ITAR resources?   Is a bare PCB ITAR restricted? - Page 1
Forum section: electronics / general

author: smoothVTer
author_rank: Regular Contributor
timestamp: January 14, 2020, 04:24:03 pm
content: I am confused about how ITAR works. Wondering if anybody has ITAR links or resources that can answer any of the following questions.A bare PCB without any components populated on it is only a collection of wires and pads. Without the schematic and the BOM included in the data package, there is no chance any external party could deduce what the bare PCB is used for, or otherwise utilize it for nefarious purposes -- it remains a collection of wires, devoid of any function.Therefore, how could a bare PCB ever be classified as an ITAR-regulated item?Who makes this decision? And how does one find an expert in the matter to answer the intricacies of such inquiries?

author: free_electron
author_rank: Super Contributor
timestamp: January 14, 2020, 04:28:27 pm
content: could be the materials or technology used ... If you use some exotic substrate material. or flex , or very high layer count , stacked via's etc.

author: smoothVTer
author_rank: Regular Contributor
timestamp: January 14, 2020, 04:35:57 pm
content: Ok, agreed. For this discussion, let us establish advanced PCB technologies or materials do not apply. For arguments sake, let's keep this to FR4, 4-8 layers max, 4mil/4mil trace/space, rigid or rigid-flex PCBs with ENIG finishes. Industry standard stuff right now, yes?

author: Kleinstein
author_rank: Super Contributor
timestamp: January 14, 2020, 05:05:12 pm
content: ITAR regulation are political and know for not being updated very often. There where times when you could not legally sell a 386 PC motherboard from the US to Taiwan, while most of those came the other way. Don't expect politics and logic to be compatible. Until about 2000 the US version of Windows 98 was also export restricted.It is not a US only thing. There where such examples from Germany too.If made for a special purpose those boards could still be a problem and customs may ask for the purpose.If not a special quality, chances are the boards would not be made in the US but China or Taiwan anyway.

author: smoothVTer
author_rank: Regular Contributor
timestamp: January 14, 2020, 05:15:29 pm
content: Never heard of EAR before. I will look into their organization now that you have put the information into my head. Thank you!To further elucidate an hypothetical example:I have a <Product A> which, when it its final state -- has all components on the PCBA populated, device software/firmware uploaded, and remaining mechanical assembly is done -- definitely falls under an ITAR restricted classification.The bare PCB for <Product A> I want made in China so I can have the PCB manufacturing step be economical. All I send is Gerbers; no other information about the schematic, the components, or the design and its uses are sent or shared. After PCB manufacture is done, China then sends me back the bare PCBs so I can complete assembly and finish the product under an ITAR-certified electronics assembly house here in my home country.Does an arrangement like I describe above exist?Must ITAR controlled end products have their bare PCBs manufactured in an ITAR-controlled facility?

author: coppice
author_rank: Super Contributor
timestamp: January 14, 2020, 05:39:35 pm
content: Quote from: smoothVTer on January 14, 2020, 05:15:29 pmITAR and EAR rules govern the transfer of products and technology, not their manufacture. The only ITAR controlled facilities are customs control points.

author: exmadscientist
author_rank: Frequent Contributor
timestamp: January 14, 2020, 05:50:44 pm
content: A couple of things worth thinking about:Does your company/organization have an ITAR point person? Most companies big enough or specialized enough to worry about ITAR should. Talk to them! Even if it's only a hallway conversation.How "hard" is the ITAR requirement on the product? By that I mean, where does it sit on a spectrum from "actual military technology" to "stuff that you can basically buy on AliExpress but is still On The List because the bureaucrats are bureaucrats"? The "softer" the technology is, the less people will care. (But you should always comply with the letter of the law!)Even if you are compliant with the letter of the law, would people care if you were "sending technology to China"? That is, suppose Your Worst Enemy™ wanted to spin this as negatively as possible for you (either you personally or your company). Would anyone, for this product and circumstance, care? If so, consider other options, such as...There are other places with cheap PCB fabs besides China (PRC). There's Taiwan (ROC), South Korea, etc. Costs vary widely for prototypes. But everyone starts to converge a bit at production quantities. Yes -- PRC will be cheapest. No one is claiming otherwise. But sometimes it's close enough not to matter, or you can offset the cost with other advantages (quality, shipping, customer support, etc.)

