For many US companies, the most significant export control risk they face is not the physical shipment of controlled goods across a border, but the transfer of knowledge — the sharing of technical data, software, and know-how with foreign persons through any medium. Technology transfer controls, embedded in both the International Traffic in Arms Regulations and the Export Administration Regulations, reflect the foundational principle that what makes US technology valuable from a national security perspective is the knowledge itself, not merely its physical embodiment. A company that gives a foreign customer access to the engineering specifications for a controlled system is, for export control purposes, doing something legally indistinguishable from physically shipping that system to the foreign country. Understanding technology transfer controls — and managing them correctly in the context of licensing agreements, joint ventures, research collaborations, and employment relationships — is essential for any US company with significant technology assets and international business activities.
Technology transfer controls operate at two levels that must be analyzed separately. The first is the item-based analysis: is the technology being transferred subject to ITAR as technical data relating to a USML defense article, or subject to EAR as technology relating to an item on the Commerce Control List? The second is the recipient-based analysis: to whom is the technology being transferred, and does that transfer require a license given the recipient’s nationality, country of location, and the applicable license requirements? Both analyses must be performed for every technology transfer to a foreign person, whether that transfer occurs in the United States (a deemed export) or abroad (a direct export). An error in either analysis can result in an unauthorized export.
What Constitutes Technology Under ITAR and EAR
Under ITAR, ‘technical data’ means information required for the design, development, production, manufacture, assembly, operation, repair, testing, maintenance, or modification of defense articles. This definition is intentionally broad and captures information in many forms: blueprints, drawings, photographs, plans, and specifications; software directly related to defense articles; design documentation; manufacturing processes; test and evaluation data; maintenance manuals; and any other information that enables the recipient to develop, produce, or operate a defense article. The breadth of the technical data definition means that a presentation at a trade show, a proposal in response to a foreign request for information, a whitepaper describing a defense technology, or even an oral discussion of classified or sensitive design information can all constitute technical data exports.
Under EAR, ‘technology’ means information necessary for the development, production, or use of items on the Commerce Control List. The EAR technology definition is structured by Export Control Classification Number (ECCN): for each item on the CCL, the corresponding ECCN specifies the technology controls that apply to information relating to that item’s development, production, and use. EAR technology controls are broader than they might initially appear: the ‘use’ controls capture not just manufacturing know-how but also operational information, maintenance procedures, and any other information required to operate or employ a controlled item. Companies that provide field service, technical support, or operator training to foreign customers may be making controlled technology transfers even if they have not shared any design or manufacturing information.
The Public Domain and Fundamental Research Exclusions
Two important exclusions from ITAR and EAR technology controls are particularly relevant for universities, research institutions, and companies involved in basic research: the public domain exclusion under ITAR and the publicly available and fundamental research exclusions under EAR. Under ITAR (22 CFR 120.11), technical data does not include information in the public domain, meaning information that has been made available to the general public without restrictions on its further dissemination, such as information published in academic journals, patent applications, educational instruction materials, and information released at open conferences. However, the ITAR public domain exclusion requires that the information have been officially released — simply being known or widely understood is not sufficient. Information that is widely known in the defense community but has not been formally released into the public domain remains ITAR-controlled.
Under EAR (15 CFR 734.3 and 734.8), technology is excluded from EAR controls if it is published and generally accessible to the public through any form of unrestricted publication. In addition, the fundamental research exclusion (15 CFR 734.8) excludes technology generated through basic or applied research at accredited institutions of higher education that is ordinarily published and shared broadly within the scientific community, and that is not subject to any proprietary restriction, access and dissemination controls, or prepublication review. The fundamental research exclusion is critically important for universities: it allows researchers to collaborate freely with foreign graduate students and colleagues on research that meets the exclusion’s criteria, without needing export licenses for every technology disclosure.
However, the fundamental research exclusion has important limits. Research that is subject to a sponsor’s right to prepublication review and withhold publication is not fundamental research, even if the sponsor rarely exercises those rights. Research that is subject to restrictions on participation by foreign nationals is not fundamental research. And research that is classified or subject to any form of access restriction imposed by the government or the sponsor is not fundamental research. Universities and companies engaged in sponsored research must carefully review their research agreements to ensure that any restrictions do not inadvertently take the research outside the fundamental research exclusion, subjecting all foreign national participants to deemed export license requirements.
Technology Transfer in Licensing and Joint Ventures
Technology licensing agreements and joint venture arrangements with foreign partners are among the most common and most significant technology transfer scenarios that US companies face. When a US company licenses its technology to a foreign licensee — providing the licensee with access to design documentation, manufacturing processes, software source code, or other controlled information — it is making a controlled technology export that requires either a license from DDTC or BIS, or qualification under an applicable exemption or license exception. For ITAR-controlled technology, the applicable authorization is typically a Technical Assistance Agreement (TAA) or, for technology licensed for manufacturing purposes, a Manufacturing License Agreement (MLA), both of which must be approved by DDTC before they take effect.
Technology licensing agreements must be structured carefully to ensure that they do not inadvertently authorize technology transfers beyond the scope of any applicable license or agreement. The agreement should specify precisely what technical data and technology are covered; it should incorporate the applicable ITAR or EAR restrictions by reference and require the licensee to comply with US export control laws in its use of the licensed technology; it should prohibit retransfer of the technology to third parties without prior US government approval; and it should include audit rights allowing the licensor to verify the licensee’s compliance with the export control provisions. Foreign licensees who misuse licensed technology — by sharing it with unauthorized third parties, using it for unauthorized purposes, or retransferring it to embargoed countries — expose the US licensor to enforcement liability as well as the licensee.
Software Controls
Software is subject to both ITAR and EAR controls, but the two regimes treat software differently. Under ITAR, software that is directly related to defense articles or defense services is treated as technical data and is subject to the full ITAR control framework, including registration, licensing, and deemed export requirements. Under EAR, software that is controlled on the CCL — encryption software, software for the operation of controlled items, and software with specific technical parameters specified in the relevant ECCN — is subject to EAR licensing requirements. Software that is publicly available, including open-source software that is available without restriction, is generally excluded from EAR controls, but care must be taken with open-source software that incorporates encryption functionality or other controlled features.
Cloud computing and remote access arrangements create particular challenges for software technology transfer controls. When a US company provides a foreign customer or employee with remote access to controlled software running on US-based servers, the question arises whether that access constitutes a technology transfer to the foreign country where the person is located. The general principle is that giving a foreign person access to controlled technology in any form — including through remote access to cloud-hosted systems — is a technology transfer to the person’s location. Companies must therefore screen cloud access arrangements with the same rigor as physical technology transfers, ensuring that access to controlled software and technical data by foreign persons in sensitive countries is appropriately licensed or avoided.