July 5, 2017

ITAR Compliance Requirements You Need To Know

ITAR Compliance: Key Requirements You Must Know

9:58

The International Traffic in Arms Regulations, or ITAR, is a set of government rules that control the export and import of defense-related articles, services and technology on the U.S. Munitions List (USML). It is a collection of critical compliance requirements that help to ensure defense technology and related technical information, like Controlled Unclassified Information (CUI), does not fall into the hands of anyone who is not expressly intended to have it.

Organizations in the aerospace and defense industry must fully understand if and how ITAR compliance requirements apply to them. Many mistakenly assume that this set of regulations only relates to tanks, missiles and weaponry, but in fact, it affects much more than that. In order to avoid the severe penalties and negative consequences of noncompliance, take the time to determine which elements of ITAR, if any, need to be addressed in your compliance efforts. Read on for answers to some fundamental questions regarding this matter.

Who Needs to Be ITAR Compliant?

Any company that does business with the U.S. military, as well as any organization that deals with information related to items, services or related data on the USML, must be highly aware of and fully compliant with ITAR. Understand that affected parties are NOT limited to government and military organizations. Also included are any third-party contractors that work with them, and all companies in the supply chain, such as:

Wholesalers
Distributors
Technical companies

What’s on the USML?

The USML comprises 21 categories of defense articles and services, as well as related technical data, pursuant to the Arms Export Control Act. The import and export of these items are controlled and regulated by the U.S. Department of State. The categories include:

USML Category	Examples
I: Firearms, Close Assault Weapons and Combat Shotguns	Non-automatic and semi-automatic firearms to caliber .50 inclusive, combat shotguns, silencers, mufflers, and sound suppressors.
II: Guns and Armament	Guns and armament like howitzers, mortars, cannons, recoilless rifles, grenade launchers, etc.
III: Ammunition/Ordnance	Ammunition for the weapons in Categories I and II, components, parts, accessories, and attachments for ammunition.
IV: Launch Vehicles, Guided Missiles, Ballistic Missiles, Rockets, Torpedoes, Bombs, and Mines	Rockets systems, missile systems, launch vehicles, ballistic missiles, bombs, torpedoes, etc.
V: Explosives and Energetic Materials, Propellants, Incendiary Agents, and Their Constituents	Explosives, propellants, incendiary agents, and their constituents.
VI: Surface Vessels of War and Special Naval Equipment	Warships, electric motors designed for submarines, underwater robots, etc.
VII: Ground Vehicles	Tanks, military armored vehicles, military vehicles fitted with mountings for arms or equipment for mine laying or mine clearing.
VIII: Aircraft and Associated Equipment	Military aircraft, military helicopters, unmanned aerial vehicles, aircraft engines, etc.
IX: Military Training Equipment and Training	Military training equipment, simulators specifically designed for training in the use of any firearm or weapon in Categories I and II.
X: Personal Protective Equipment	Body armor, helmets, protective garments designed to protect against hazardous materials.
XI: Military Electronics	Military electronics, underwater sound equipment, radar systems, etc.
XII: Fire Control, Laser, Imaging, and Guidance Equipment	Fire control systems, gun and missile guidance systems, imaging equipment, etc.
XIII: Materials and Miscellaneous Articles	Materials specially designed for military use, miscellaneous articles like toxicological agents, including chemical agents, biological agents, and associated equipment.
XIV: Toxicological Agents, Including Chemical Agents, Biological Agents, and Associated Equipment	Chemical agents, biological agents, defoliants, and other toxic agents.
XV: Spacecraft and Related Articles	Spacecraft, satellites, spacecraft launch vehicles, etc.
XVI: Nuclear Weapons Related Articles	Nuclear weapons design and testing related articles.
XVII: Classified Articles, Technical Data, and Defense Services Not Otherwise Enumerated	Classified articles, technical data, and defense services not covered in other categories.
XVIII: Directed Energy Weapons	Lasers, particle beam systems, high power radio-frequency systems.
XIX: Reserved	Reserved for future use.
XX: Submersible Vessels, Oceanographic and Associated Equipment	Submersible vessels, oceanographic equipment, remotely operated vehicles, etc.
XXI: Articles, Technical Data, and Defense Services Not Otherwise Enumerated	Miscellaneous articles, technical data, and defense services not covered in other categories.

