Export Control Manual

Introduction

United States export controls are a complex set of laws and regulations in place to ensure U.S. national security; prevent the proliferation of weapons of mass destruction; further U.S. foreign policy; and govern U.S. economic stability. U.S. export control laws and regulations govern the transfer of technology, information, and commodities overseas or to a foreign national within the U.S. Export controls apply to all types of entities, organizations, and individuals, including the University of Florida and its faculty, staff, and students.

The University of Florida (UF) anticipates an open international culture of education and research shared broadly with the academic community. As a public institution of higher education, UF employs foreign nationals, collaborates with international partners, and host foreign visitors. UF intends to continue to foster this international engagement while also ensuring compliance with U.S. laws and regulations governing the export of certain commodities, information, and technical data. In support of and in commitment to UF’s compliance with U.S. export control laws, regulations, and policies, the Vice President for Research and Chief Compliance Officer have published a Memorandum of Export Control Compliance.

While most of the research in which UF personnel participates is “fundamental research,” which consists of research in basic and applied efforts published and shared broadly with the academic community, UF does accept restricted research awards and agreements. Some of these awards and agreements may require additional controls to ensure compliance and to avoid inadvertent disclosures of and/or access to confidential and proprietary information.

Institutional Policy

It is the policy of the University of Florida to comply with all U.S. export control laws and regulations including, but not limited to, those implemented by the Department of Commerce through its Export Administration Regulations (EAR) and the Department of State through its International Traffic in Arms Regulations (ITAR) as well as trade controls imposed by the Treasury Department through its Office of Foreign Assets Control (OFAC).

To review the University of Florida’s entire export control policy, click here.

Export Controls at Universities

The University of Florida is an open campus with a wide range of research, education, and outreach. There is a common misunderstanding that export controls do not apply to institutional activities other than research, however, UF employees engage in a number of important activities that may require the need for export compliance. Many other UF business activities, including travel abroad to high-risk countries, hand-carrying UF assets abroad, international shipping, international visitors, controlled or proprietary research, military items, international engagements, and interactions with comprehensively sanctioned countries, require additional review. It is important to understand that export controls apply to all individuals within the UF community.

Understanding the Basics

Governing Bodies

Three principal U.S. regulatory governing bodies oversee the export of commodities and technology outside of the U.S. or to a foreign person:

The U.S. Department of State, Directorate of Defense Trade Control (DDTC), governs commodities, technical data, and defense services which are “inherently military” in nature through the International Traffic in Arms Regulations (ITAR), 22 C.F.R. Part 120;
The U.S. Department of Commerce, Bureau of Industry and Security (BIS), oversees “dual-use” or commercial items through oversight of the Export Administration Regulations (EAR), 15 C.F.R. Part 730; and
The U.S. Department of the Treasury, Office of Foreign Assets Control (OFAC) administers comprehensive and selective sanctions and embargoes including management and oversight of all engagements and activities involving commodities, services, and technologies to prohibited persons or destinations.

Exclusions

While UF does engage in research and activities governed by export control laws and regulations, much of the technology UF develops and many of the programs UF facilitates are exempt from export control authority based on the following three exclusions.

Publicly Available Information
Information, which is previously published and widely available in the public domain, is excluded from export controls. The ITAR defines “public domain” (22 C.F.R. § 120.11) as information which is published and generally accessible or available to the public and thus not considered controlled “technical data” subject to the regulations. The EAR defines “published” (15 C.F.R. § 734.7), and thus not subject to the EAR, as information which has been made available to the public without restrictions upon its further dissemination.
Fundamental Research
Both the ITAR and the EAR define fundamental research as basic and applied research in science and engineering where the resulting information is ordinarily published and shared broadly within the scientific community, as distinguished from research results of which are restricted for proprietary reasons or specific U.S. government access and dissemination controls. One of the differences between the EAR and the ITAR is that the ITAR requires fundamental research to occur at an accredited institution of higher learning in the U.S.There are two caveats that can void the fundamental research exclusion:
• If the University or its researchers accept restrictions on publication of the scientific and technical information resulting from the project or activity; or
• The research contains citizenship or dissemination restrictions requiring specific access controls to protect the research results (i.e. if there is a requirement for U.S. persons only or approval of foreign nationals).
Fundamental research does not apply to physical items including shipping, transfers, exports, re-exports, or development and maintenance of such items.
Educational Information
Information that is generally available through teaching at institutions of higher education is addressed in both the ITAR and the EAR. Such information is generally not subject to the jurisdiction of export controls. The ITAR (22 C.F.R. § 120.10(b)) specifically provides that the definition of “technical data” does not include information concerning general scientific, mathematic, or engineering principles commonly taught in schools, colleges, and universities. The EAR (15 C.F.R. § 734.8(b)(3) and 734.9) specifically provide that publicly available “educational information” is not subject to the controls, if it is released by instruction in catalog courses and associated teaching laboratories of academic institutions.

