# Presentation: 434098

## Export Control Coordinators Organization: Technology Licensing Issues and Deemed Exports Todd WillisSenior Export Policy AnalystDeemed Exports and Electronic DivisionOffice of National Security and Technology Transfer ControlsJune 27, 2007

## Agenda

- Deemed export year in review
- Trends
- Withdrawal of Advanced Notice of Proposed Rulemaking
- “Use” technology
- Country of origin licensing policy
- Export controls in the context of fundamental research
- Deemed Export Advisory Committee
- Deemed export topic du jour
- Technology Control Plan (TCPs):
- Export Enforcement cooperation

## Deemed Export Year in Review

- Deemed export staffing doubled from three to six full time employees
- BIS published two deemed export related Federal Register Notices
- Established the Deemed Export Advisory Committee
- Maintained robust deemed export outreach program conducting over 120 outreach events

## Deemed Export Year-End Summary

- The deemed export program remains an important mechanism to prevent the diversion of sensitive dual use technologies to countries and end users of concern
- In FY2006, the Bureau approved 85%, returned without action approximately 14%, and denied less than 1% of the total of 830 deemed export license applications
- Almost 60% of the deemed export licenses processed are for PRC foreign nationals
- Followed in descending order by foreign nationals from India (13%), Iran (7%), Russia and Germany (2%) and UK (1%)
- Most deemed export licenses are processed in 40 days

## Annual Deemed Export Licensing Trends

_**Most Common Deemed Exports:**_
** ****Semiconductor & Electronics - Category 3**
** ****High Performance Computers - Category 4**
** ****Telecommunications - Category 5**

*** Projected**

**** To Date**

## Recent Debate Over Deemed Export Policy

- 2004: Commerce Office of Inspector General (OIG) Report
- Highly critical of the Deemed Export Program
- 2005: BIS published two deemed export related Federal Register Notices:
- Establishment of Advisory Committee and Clarification of Deemed Export-Related Regulatory Requirements (71FR29301 of 05/22/06)
- Withdrawal of the Deemed Export Advanced Notice of Proposed Rulemaking (71FR30840 of 05/31/06)
- 2006-2007: Deemed Export Advisory Committee deliberations

## Clarification of “Use” Technology

- The use of export controlled equipment is not a deemed export.  Deemed exports occur only if controlled _technology_ is transferred.
- The regulatory definition of “use” is technology for “operation, installation (including on-site installation), maintenance (checking), repair, overhaul and refurbishing.”
- General Technology Note:
- The term “technology” as used in the EAR refers to specific information “required” for the “development,” “production,” or “use” of specific product (e.g. computer, fermenter, machine tool, etc.).
- “Required”  technology refers only to that portion of technology which is peculiarly responsible for achieving or exceeding controlled performance levels, characteristics or functions.
- Controlled “use” technology requires all six attributes of the definition in order to qualify as controlled “use” technology.  Otherwise the technology is likely EAR99.

## Reaffirmation of Foreign National Licensing Policy

- Naturalized U.S. citizens, U.S. Legal Permanent Residents and U.S. Asylees and Refugees are protected individuals and are not subject to the deemed export rule.
- Deemed export licensing policy for foreign nationals that are not protected individuals (i.e., third country nationals) is based on recently established legal permanent residence or citizenship.
- For example:  A foreign national born in Iran that has established citizenship or permanent residency in Canada would be treated for licensing purposes as a Canadian.
- If an exporter is unable to determine a foreign national’s country of origin for deemed export licensing, the exporter should consult with BIS.
- For deemed reexports to a foreign national of another country, licensing is also based on the foreign national’s recently established permanent residency or citizenship.

## Scope of Fundamental Research Is Unchanged

- “Fundamental research is basic and applied research in science and engineering where the resulting information is ordinarily published and shared broadly within the scientific community.” (EAR Part 734.8)
- "While the product of the fundamental research is not subject to the EAR because the results of that research are intended for publication and dissemination within the scientific community, *authorization may be required if during the conduct of the research controlled technology is released to a foreign national*.“(71FR30840 of 05/31/06)

## Scope of Fundamental Research Is Unchanged

- Fundamental research technology is not subject to the EAR because:
- the technology that rises during or results from the research is normally made public; _and,_
- the technology necessary to conduct the research is normally obtained from public or published sources.
- If preexisting technology necessary to conduct the research is export controlled; or, if a researcher makes a decision to control the technology that results from the research, then, deemed export licensing requirements must be considered.