As we pull back from this deep dive into the labyrinth of the United States Munitions List (USML), it's clear that this isn't your everyday inventory. It's a meticulously curated collection of defense articles and services, each with its own story and significance. From firearms and explosives to spacecraft and submersible vessels, the USML is a testament to the breadth and depth of defense-related technology. But remember, this list isn't just about what's on it—it's about understanding the implications for international trade and security. So, whether you're in the business of exporting defense articles or just an intrigued observer, keep this guide handy. After all, in the world of defense, knowledge isn't just power—it's security.

What Do I Need to Know About Technical Data?

A protected article under ITAR is any technical data stored in any form (e.g., a document or other digital file) that contains information related to items or services designated on the USML. ITAR compliance is focused on ensuring this technical data is not inadvertently distributed to foreign persons or foreign nations.

One key piece of information to keep in mind is that by law, data management and FTP providers are NOT considered to be an “exporter of data” in the same way your own organization might be. This means that the responsibility of maintaining ITAR compliance does not lie with your provider, but rather with your company and the individuals within your company or outside parties with whom the data is legally shared via the FTP provider.

How Does ITAR Affect Data Management?

To meet compliance requirements, any organization that falls under the jurisdiction of ITAR should design and implement a dedicated security policy, one that is fluid and continually updated to reflect the latest ITAR developments and compliance needs. This policy should include provisions for both physical and network security, addressing how your data is stored and accessed. In addition, it should have a detailed Incident Response Plan to help guide all relevant parties in the event of a breach.

Following are some important steps to take in your efforts to meet your company’s ITAR obligations as they pertain to data management:

Institute a data classification system to guide any data leakage prevention implementation your business happens to use. Not every kind of data your business handles will need to be ITAR compliant, so the key is knowing which techniques to use on which types of data. All of your information should be classified into various categories for easy identification, like “Public Use,” “Internal Use Only,” “Confidential” and more.

Familiarize yourself with the types of situations you are likely to face and how they could put you in violation of ITAR. For instance, mistakes can and will happen, and accidental leaks due to user error or other oversights are quite common. It’s important to put a set of strict policies in place to help prevent users from taking data home to work on it, accidentally sending data using insecure channels and more.

Employ analytical tools and proactive network scans to quickly identify suspicious activity and safeguard your organization from any malicious insider who may be working with a foreign state.

Rely on proper encryption methods to protect data at rest, in use and in transit. At-rest encryption secures data while it is stored on servers, laptop or desktop hard drives and mobile devices. In-use encryption can prevent data from being seen by unauthorized users even if accessed by people with the appropriate permissions. In-transit encryption helps secure data that’s being transferred via email, a file sharing solution or another means.

What Are the Penalties for ITAR Noncompliance?

Once your company is registered with the State Department’s Directorate of Defense Trade Controls (DDTC), it’s critical you understand what is required to be ITAR compliant. Serious repercussions can occur if you violate ITAR, including civil fines as high as $500,000 per violation, criminal fines of up to $1,000,000 per violation and 10 years of imprisonment per violation. Additionally, you can be barred from future imports and exports.

In order to avoid these detrimental consequences, it is crucial to evaluate your file sharing and data handling processes. Are you utilizing a solution that aids you in ITAR compliance efforts?

Most providers are not required to maintain a comprehensive export compliance program, but there are those that offer options to assist you with these requirements. For example, Sharetru provides multiple security layers that customers can control, and it features a country blocker to prevent data from being transmitted outside the United States. This facilitates each customer’s management of their own compliance obligations while processing and storing data on Sharetru servers.