Government Authorization

Approval from the appropriate governing authority is required prior the export or provision of services controlled under varying export control regulations. This approval may be granted in the form of a specific or general license, an exception (EAR), or an exemption (ITAR). The Export Control Officer serves as the individual responsible for development, submission, and management of export control licenses and determination of appropriate use of exceptions and exemptions. If you have any questions about license exceptions or exemptions, please reach out to UF RISC.

Key Cooperating Offices and Individuals

Complying with export control laws and regulations takes University-wide commitment, not just the efforts of one compliance office. Varying offices and individuals on campus, in conjunction with each individual faculty, staff and student, all working together, are the key to protecting U.S. national security on UF’s campus. Each area plays an individual role in supporting the export control program at UF in its own unique way. Below is a description of the key cooperating individuals and offices involved in the effort.

UF Research Integrity, Security & Compliance

Within UF Research, UF Research Integrity, Security and Compliance (UF RISC) serves as the University’s authority on export controls, providing guidance to UF personnel. UF RISC assists with the application of regulations to UF activities, the transfer, export, or reexport of controlled items, and the provision of services. UF RISC serves as the authority to advise on and apply for U.S. Government export control authorizations. The primary point of contact in UF RISC for export controls is the Export Control Officer, reachable through email at exportcontrol@research.ufl.edu.

Faculty Members

Faculty members play an integral part in export control compliance and management within the University. Faculty members understand their research better than any other source on campus. In addition, faculty manage information, commodities and equipment within their labs. Faculty are best suited to notify UF RISC when engaging in restricted research, partnering with or traveling to international locations, and shipping commodities overseas. This partnership ensures appropriate controls are in place to conduct research and other activities efficiently and effectively.

College and Department Level Research Administrators

College and Unit Research Administrators serve as the first line of communication with faculty, administration, and UF RISC, ensuring information is entered accurately into systems of record, including UFIRST, Asset Management, Travel registry, etc. In addition, research administrators serve to inform and update UF RISC of incoming contracts and activities requiring assistance with export controls.

Division of Sponsored Programs

The Division of Sponsored Programs (DSP) facilitates institutional approval for all proposal submissions, accepts and administers grant awards, and negotiates contracts and research agreements on behalf of the University of Florida. Representatives within these areas review and route all awards, contracts, and agreements with potential export control concerns to UF RISC. DSP triggers an additional review by UF RISC through an internal review system and series of questions within UFIRST that identifies items with potential export control implications during negotiation or award stage.

Asset Management

Asset Management, a division within UF Finance and Accounting, provides support services to the University community to facilitate the management of UF tangible property. In order to manage assets traveling overseas, Asset Management has instituted a review process for foreign travel with UF owned equipment, including traveling for vacation with a UF asset, such as a UF laptop. In conjunction with UF RISC, all UF tangible and/or attractive property requires review and approval prior to transfer overseas, whether temporarily or permanently. The review ensures compliance with export control regulations.

International Travel

UF RISC reviews travel authorization in accordance with University policy, state and federal regulations. This includes travel abroad with UF assets, whether on vacation or business travel, and travel involving dissemination export controlled information, data, or technology. For information on export control-related travel considerations and processes, please visit the Initiating International Business Travel webpage.

Information Security

The UF Information Security Office has established an IT Risk Management process that is based on many factors, and designed to meet all university policies, Board of Governors policies, Florida Statutes, and comply with federal laws. UF RISC and the UF Information Security Office collaborate to develop appropriate IT security procedures within Technology Control Plans (TCP) for export controlled projects. The Risk Assessment contains all relevant documents related to the project ensuring continuity between offices. Once the risk assessment is complete, a report of the findings is submitted to the necessary stakeholders to make a risk-based decision on moving forward with the proposed technology.

Research Computing

Pursuant to the U.S. Department of Commerce National Institute of Standards and Technology, Special Publication 800-171 Revision 2 (NIST SP 800-171 Rev. 2), entities such as UF must follow certain standards regarding protecting controlled unclassified information. UF Research Computing provides comprehensive support for researchers through computing solutions including HiPerGator Research Vault (HiPerGator-RV). Research Computing manages HiPerGator-RV as a pre-vetted secure solution for protection of technical data, source-code, and software in compliance with NIST SP 800-171 Rev. 2. In conjunction with UF RISC, Research Computing supports faculty conducting export controlled research by providing a secure environment to process, store, and manage controlled technical data.