## Deemed Export Advisory Committee

- Comprehensive policy review
- Required by law to meet quarterly
- Meetings open to the public
- The final report is expected to be delivered to the Secretary of Commerce in late 2007

## Deemed Export Advisory Committee

**DEAC Members  **
**Norman Augustine, Retired Chairman & CEO, Lockheed Martin Corporation*;**
**Robert Gates, PhD, President of Texas A&M University****
**Albert Carnesale, PhD, Former Chancellor of the University of California at Los Angeles; **
**Ruth David, PhD, President & CEO, Analytic Services, Inc.; **
**The Honorable John Engler, President, National Association of Manufacturers;**
**Anthony Frank, PhD, Provost and Senior Vice President, Colorado State University; **
**General John A. Gordon, Former Deputy Director, Central Intelligence Agency; **
**Sean O'Keefe, Chancellor, Louisiana State University; **
**Eva Pell, PhD,  Senior Vice President and Dean of the Graduate School, Penn State University; **
**Michael Splinter, CEO, Applied Materials; **
**James Siedow, PhD, Vice Provost for Research and Professor of Biology, Duke University; **
**William A. Wulf, PhD, President, National Academy of Engineering and Professor of Computer Science and University Professor, University of Virginia.**
- 		*  *Chairperson ** Resigned to become Secretary of Defense** *

## Deemed Export Control Topic Du Jour

- Exporters must distinguish between the following to insure the correct licensing authorization:
- Deemed export of technology;
- Deemed reexport of technology;
- Technology export; and,
- Technology reexport.
- Exporters in general are creating unnecessary licensing burdens for themselves.

**Notes:**
When we review a Technology Control Plan, we look at the following essential elements:
Corp. commitment: i.e., CEO letter to employees
Physical plan: i.e., badging, visitor plan, etc.
Info Security: i.e., firewalls, electronic monitoring of databases with controlled technology, intranet systems, etc
Personnel screening: i.e., hiring process, non disclosure statements, visa status, labor certification process, etc.
Self-eval: i.e., internal audits
Another important element is how a company classifies its technology and how it integrates this classification process into its personnel screening process.

## Distinguishing Deemed Export from Technology Export

- A deemed export is the release of controlled technology or source code to a foreign national in the U.S.
- A technology export is the release of controlled technology in a foreign country
- Deemed export licensing authorization is based on a review of the individual foreign national’s background, country of origin and level of technology
- Technology export licensing authorization is based on the ultimate consignee’s country, the level of technology and the bonafides of the consignee
- BIS does not license individual employees of consignees on a technology export license

**Notes:**
When we review a Technology Control Plan, we look at the following essential elements:
Corp. commitment: i.e., CEO letter to employees
Physical plan: i.e., badging, visitor plan, etc.
Info Security: i.e., firewalls, electronic monitoring of databases with controlled technology, intranet systems, etc
Personnel screening: i.e., hiring process, non disclosure statements, visa status, labor certification process, etc.
Self-eval: i.e., internal audits
Another important element is how a company classifies its technology and how it integrates this classification process into its personnel screening process.

## Distinguishing Deemed Reexport from Technology Reexport

- A deemed reexport is the release of controlled technology or source code to a foreign national of another country; this is deemed to be a reexport to the foreign national’s home country
- In many cases technology exported to the country home of that foreign national may be exported NLR or under License Exception (LE) not available for the foreign national’s home country
- e.g., ECCN 5E001 technology may be exported to a company in Ireland under LE TSR.
- A Russian foreign national employee of that company in Ireland requires deemed reexport license authorization to receive this technology
- A technology reexport is the actual shipment or transmission of controlled technology from one foreign country to another foreign country

**Notes:**
When we review a Technology Control Plan, we look at the following essential elements:
Corp. commitment: i.e., CEO letter to employees
Physical plan: i.e., badging, visitor plan, etc.
Info Security: i.e., firewalls, electronic monitoring of databases with controlled technology, intranet systems, etc
Personnel screening: i.e., hiring process, non disclosure statements, visa status, labor certification process, etc.
Self-eval: i.e., internal audits
Another important element is how a company classifies its technology and how it integrates this classification process into its personnel screening process.

