Control and Handling of Control and Handling of Export Controlled InformationExport Controlled Information

Course # 80038Course # 80038Rev. F1Rev. F1

Uranium Enrichment Technology

Gaseous Diffusion Technology

Not Approved for Public Release3

Identifying ECIIdentifying ECI

4

Terminal Objective

At completion of this course, the student will understand the control and handling of Export Controlled Information.

The Integrated Safety Management System (ISMS) is a systematic, common sense approach to working safely. The objective of ISMS is to integrate working safely into management and work practices at all levels, addressing all types of work and all types of hazards to ensure safety for the workers, the public, and the environment. ISMS integrates working safely into planning and execution of work.

How Does How Does Radiological ECI Radiological ECI Relate to Relate to ISMS?ISMS?

Unclassified technical information(PMA ECI may include some legacy docs, D&D drawings/docs pertaining to GDP, computerized records systems, certain new procurements, etc.).

Export is subject to export control laws and licenses.

Unrestricted dissemination could help potential adversaries of the United States.

What Is ECI?What Is ECI?

7

Within the discipline of uranium enrichment, there are two major categories of ECI items:

Trigger List Items — Equipment and materials especially designed or prepared for nuclear application.

Dual Use Items — Items that have both nuclear and non-nuclear applications.

NOTE: Additional ECI laws, regulations, and lists pertaining to other topics could apply to PMA operations. If questions arise, contact the PMA FSS export control coordinator for assistance.

ECI CriteriaECI Criteria

8

Unclassified information on gaseous diffusion assemblies and components such as:

Barriers Diffuser housings Compressors Gas blowers Rotary shaft seals Heat exchangers

Major Major Trigger ListTrigger List Items Items(Gaseous Diffusion Technology)(Gaseous Diffusion Technology)

9

Unclassified information on gaseous diffusion auxiliary systems, equipment, and components such as:

Feed systems Product and tails withdrawal systems Header piping systems Vacuum systems Shut-off and control valves Mass spectrometers/ion sources

Major Major Trigger ListTrigger List Items, cont. Items, cont.(Gaseous Diffusion Technology)(Gaseous Diffusion Technology)

10

Information on:

High strength aluminum or maraging steel, beryllium, bismuth, boron, calcium, chlorine triflouride, “fibrous or filamentary materials” and prepregs, halfnium, lithium, magnesioum, radium, titanium, tungsten, zirconium, nickel powder, tritium, helium-3, and alpha-emitting radionuclides

Corrosion-resistant valves

Direct current high-power supplies (100 volts or greater)

Corrosion-resistant pressure instrumentation

Large vacuum pumps

Certain seals

Pressure transducers

Mass spectrometers

Major Major Dual UseDual Use Items Items(Gaseous Diffusion Technology)(Gaseous Diffusion Technology)

11

Potential ECI at PMA includes:

Gaseous-diffusion processes or components — including in-line analytical equipment

Site or facility drawings that (1) contain details about gaseous-diffusion processes/dimensions/components or (2) that don’t, yet are included in a document/ presentation/etc. that addresses any other item in the lists (such that the aggregate of data may enable someone to build a diffusion component)

PMA Potential ECIPMA Potential ECI

12

PMA requests for proposal (RFPs), requests for information (RFIs), and responses to vendor questions (however, it is unlikely PMA will issue ECI procurements under its current scope)

D&D drawings, certain legacy documents, and records turned over from USEC

Procurements for computer software (many popular software programs are made by foreign companies or foreign persons; such programsmust not interface with ECI)

Examples of Things That May Be Subject Examples of Things That May Be Subject to Export Controlto Export Control

13

Marking ECIMarking ECI

14

ECI must be processed only on authorized computer systems, and potential ECI must be reviewed by an “authorized” ECI reviewing official prior to distribution. (If your document may contain ECI, contact the FSS export control coordinator before initiating a draft.)

ECI must be marked appropriately, and uncontrolled dissemination especially to foreigners must be prevented.

Review and Marking of ECIReview and Marking of ECI

15

An “ECI reviewing official” is a trained, qualified individual who is delegated and authorized in writing by the DOE’s Office of Non-Proliferation and International Security.

PMA has several authorized ECI reviewers on staff; a list is maintained on the intranet at: http://PMAnet/security/docs/ECIReviewerList.pdf.

For questions or reviews, please contact the PMA FSS export control coordinator John Zangri, ext. 3247, building X-1000).

ECI Reviewing OfficialECI Reviewing Official

16

Ensure that all documents formally identified as containing ECI information are marked with this information, to include the “approved reviewer” (signature) block and date, on the coversheet or first page. All other pages shall be marked “Export Controlled Information” at the bottom.

Marking ECI DocumentsMarking ECI Documents

EXPORT CONTROLLED INFORMATION

Contains technical information whose export is restricted by statute. Violations may result in administrative, civil, or

criminal penalties. Limit dissemination to U.S. Department of Energy employees and contractors, and other U.S.

Government agencies. The cognizant program manager must approve other dissemination. This notice shall not be

separated from the attached document.

