The Directorate of Defense Trade Controls enforces the International Traffic in Arms Regulations with tools that range from administrative penalties and compliance orders to criminal referrals to the Department of Justice. ITAR enforcement is not a theoretical concern for US companies in the defense and technology sectors: the DDTC has imposed consent agreements requiring hundreds of millions of dollars in penalties and comprehensive compliance reforms on some of the largest and most sophisticated defense contractors in the United States, and the Department of Justice has brought criminal prosecutions under the Arms Export Control Act against individuals and companies alike. Understanding what types of violations trigger enforcement, how the enforcement process unfolds, what penalties are available, and what factors affect the outcome is essential for any company navigating the ITAR compliance landscape.

ITAR violations fall into two broad categories: administrative violations that are subject to civil enforcement by the DDTC, and willful violations that are subject to criminal prosecution under the Arms Export Control Act. The same underlying conduct — an unauthorized export of a defense article, an undisclosed foreign ownership, a false statement in a license application — can give rise to both civil and criminal exposure, and the DDTC and DOJ work closely together in significant cases. The civil and criminal tracks are not mutually exclusive, and companies that are the subjects of DDTC investigations must be prepared to manage both simultaneously.

Types of ITAR Violations

The most common types of ITAR violations that generate enforcement actions include the following. Unauthorized exports occur when a defense article, technical data, or defense service is provided to a foreign person without the required ITAR license or applicable exemption. This includes physical shipments of defense hardware, electronic transmissions of technical data, oral or written disclosures to foreign nationals, and the provision of defense services to foreign customers without an approved TAA or MLA. Unauthorized exports are the most fundamental ITAR violation and the most frequently charged in enforcement actions.

Registration failures involve engaging in the manufacturing or exporting of defense articles, or furnishing defense services, without the required DDTC registration. As discussed in the registration article, a company that manufactures USML items without registering is in violation even if no export has occurred. Retransfer violations occur when a foreign recipient of US-origin defense articles or technical data transfers those items to a third country or a third party without the required US government approval — a violation for which the US exporter may bear responsibility if it failed to obtain proper end-use commitments or to notify the foreign recipient of applicable retransfer restrictions. False statement violations involve making false or misleading representations in license applications, shipping documents, or other submissions to the DDTC — a category of violation that can transform an administrative enforcement matter into a criminal prosecution. Agreement violations involve activities that deviate from the scope of an approved TAA, MLA, or other DDTC authorization.

What Triggers a DDTC Investigation

DDTC investigations are initiated through several different channels. Voluntary self-disclosures (VSDs) — the company’s own report to the DDTC of a potential violation — are the most common trigger, and the DDTC strongly encourages self-disclosure as a compliance tool that benefits both the company and the government. A significant majority of DDTC enforcement actions begin with a company’s VSD. Referrals from other government agencies are a second common trigger: the Department of Defense, the intelligence community, US Customs and Border Protection, and other agencies that encounter potential ITAR violations in the course of their own activities may refer those matters to DDTC for investigation. Third-party complaints — from whistleblowers, competitors, foreign governments, or customers who report suspected violations —isa third trigger. Export filing data reviewed by the DDTC or CBP can also surface potential violations: anomalies in export documentation, mismatched descriptions or values, or exports to restricted countries or parties may trigger further inquiry.

Once an investigation is initiated, the DDTC’s Office of Defense Trade Compliance (ODTC) conducts a review of the facts and circumstances. This may involve document requests, interviews of company personnel, site visits, and coordination with other agencies. The company has the right to present information and arguments in response to the DDTC’s findings, and the enforcement outcome is typically negotiated between the DDTC and the company’s export control counsel over a period of months to years in significant cases. Cooperation with the investigation, the company’s voluntary disclosure and remediation record, and the quality of its compliance program are all important factors in the enforcement outcome.

