export compliance - central michigan university...structure of an export compliance program...
TRANSCRIPT
Export ComplianceRobert Bienkowski
21 June 2016
Presentation to COD
1
In a nutshell
If you want to send certain things tocertain foreign persons, places or countries,
then you may need a license from the government.
2
Objectives
•Review the vocabulary of export compliance•Discuss the various regulations that control exports•Discuss implications of export compliance for universities and faculty •Begin a discussion of why CMU needs an Export Compliance program
and how it might be organized
3
“Export” is a verb and a noun
•Verb: To send or take controlled tangible items, software, or information out of the United States in any manner (including hand carried), to transfer ownership or control of controlled tangible items, software, or information to a foreign person, or to disclose information about controlled items, software, or information to a foreign government or foreign person.•Noun: The controlled tangible item, software or information being
sent or taken out of the United States. Stanford website
4
Non-US Persons/Foreign Persons
•Visiting scholars holding F-1 or J-1 visas•Employees holding H1-B visas•Businesses, corporations, groups or agencies not
incorporated in the US
5
Export Control - definition
The array of federal regulations that apply to the export of funds or certain technologies (including information as well as materials or products) to non-US destinations, non-US organizations or to persons in the US or abroad who are neither US citizens nor permanent residents, nor “protected immigrants.”
Adrian Shelton, UNC
6
Underlying Structure of the Regulations
There are 3 lists •One list (EAR) deals with “dual use” items that have military and
nonmilitary uses•Another list (ITAR) deals with things that have military uses •The third list (OFAC) contains names of persons, places such as
companies or institutes, and countries that are restricted from receiving any exports without a license
7
Government Agencies & Regulations
•Department of Commerce – Export Administration Regulations (EAR)• Dual use items
•Department of State – International Traffic in Arms Regulations (ITAR)• Military use
•Department of the Treasury – Office of Foreign Asset Control (OFAC)• Persons, places, countries
8
Purposes of the Regulations
1. Control proliferation of certain military technologies
2. Control proliferation of some nonmilitary technologies that may have military applications (“dual use”)
3. Protect US commercial technology advantages
4. Enforce State Department opposition to flow of money to embargoed countries, entities and persons
9
National Security
Economics
Foreign Policy
The regulations and the things and persons on the lists change frequently. For example:• International Traffic in Arms: Revisions to Definition of Export and
Related Definitions•…amends the CCL entry that controls certain human and zoonotic
pathogens and toxins by adding two viruses that were not previously identified on the AG 'List of Human and Animal Pathogens and Toxins for Export Control' •Recent changes to master list of Specially Designated Nationals and
Blocked Persons• Designation of Tariq Gidar Group, aka TGG, ... as a Specially Designated
Global Terrorist
10
On the one hand, we recently learned that…
11
WCVB5/Boston
On the other hand…
12
• The primary U.S. trade embargo targeting Iran remains in place. It prohibits U.S. citizens from investing directly in Iran, and denies Iranian banks the ability to clear U.S. dollars through New York or do business with American financial institutions.
• Sanctions covering military technology, terrorism and human rights all remain in force. Together, they effect a wide range of industries, including aviation.
• Tehran-based Mahan Air remains on the U.S. sanctions list. The U.S. Treasury has accused the airline of providing support to Iran's Quds Force, an elite division of the country's Revolutionary Guards.
• In March, the U.S. Treasury sanctioned individuals who had attempted to conduct business with Mahan Air. It also accused the airline of transporting Iranian military forces into Syria.
Bottom line
•One should not assume anything about the logic of the regulations or their interpretation.
Boeing can sell airplanes to Iran but GM cannot sell Chevies.•When asking whether something, someone, or someplace is subject
to export controls, the most current lists should be consulted.
13
Universities’ Security Blanket - The Fundamental Research Exemption (FRE)Because any information, technological or otherwise, that is publicly available is not subject to the Export Administration Regulations (EAR) (except for encryption object code and source code in electronic form or media) and thus does not require a license, "fundamental research" is not subject to the EAR and does not require a license.
14
Fundamental Research
"Fundamental research" is basic and applied research in science and engineering where the resulting information is ordinarily published and shared broadly within the scientific community. It is distinguished from proprietary research and from industrial development, design, production, and product utilizations, the results of which ordinarily are restricted for proprietary and/or specific national security reasons. Normally, the results of "fundamental research" are published in scientific literature, thus making it publicly available. Research which is intended for publication, whether it is ever accepted by scientific journals or not, is considered to be "fundamental research." A large segment of academic research is considered "fundamental research."
15
Deemed Exports – The Land Mine of Export ControlRelease of controlled technology to a foreign person in the U.S. is "deemed" to be an export to the person’s country of nationality.Typical organizations using deemed export licenses include universities, high technology research and development institutions, bio-chemical firms, as well as the medical and computer sectors.
So, a professor giving a graduate seminar about her work on nanotubes may be exporting information.