Reviewer (Signature) ______________ Date ______________17

Ensure that all ECI removable media are marked with the words “EXPORT CONTROLLED INFORMATION.”

Export controlled matter (equipment/tools/products) usually is not labeled as such, unless destined for disposal or shipped to another facility. Equipment markings shall be securely affixed to the property, legible, and conspicuous. Consult the PMA FSS export control coordinator before disposing of any export controlled property.

Marking ECI Media and MaterialsMarking ECI Media and Materials

Export Controlled Information

18

Reviewed documents that do not contain ECI can be marked with the following verbiage on the bottom of the coversheet (if applicable) or the first page of the document:

The export control coordinator or ECI reviewer determines whether to apply such markings to documents.

““Non-ECI” Document MarkingNon-ECI” Document Marking

INFORMATION CONTAINED WITHIN

DOES NOT CONTAINDOES NOT CONTAIN

EXPORT CONTROLLED INFORMATION

Reviewer (Signature) ___________________ Date ___________

19

Managing ECI Managing ECI InternallyInternally

20

Use a standard, unclassified copying machine or printer if desired.

Limit copies to the minimum amount needed. Do not leave copies unattended. Manually clear copier/printer memory afterward. If copier/printer jams, clear all paper paths. Destroy any partial copies (place in locked shred bin). If necessary to have ECI reproduced off-site, then contact PMA

Contracts/Procurement to ensure appropriate controls are flowed into subcontracts and purchase orders.

Copying/PrintingCopying/PrintingECI DocumentsECI Documents

21

Personally Transporting ECIPersonally Transporting ECI ECI must be concealed in a briefcase, hand-carried

luggage, or other opaque covering that will prevent unauthorized access.

ECI must remain in the control of the authorized individual(s).

The authorized individual is responsible to prevent unauthorized access to the ECI.

22

If mailing ECI on site:

Place the marked document(s) inside an opaque envelope; seal the envelope, and mark it “To Be Opened By Addressee Only.” Then place that envelope in a normal intra-plant mailing envelope addressed to the intended recipient.

Sending Hardcopy ECI Documents Sending Hardcopy ECI Documents Through Plant MailThrough Plant Mail

23

If mailing ECI off site:

Place the marked document(s) inside an opaque sealed envelope addressed to the intended recipient; provide a return address. Mark the envelope “To Be Opened By Addressee Only.”

Utilize the US postal service (first class, express, certified, or registered mail) or any US commercial carrier that requires a recipient’s signature (Federal Express, United Parcel Service, etc.).

Mailing Hardcopy ECI DocumentsMailing Hardcopy ECI Documents

24

Faxing ECIFaxing ECI

ECI may be transmitted with a standard unclassified facsimile machine if the following conditions are met:

The sender notifies the recipient before sending the fax (to verify the recipient is available to receive and control access to the fax).

The sender attaches a cover sheet that identifies the intended recipient, indicates that ECI is being transmitted, and specifies the total number of pages (including the coversheet).

The sender immediately contacts the recipient to verify the receipt of the fax.

The sender and recipient both manually clear the memories on their fax machines.

25

ECI shall be encrypted both inside and outside of the PMA firewall (e.g., even when residing on restricted areas of the PMA network, such as “M” drives or “home” drives, and even when emailed from one PMA-llc.com address to another PMA-llc.com address).

Protecting ECI on Computers Protecting ECI on Computers and in E-mailsand in E-mails

26

ECI can be discussed by standard telephone if the following conditions are met:

Do NOT use cell (mobile) phones!

AVOID speaker phones except in controlled environments (e.g., closed offices, conference rooms, etc.).

Verify that the person being called is authorized to receive the information and has a need to know.

Communicating ECI Communicating ECI Via TelephoneVia Telephone

27

Use only PMA-issued removable media (CDs/DVDs, USB drives, etc.).

Manually encrypt ECI or potential ECI stored on removable media, and maintain control of the media.

ECI stored on PMA-issued, encrypted laptops does not have to be manually encrypted (PMA laptops have automatic encryption software installed) as long as the authorized individual controls the laptop. ECI on all other laptops must be manually encrypted.

Removable Media and LaptopsRemovable Media and Laptops

28

In vault-type security areas (e.g., X-1000 limited area conf. room or PMA records vaults), store ECI such that it is not readily accessible to casual visitors.

Outside of vault-type security areas (e.g., offices in X-1000 off site), store ECI in a locked container, cabinet, desk, or room to which only authorized individual(s) have access.

Encrypt ECI even when storing it in access-controlled areas of the PMA network.

Do not place ECI (even if encrypted) on internet sites that are openly accessible to all employees or the public.

Encrypt ECI before storing it on removable media, then control the media so only authorized individuals can access it.

Storing ECIStoring ECI

29

Do not place ECI in trash or recycling bins (put documents in locked shred bins to await disposal).

Dispose of ECI paper documents using any crosscut or ¼-inch strip shredder.

Destroy ECI on CDs using a shredder designed to accommodate disks.