## Considerations to Ease Licensing Burden

- If a consignee on a technology export license intends to send employees to the U.S. for training or other requirements resulting in the need for controlled technology, identify this on the export license application
-   A duplicative deemed export license is not required
- If your company has multiple subsidiaries in different countries, technology export authorization could authorize reexports as well
- Exporters need to specify these requirements in its application
- This could also authorize deemed reexport requirements for employees of the company’s foreign subsidiaries visiting its other foreign subsidiaries
- A technology export license does not require information on individual employees

**Notes:**
When we review a Technology Control Plan, we look at the following essential elements:
Corp. commitment: i.e., CEO letter to employees
Physical plan: i.e., badging, visitor plan, etc.
Info Security: i.e., firewalls, electronic monitoring of databases with controlled technology, intranet systems, etc
Personnel screening: i.e., hiring process, non disclosure statements, visa status, labor certification process, etc.
Self-eval: i.e., internal audits
Another important element is how a company classifies its technology and how it integrates this classification process into its personnel screening process.

## Developing a Technology Control Plan (TCP)

- The requirement for a TCP is a standard condition of approval for a deemed export license
- A TCP should include the following six essential elements:
- Corporate commitment to export compliance
- Physical security plan
- Information security plan
- Personnel screening procedures
- Training and awareness program
- Self evaluation program

**Notes:**
When we review a Technology Control Plan, we look at the following essential elements:
Corp. commitment: i.e., CEO letter to employees
Physical plan: i.e., badging, visitor plan, etc.
Info Security: i.e., firewalls, electronic monitoring of databases with controlled technology, intranet systems, etc
Personnel screening: i.e., hiring process, non disclosure statements, visa status, labor certification process, etc.
Self-eval: i.e., internal audits
Another important element is how a company classifies its technology and how it integrates this classification process into its personnel screening process.

## Essential Elements of a TCP

- 1. Corporate commitment to export compliance
- Organizational chain of command of export compliance team
- Must have member of senior management team responsible for export compliance
- Demonstrate how compliance issues are resolved
- Show evidence of methodology for commodity classification of technology in the workplace
- Top-down leadership (e.g., CEO company wide letter that establishes a corporate culture of export compliance)

**Notes:**
When we review a Technology Control Plan, we look at the following essential elements:
Corp. commitment: i.e., CEO letter to employees
Physical plan: i.e., badging, visitor plan, etc.
Info Security: i.e., firewalls, electronic monitoring of databases with controlled technology, intranet systems, etc
Personnel screening: i.e., hiring process, non disclosure statements, visa status, labor certification process, etc.
Self-eval: i.e., internal audits
Another important element is how a company classifies its technology and how it integrates this classification process into its personnel screening process.

## Essential Elements of a TCP

- Structure of building security at each  technology location
- Description of physical security plan (badge access, secure door access...).
- Perimeter security and access control.

**Notes:**
When we review a Technology Control Plan, we look at the following essential elements:
Corp. commitment: i.e., CEO letter to employees
Physical plan: i.e., badging, visitor plan, etc.
Info Security: i.e., firewalls, electronic monitoring of databases with controlled technology, intranet systems, etc
Personnel screening: i.e., hiring process, non disclosure statements, visa status, labor certification process, etc.
Self-eval: i.e., internal audits
Another important element is how a company classifies its technology and how it integrates this classification process into its personnel screening process.

## Essential Elements of a TCP

- Command structure of IT security at each technology location
- Description of IT security plan (password access, firewall protection plans...)
- Verification of technology authorization (terminated employees, individuals working on new projects...)
- Intranet and internet security

**Notes:**
When we review a Technology Control Plan, we look at the following essential elements:
Corp. commitment: i.e., CEO letter to employees
Physical plan: i.e., badging, visitor plan, etc.
Info Security: i.e., firewalls, electronic monitoring of databases with controlled technology, intranet systems, etc
Personnel screening: i.e., hiring process, non disclosure statements, visa status, labor certification process, etc.
Self-eval: i.e., internal audits
Another important element is how a company classifies its technology and how it integrates this classification process into its personnel screening process.

## Essential Elements of a TCP

- At minimum must review entities and denied parties list.
- What types of background checks are conducted (criminal, drivers license, credit...).
- Must know procedures that 3rd party contractors use (e.g. temporary employment agencies)
- Non-disclosure agreements

**Notes:**
When we review a Technology Control Plan, we look at the following essential elements:
Corp. commitment: i.e., CEO letter to employees
Physical plan: i.e., badging, visitor plan, etc.
Info Security: i.e., firewalls, electronic monitoring of databases with controlled technology, intranet systems, etc
Personnel screening: i.e., hiring process, non disclosure statements, visa status, labor certification process, etc.
Self-eval: i.e., internal audits
Another important element is how a company classifies its technology and how it integrates this classification process into its personnel screening process.