Civil Penalties and Consent Agreements

The DDTC’s primary civil enforcement tool is the civil penalty, which can be assessed at up to $1,348,073 per violation under the ITAR as currently indexed for inflation. The maximum penalty per violation has increased significantly over the years through inflation adjustments under the Federal Civil Penalties Inflation Adjustment Act, and companies with multiple violations can face aggregate civil penalties in the hundreds of millions of dollars. The DDTC has broad discretion in determining the appropriate penalty amount, taking into account factors including the severity and duration of the violations, the number of transactions involved, the sensitivity of the technology, the countries and end users involved, the company’s compliance history, the quality of the company’s compliance program, and the company’s cooperation with the investigation.

Major ITAR enforcement actions against large companies are typically resolved through consent agreements negotiated between the company and the DDTC. A consent agreement is a detailed administrative settlement that includes: a civil penalty (often partially or fully suspended on condition of satisfactory compliance with the agreement’s requirements); a detailed compliance program that the company must implement or improve; appointment of an external compliance auditor who reports to both the company and the DDTC; specific milestone compliance benchmarks; and provisions for monitoring and reporting. Consent agreements in major cases can impose sweeping compliance obligations that effectively restructure the company’s entire export compliance infrastructure, require hundreds of millions of dollars in compliance investment, and subject the company to years of external oversight.

Notable ITAR consent agreements include the landmark case against Hughes Electronics Corporation and Boeing Satellite Systems, arising from the unauthorized transfer of satellite technology to China, which resulted in a $32 million civil penalty in 2003 — then the largest in ITAR history. Subsequent cases have resulted in even larger penalties: ITT Corporation paid $100 million in 2007, related to unauthorized exports of night-vision technology components to foreign countries; Xe Services (formerly Blackwater) paid $42 million in 2010 for numerous unauthorized exports of defense articles and services; and BAE Systems paid $79 million in 2011 for violations related to unauthorized exports in multiple countries. More recently, L3 Technologies settled for $13 million in 2019, and General Atomics Aeronautical Systems paid penalties in connection with unauthorized UAV technology disclosures.

Criminal Prosecution Under the AECA

Willful violations of the Arms Export Control Act and ITAR carry criminal penalties of up to $1 million per violation and up to 20 years imprisonment for individuals. Criminal prosecutions are reserved for the most serious cases — deliberate unauthorized exports to adversaries, deliberate falsification of license applications, and significant ongoing unauthorized disclosures of sensitive military technology. The Department of Justice’s National Security Division and US Attorneys’ offices prosecute AECA cases, often in coordination with the FBI, Homeland Security Investigations (HSI), and other law enforcement agencies.

Criminal cases frequently involve attempted exports to embargoed countries (Iran, North Korea, Russia, China), procurement networks for weapons of mass destruction components, and deliberate schemes to evade export controls through false documentation, misclassification of controlled items, or the use of foreign intermediaries. Individuals convicted under the AECA face not only imprisonment and fines but permanent loss of export privileges, disqualification from government contracting, and reputational consequences that effectively end careers in the defense industry. Corporate defendants face the same civil penalties available in administrative enforcement, plus the additional reputational and operational consequences of a criminal conviction or deferred prosecution agreement.

Debarment

Debarment from export privileges is one of the most severe and disruptive consequences of an ITAR enforcement action. A debarred person is prohibited from participating directly or indirectly in any export of defense articles, defense services, or technical data — including as a manufacturer, exporter, broker, consultant, or employee of a registered company — for the duration of the debarment period. Debarment can be imposed as part of a consent agreement, as a result of a criminal conviction, or independently by the DDTC for violations involving fraud, willfulness, or the export of particularly sensitive technology. Statutory debarment, which is mandatory upon conviction for an AECA violation, is difficult to waive and can effectively put a company out of the defense business.

The severity of ITAR enforcement consequences makes proactive compliance — through voluntary self-disclosure, strong compliance programs, and prompt remediation of identified violations — not merely a legal obligation but a critical business imperative. Companies that experience ITAR violations and handle them proactively, with full transparency and genuine remediation, are consistently treated more favorably by the DDTC than companies that minimize, conceal, or delay in addressing compliance failures. The investment in a strong export compliance program is, in the export control context, a direct investment in limiting the company’s exposure to these severe and business-threatening consequences.