in a secure environment;
• Consist only of reasonable equipment of the trade (equipment that people in your discipline would generally recognize as a ”tool of trade”);
• Not be to an embargoed country (Cuba, Iran, North Korea, Syria or Sudan);
• Be carried with the exporter or shipped ahead within 30 days of exporter’s travel
• Be data that is within the public domain; and
• Be for less than one (1) year.

You should not take ANY of the following items, abroad, without first obtaining specific advice from the ECO:

• UChicago-owned scientific equipment (other than a sanitized laptop computer, PDA or electronic storage device);
• Data or information received under an obligation of confidentiality including private information about research subjects;
• Data or analyses that result from a project for which there are contractual constraints on the dissemination of the research results;
• Devices, equipment or computer software received with restrictions on export to or on access by foreign nationals;
• Devices, systems or software that was specifically designed or modified for military or space applications; or
• Classified information

Warnings

If U.S. Customs and Border Protection officials suspect that a regulated item or defense article has been exported without a proper license, they may on your return examine files and software on your laptop computer as well as your baggage. For this reason, international travelers are encouraged to “sanitize” electronic devices by removing all non-essential data prior to leaving the United States. Inspectors in other countries may detain and copy your hard drive (this has been known to happen). Alternate safeguard methods include taking a blank laptop with only public domain files needed for the specific international trip or encrypting and then e-mailing to yourself any information you may need while overseas. Do not retrieve the e-mail until you have reached your destination, and remember you will need to remove it completely prior to returning to the U.S. or prior to crossing any international border.

Helpful Tips

When traveling internationally:

• Use your best judgment in communicating with foreign nationals, and be alert to situations that may result in inadvertent, inappropriate, or illegal disclosure of controlled information or data;
• Avoid situations that lead to providing advice or assistance outside of fundamental research parameters; 
• Do not discuss controlled or sensitive information (for example, proprietary information that you may happen to have) in public places; 
• Always keep controlled or sensitive items, information, or data secure; 
• Maintain a “need-to-know” policy when discussing work related information with others; 
• Do not leave equipment, documents, or data in your hotel safe.

Working with the Export Control Office well ahead of your international trip is the best way to ensure that your travel is permitted, and/or that your materials and data can be taken abroad without a license or without violating export control laws and/or regulations. Contact the ECO at exportcontrol@lists.uchicago.edu.