## Essential Elements of a TCP

- Schedule of training program for informing foreign national employee of technology access limits
- Description of training for U.S. employees which have access to controlled technology areas
- Export control awareness training for all employees

**Notes:**
When we review a Technology Control Plan, we look at the following essential elements:
Corp. commitment: i.e., CEO letter to employees
Physical plan: i.e., badging, visitor plan, etc.
Info Security: i.e., firewalls, electronic monitoring of databases with controlled technology, intranet systems, etc
Personnel screening: i.e., hiring process, non disclosure statements, visa status, labor certification process, etc.
Self-eval: i.e., internal audits
Another important element is how a company classifies its technology and how it integrates this classification process into its personnel screening process.

## Essential Elements of a TCP

- Self auditing schedule
- Checklist of items reviewed during each audit
- Action item and corrective procedures
- Internal or external audit

**Essential Elements of a TCP**

**Notes:**
When we review a Technology Control Plan, we look at the following essential elements:
Corp. commitment: i.e., CEO letter to employees
Physical plan: i.e., badging, visitor plan, etc.
Info Security: i.e., firewalls, electronic monitoring of databases with controlled technology, intranet systems, etc
Personnel screening: i.e., hiring process, non disclosure statements, visa status, labor certification process, etc.
Self-eval: i.e., internal audits
Another important element is how a company classifies its technology and how it integrates this classification process into its personnel screening process.

## TCP Summary

- Necessary to provide assurance that information will not be diverted to foreign national’s home country
- Typical agenda item for BIS site visit
- Verification of TCP effectiveness is a goal of domestic post shipment verification/pre-license check to assure compliance with license conditions20

**Notes:**
When we review a Technology Control Plan, we look at the following essential elements:
Corp. commitment: i.e., CEO letter to employees
Physical plan: i.e., badging, visitor plan, etc.
Info Security: i.e., firewalls, electronic monitoring of databases with controlled technology, intranet systems, etc
Personnel screening: i.e., hiring process, non disclosure statements, visa status, labor certification process, etc.
Self-eval: i.e., internal audits
Another important element is how a company classifies its technology and how it integrates this classification process into its personnel screening process.

## Export Enforcement Role in Deemed Exports:

-  Compliance with license conditions
-  Deviations from the scope of license
-  Compliance with the Technology Control Plan (TCP)
-  Possible unauthorized releases of controlled technology 		to the foreign national or unauthorized foreign nationals

- Deemed Export Domestic PSV Program

## Export Enforcement Role in Deemed Exports:

- Deemed Export Domestic PSV Program

- •	Spans all Commerce Control List categories
- •	2006: EE /EA conducted 10 domestic PSVs
- 2007: Plans to conduct an additional 10-15 PSVs
-  License holders have demonstrated a high degree 	of 					    		compliance
- Preparing for domestic PSV: Internal compliance assessment
- •	EE continues to review selected licenses based on certain risk factors & conduct domestic PSVs as necessary

## BIS Web site

- _[www.bis.doc.gov](http://www.bis.doc.gov/)_
**Licensing**
**Deemed Exports**
** **_[Process Improvements](http://www.bis.doc.gov/DeemedExports/DeemedExpImprovements11_03.htm)_
** **_[Licensing Guidance](http://www.bis.doc.gov/DeemedExports/foreignationals.pdf)__ _
** **_[Frequently Asked Questions](http://www.bis.doc.gov/DeemedExports/DeemedExportsFAQs.html)__ _
** **_**Q&A’s on Clarification of Deemed Export    Regulatory Requirements**_

## Deemed Export Contacts

**Todd Willis**
- Senior Export Policy Analyst
- Ph: 202-482-9163
- E-mail: twillis@bis.doc.gov

**Robert Juste**
- Senior Electrical Engineer
- Ph: 202-482-8245
- E-mail: rjuste@bis.doc.gov

**Kurt Franz**
- Senior Export Policy Analyst
- Ph: 202-482-2278
- E-mail: kfranz@bis.doc.gov

**Alexander Lopes**
- Director, Deemed Exports and
- Electronics Division
- Ph: 202-482- 4875
- E-mail: alopes@bis.doc.gov

**Ilona Shtrom**
- Senior Export Policy Analyst
- Ph: 202-482-3235
- E-mail: lshtrom@bis.doc.gov