Export Controls: Think Twice Before Sharing Technical Drawings or Data with Non-U.S. Business Partners

If you run an import-only business and never ship goods out of the United States, you may not have spent much time considering U.S. export controls. They don’t affect you, do they?

Actually, they may. You might be surprised to learn that U.S. export controls don’t just control the export of tangible goods. They control the export (including the electronic “release”) of intangible items, too—including ideas; design work like technical drawings, blueprints, detailed product specifications or CAD files; and software source and object code.

Perhaps you operate your U.S. business on a model where you send designs by email or through a collaboration platform to contractors or manufacturing partners outside the United States, but you never send physical goods. Maybe you occasionally send prototypes to accompany the design files, but not items offered for sale. Or perhaps you work for a company that only trades in ideas and electronic files, working to develop new mobile applications or software with developers around the world. 

In all of these situations, U.S. export controls may apply to the information that you send outside of the United States. Additionally, physical prototypes are often controlled for export in exactly the same way as the finished good—depending on how much of the finished good’s performance capabilities they share. Don’t be fooled by import rules that might offer a duty reduction for entry of a prototype; for the purposes of export controls, a functional prototype is just as tightly controlled as the actual product, and a non-functional prototype is still controlled as development-related information.

Even more surprisingly, export controls may apply even if you never email files to persons sitting outside of the United States, as long as your recipients are considered to be “non-U.S. persons.” (Note that the scope of who is a “U.S. person” and who is not varies between the Export Administration Regulations (EAR), which govern less sensitive items that have a dual commercial and military use, and the International Traffic in Arms Regulations (ITAR), which govern more sensitive defense articles.)

However, just because U.S. export controls apply does not mean that they prohibit your information exchange or create a licensing requirement. Whether a license requirement attaches to your physical or electronic transmission of information generally depends on where the information is bound to, how sensitive that information is and whether it would help a non-U.S. person to recreate a controlled item. The particular recipient and the recipient’s intended use for the information may also affect whether a license is required.

Transfer of Information: Do You Need an Export License?

Let’s walk through a few steps that can help you evaluate whether you need a U.S. export control license for your transfer of information:

1. As a starting point, consider whether your file relates to a piece of hardware or software that would be controlled if it were exported from the United States. This will require you to classify the underlying hardware or software for export. Start with the ITAR’s U.S. Munitions List (USML), where controlled information is referred to as “technical data,” and then move to the EAR’s Commerce Control List (CCL), where controlled information is referred to as “technology.”
2. After you have a classification for the underlying item, look for controls on associated information. These controls are usually listed near the end of each USML category or in Part E of each CCL Category. Note that information associated with EAR99 items (that is, items subject to the EAR but not listed on the CCL, and to which the lowest level of restrictions apply) should be EAR99, too. There are a few cases where information associated with a CCL-controlled item is actually governed by the ITAR’s USML, so make sure to always check the USML again at this stage.
3. If your product is listed on the Commerce Control List, carefully note what kind of information relating to the underlying product is controlled. Is it information relating to production, development or use, as these terms are defined in 15 C.F.R. 772, or relating to some combination of these? It is possible for one classification to apply to some information about a product (like production and development information) while another classification applies to other information (like use information), so be careful at this stage to think about all of the information your team may need to exchange and to consider all possible technology classifications.
   1. Often, “use” information is the least strictly controlled type of information (that is, it is permitted to be sent to more countries without a license, or it is more likely to receive a license if one is required). This makes sense: It's one thing to be sending a standard user manual for a controlled item to a supplier to print and include in the product’s packaging. Many (but not all) user manuals will not contain enough information about an item to concern the U.S. government. It’s something else entirely to send a CAD file or wafer mask design—that’s exactly the kind of information that allows the recipient to develop or produce the controlled hardware.
4. Using your newfound classification, conduct an export control licensing analysis according to the licensing rules of the ITAR or the EAR. This will tell you if a license is needed for your particular destination, end user and end use. For this step, as for classification, you may want to consult with an export compliance professional, and remember to screen your recipient against U.S. restricted party lists!
5. If a license is required to send your information to your recipient, you must apply for one before sending the information or making it available to a non-U.S. person, unless a license exception applies. Talk to your trade compliance team or counsel if you need assistance applying for a license or evaluating the applicability of a license exception, or—worst case—if you have already transmitted information that required a license.