author: donotdespisethesnake
author_rank: Super Contributor
timestamp: January 15, 2020, 11:13:04 am
content: Quote from: smoothVTer on January 14, 2020, 05:15:29 pmIn my experience, ITAR is quite viral. That is, if the end product is ITAR, then all the people, processes, components and suppliers get tarred with the ITAR brush. As noted, ITAR is political, it is a lot aboutprotectionism, IOW denying business to the Chinese who are "taking over".It also affects test equipment. We can't send the supplier screen shots of their product attached to our kit, because it might reveal some information about our kit. This makes it very difficult to get support...It may be fictional, but there was a story about Chinese companies embedding spy chips into PCBs. Potentially similar issues could affect other parts like ICs, so I think supply chain integrity is an important consideration.Note that ITAR is not transferrable. If you have been cleared for ITAR, it does not allow you to decide who to pass information onto, even if it seems completely harmless or in the public domain.Companies are expected to self-police, and have received massive fines for non-compliance. So my advice is err on the side of caution, don't send *anything* outside your company unless signed off and approved at the highest level of engineering function in your company (e.g. VP of Engineering).

author: ajb
author_rank: Super Contributor
timestamp: January 16, 2020, 10:47:18 pm
content: Quote from: smoothVTer on January 14, 2020, 04:24:03 pmThat's a pretty strong statement. Examining a bare PCB can absolutely reveal information about the function of the circuitry. If someone can deduce a bit of other information about its functionality or purpose, then having access to the PCB design even without specific component information could certainly provide useful information about the technology that goes into your project. Say someone wants to learn about some fancy ASIC that is subject to ITAR, if they have access to a board designed for it, that immediately provides a bunch of information on connectivity, a ballpark idea of power, and possibly data rates and performance. Or maybe someone wants to know what sort of hardware it takes to perform whatever function your board is responsible for. Seeing just the board could allow them to make some very informed estimates on processing capacity, IO, power, or whatever. Many footprints are fairly recognizable, if not as a specific component, but as a class of components, which is absolutely useful information in reverse engineering a design, especially if the design is otherwise viewed as a black box. Think about all of the details you consider when laying out a PCB. All of those details essentially get encoded into the layout. Obviously it is difficult or impossible to decode a layout into all of its performance requirements, but there is a lot of information that can be gleaned, and furthermore can't be obfuscated without compromising board functionality.Obviously the likelihood of someone trying to use your particular board design to circumvent ITAR restrictions depends on how juicy of a target the product is, but having an obscure product does not exempt you from your legal obligations under ITAR.

author: smoothVTer
author_rank: Regular Contributor
timestamp: January 17, 2020, 03:16:39 pm
content: Point well taken.Thank you for your contribution on this topic.

author: jmw
author_rank: Frequent Contributor
timestamp: February 05, 2020, 07:37:15 pm
content: Quote from: donotdespisethesnake on January 15, 2020, 11:13:04 amIf you're thinking of the Bloomberg report about tampered Supermicro motherboards ("The Big Hack", published Oct 4, 2018:https://www.bloomberg.com/news/features/2018-10-04/the-big-hack-how-china-used-a-tiny-chip-to-infiltrate-america-s-top-companies), the consensus of everyone other than Bloomberg is that it's bullshit. The claims were extraordinary: that ICs were being embedded into the PCB substrate, way beyond just adding an extra part. Bloomberg never offered an actual tampered board or chip as an exhibit, and all the parties involved denied the story. Normally big investigative scoops have tons of follow-up action, but the by-lines on that story haven't written a thing for Bloomberg since.

author: donotdespisethesnake
author_rank: Super Contributor
timestamp: February 06, 2020, 09:53:11 am
content: Yeah, I think that story was bogus.However, the compliance teams I have personally dealt with are not deeply technical, and now there is a general view "Chinese suppliersmightcompromise the supply chain" which is hard to dislodge, even if there is no actual evidence these compromises occurred. They will prefer to err massively on the "better safe than be fined by the US govt" side.Some of the paranoia regarding China is justified, they are trying to steal Western secrets. Recent stories likehttps://www.zdnet.com/article/raytheon-engineer-arrested-for-taking-us-missile-defense-data-to-china/add to that perception.