Destroy ECI matter beyond its intended use/design; contact the FSS export control coordinator for instructions.

During destruction, protect ECI from being viewed by persons without a need to know.

Destroying ECIDestroying ECI

30

Disclosing ECI Disclosing ECI ExternallyExternally

31

DOE requires an ECI review and license before release of technology that could help proliferators or potential adversaries. Any request for an export license must be processed through the PMA FSS export control coordinator.

Export licensing requirements must be met for any export of ECI, including “deemed export” transfers to foreign persons within the US.

Export LicensingExport Licensing

32

A deemed export is domestic release of export controlled technology, including software, verbal information, or documents (i.e., release to a foreign person within US boundaries).

Deemed Export DefinitionDeemed Export Definition

33NOTE: Information does not have to leave the boundaries of the United States to be considered an “export.”

The matrix displayed on the following page describes who may be considered a “US person” and who may be considered a “foreign person.” Read across the top row to the box that identifies the status of the individual, then down the first column to the box that identifies the status of the entity that individual is representing. The actual status of the individual for export control purposes is identified where the applicable column and row intersect.

For example, a US citizen who works for a foreign-incorporated company is considered a foreign person, and must be treated as a foreign person for export control compliance purposes. More broadly, any representative of a foreign interest (*RFI) is a foreign person.

•Take a few moments to become familiar with these descriptions as they pertain to export controlled information.

Export Control Export Control US/Foreign Person Matrix US/Foreign Person Matrix

Entity US person * All Others

Company incorporated in the US (e.g., PMA)License not

neededExport license

needed

US government entity (e.g., DOE, DoD, EPA, DOT, NRC)

License not needed

Export license needed

Company incorporated outside the US (e.g., Boeing Toronto, Ltd.; Areva)

Export license needed

Export license needed

Foreign government entity (e.g., Royal Air Force of the UK)Export license

neededExport license

needed

Foreign organization (e.g., NATO, UN, EU)Export license

neededExport license

needed

* Includes US citizens, US nationals, permanent resident aliens (“green card” holders), alien refugees, aliens granted asylum, amnesty applicants, and special agricultural workers.

35

Export Control — Export Control — US/Foreign Person Matrix, cont.US/Foreign Person Matrix, cont.

US citizen – native-born or naturalized citizen of the United States.

US national – citizen of a US possession that does not have statehood, such as Puerto Rico, Guam, American Samoa, etc.

Permanent resident alien – also known as “green card” holder. Holds I-151 or I-551 document.

Alien refugee – granted refugee status; holds I-571 document.

Alien granted asylum in the US – granted asylee status.

Special agricultural worker/amnesty applicant – someone admitted for temporary residence in one of these categories. Holds I-688 document (not I-688A or I-688B).

36

Anyone who meets ALL of the following criteria:

Has a need to know (determined by PMA Security) and

Is a US person and

Is an employee or subcontractor of:

PMA or

A US federal agency funding PMA work (i.e., DOE) or

A potential supplier to which PMA Contracts/Procurement has flowed down ECI controls (e.g., via contract terms and conditions)

Who Can Access PMA ECI Who Can Access PMA ECI Without a LicenseWithout a License

37

PMA likely will never need to turn ECI over to suppliers during a bidding or purchase process. If such an occasion arose, PMA would first have to flow down ECI controls to all bidders/suppliers (e.g., via terms and conditions) and obtain an ECI review of any technical information to be distributed.

However, PMA may need to purchase items (e.g., software) that, once in place, could allow the supplier to gain access to ECI (e.g., electronic records). Such procurements must first undergo ECI review, as many suppliers are considered foreign persons.

ECI and ProcurementECI and Procurement

38

What Is Unauthorized Disclosure?What Is Unauthorized Disclosure?Unauthorized disclosure of ECI occurs when:

ECI is released to the public at large(such as public relations articles, news stories, and radio/TV broadcasts). ECI is released to an entity without a need to know. Technical information is released to suppliers without having been reviewed for ECI. ECI is released to suppliers without a mechanism in place to flow down ECI (e.g., general terms/conditions). ECI has been released to a foreign national or agent of a foreign national.

39

Examples of Unauthorized DisclosureExamples of Unauthorized Disclosure

ECI is placed in DOE’s Environmental Information Center.

ECI is published to a public web site (even if encrypted, ECI should not be put on the internet).

ECI is published to a restricted portion of the PMA intranet without being encrypted.

ECI is emailed without being encrypted.

ECI is discussed over a cell phone or viewed in a public place.

ECI is presented at a conference or public meeting. 40

In person or by secure device, notify the FSS security manager and your line manager if you suspect an unauthorized disclosure has occurred.

Try to contain the release:

Attempt to retrieve the ECI.

Identify the means of release.

Attempt to identify the persons involved in the release

Responding to Unauthorized DisclosuresResponding to Unauthorized Disclosures

41

Penalties for unauthorized disclosure of ECI can be quite severe and may include fines (e.g., $1,000,000), prison terms, or both.

Penalties for Unauthorized DisclosurePenalties for Unauthorized Disclosure

42