16
Why are Export Controls important to universities?• Loss or misuse of universities’ intellectual property•National security concerns
17
FBI Whitepaper - 2011
18
The open environment of US campuses of higher education may be misused in order to:• Steal technical information or products• Bypass expensive research and development• Recruit individuals for espionage• Exploit the student visa program for improper purposes• Spread false information for political or other reasons
Examples of University Export Violations• University of Massachusetts at Lowell, received a $100,000 penalty from Bureau of Industry and Security (BIS).
The exports in this case were not controlled items-all were classified as EAR99 (low level concern), but the recipient of the items was on the BIS Entity List. 2013
• University of Michigan, Mohamad Nazemzadeh, who was a Research Fellow in the Neurology Department at the time of his arrest, was prosecuted for sending a medical device to Iran, in 2013.
• New York University-School of Medicine, three researchers were charged for sharing non-public information with Chinese companies about their NYU work conducted through a grant from the NIH to develop new M.R.I. technologies. 2013
• Georgia Institute of Technology allowed Internet users in 36 countries, including China, and Iran, to view sensitive information that was intended only for federal employees and contractors. This course included 14 PowerPoint slides and was uploaded to Georgia Tech's servers. State Dept determined that violations had occurred. 2009
• University of Tennessee –Knoxville professor John Reece Roth was sentenced to 4 years in prison for violating the Arms Export Control Act by conspiring to illegally export technical information. 2009.
• Texas Tech University professor Thomas Campbell Butler, M.D., was sentenced to 2 years in prison for illegally exporting the Yersinia pestis (bacterium that causes human plague), which is a controlled item under the EAR and cannot be exported without the required export licenses. 2004
19
What is our risk of not having an Export Control Compliance Program?•The risk of violating an export control regulation is probably small.
• Our total external funding for research is modest • All the universities on the previous list have several times more external funding than
CMU
• No concerns from survey last summer of labs for agents on the DURC list • No concerns from audit of sample of recent contracts
• In terms of compliance issues at CMU, my guess is:• Title IX >> Misconduct >> IRB >> Export Controls
20
What do we have to worry about at CMU?Generic Issues• Professors’ travels
• Where they go; where they shouldn’t (without a license)• What they take with them (especially laptops and tablets)• What they bring back; what they leave behind
• “Exports” to research collaborators in other countries• Stuff (such as samples) and ideas
• Visiting researchers• What they can see and hear (Deemed exports)
• Foreign students• What projects they can work on
• Contracts with restrictions• Publication• Embargoes (eg, doing business with Israel)
• Student travel• The unfortunate case of Glenn Duffie Shriver from GVSU
21
Calibrating our worries – Determining level of risk• The risk of a bad event has 2 independent
components:• The magnitude of the event• The probability of the event
22
Low probability/high magnitude events are called “Black Swans” or Never Events
Black Swan Event
•Even if the probability of a violation of Export Control Regulations is exceedingly low, the consequences of not having an organizational infrastructure can be severe.•Monetary penalty•Reputational loss
• So, as the government says…
23
Structure of an Export Compliance Program
1. Articulate and publish an export control compliance policy2. Identify an office at the university in charge of export control
training and compliance1. Conduct a needs analysis/risk assessment2. Establish SOPs
3. Determine who needs export training, what level of training is required, and how frequently the training should be delivered
1. who to ask 2. what to ask 3. when to ask about export compliance
4. Conduct audits to determine effectiveness of the program24
CMU already has a program…unfortunately it’s the other CMU
25
Current Export Compliance Program @ CMU
•3971
26
We do not have to reinvent the wheel
There are many resources available on the web – including from institutions in our peer group:
•Basic information•Training • SOPs
27
28
29
U of M Website
Penn has a very good set of materials
•Here is there flow chart for vetting research contracts
30
Mary Roy External Counsel
31
Answers are usually NO because most university research qualifies for the FRE – the Fundamental Research Exemption
Functions can be distributed among various offices
32
PIsResearch StaffORSRAsBAs
Training at CITIProgram.org can be tailored to a person’s responsibilities
33
Working with the lists
•One of the most daunting and labor-intensive aspects of determining whether shipping something or dealing with someone requires an export license is checking the lists at State, Commerce or Treasury and documenting what you did.• Fortunately, there’s an app for that.
34
Visual Compliance Research Edition (VCRE) is a modular export compliance solution, including…
VCRE Overview
Controlled Goods Classification and License
Determination
Restricted Party Screening
Audit, Reporting, and Dynamic Rescreening
International Trade Compliance Resources
35
Several Michigan universities and research institutes have collaborated to obtain a system license and split the yearly fee of ~$54k
In summary
There are three areas of concern in Export Compliance that we should be able to address with modest additional effort and expenditure:•Vetting foreign visitors•Vetting contracts• Foreign travel
36
Closing words paraphrased from the Federal Sentencing Guidelines
37
It is a general principle of compliance that when things go south:• Having policies and procedures and using them is a mitigating factor• Not having policies and procedures is an aggravating factor