Environmental Health & Safety

UF Environmental Health & Safety (EH&S) houses a number of programs to ensure a safe and healthy environment for all UF business activities occurring on campus. Biological Safety is contained within this list of programs. EH&S is instrumental in the on-campus mitigation of risk related to controlled biologicals and chemicals, as well as the facilitation of international shipping and transport of materials.

For shipping of animals, insects, other biologicals, and chemicals, EH&S may have separate permits and other requirements for importing and exporting such items that are not under UF RISC’s purview. Please contact EH&S in addition to UF RISC for review of international shipments of biologicals and other possibly hazardous substances.

Human Resources

The Office of Human Resources Immigration Compliance Services (HR) processes all University- sponsored employment for foreign national hiring, including H1-B and O-1. HR collaborates with UF RISC to ensure compliance in submission of the Controlled Technology/Technical Data (CTTD) form required by U.S. Customs and Immigration Services prior to hiring.

UF RISC reviews CTTD forms that indicate the potential for government authorization prior to sponsorship of a foreign national for a visa. Export Control licensing or other authorization may be required when an individual engages with restricted or defense research, export controlled commodities or technology, or receives sponsorship from certain federal agencies.

UF Compliance and Ethics Office (UFCE)

The UF Compliance and Ethics Office, under the direction of the Chief Compliance Officer (CCO), coordinates compliance initiatives and operations across the UF enterprise. In that role, the CCO maintains partnerships with all major compliance functions, including UF’s Export Control program. The CCO regularly consults with the Export Control Officer on programmatic matters of enterprise-wide significance.

UFCE manages the UF Compliance Hotline, a confidential hotline service operating 24 hours a day, 365 days per year. The UF Compliance Hotline is used for reporting anonymous concerns related to potential violations, including alleged violations of export control regulations. The hotline may be accessed by calling 1-877-556- 5356. In addition, there is a website available for anonymous reports at https://compliance.ufl.edu/compliance-hotline/.

Office of the General Counsel

The Office of the General Counsel provides legal advice and representation to the University of Florida and its employees while acting within the scope and course of their employment. The General Counsel provides UF RISC with expert advice and guidance in complex legal matters related to export controls, internal reviews, and export control-related voluntary self-disclosures.

Processes and Procedures

The following describes some of the most common processes and procedures related to the export control program at UF. As many situations are unique to the circumstances, the below is intended to serve as an overview and not an exhaustive listing or set of standard operating procedures.

UFIRST

UFIRST is the University of Florida’s official system of record for proposals, awards, and agreements. UFIRST is mandatory for the entry and routing of proposals and agreements managed by DSP. UFIRST allows transparent tracking throughout the lifecycle of the award from proposal development to proposal submission to agreement negotiation, set up and management. Below is a brief snapshot of the relationship UF RISC has within the system related to award and agreement review.

Faculty proposes research through formal proposal in UFIRST.
Agreement or Award is received from Sponsor.
UFIRST data entry, including required export control questionnaire completed by faculty.
DSP review of award or agreement for export control red flags.
Push to UF RISC for export control review with simultaneous negotiation continued by DSP.
1. If UF RISC determines no Export Control concerns, the award is finalized and executed with no Technology Control Plan.
2. If UF RISC determines there are Export Control concerns, the Technology Control Plan process begins.

Additional information regarding UFIRST is available here.

Technology Control Plan

A Technology Control Plan (TCP) is an internal document designed to lay out the plan to appropriately comply with export control regulations and contract terms related to a specific research project or export controlled article. Among other things, the TCP defines technology, software, and commodities involved in the research, responsible jurisdiction and classification (USML or CCL), the physical and IT security, and a listing of project personnel. The document is designed in conjunction with UF RISC, the lead Principal Investigator (PI), and Information Technology (IT). Below is a brief overview of the process of TCP development at UF.

UF RISC determination of a restricted research controlled project or receipt of controlled equipment.
TCP Kick-Off Call (includes UF RISC, PI, local IT, and Research Computing).
Draft TCP sent to PI and IT for review and comment.
Required online export control training by all persons on the project.
Final TCP signed by UF RISC and PI after all negotiations finished.
Required TCP training conducted in person with all Project Personnel.
TCP review and signature by Chair and ADR of College.
TCP active.
If a new person is added to the project, the PI notifies UF RISC and the TCP is updated to add the new person, who will have to complete all required training before signing the TCP and beginning work on the project.
If the scope of work of the project is changed or new and/or unanticipated data or technology is received by UF that is not covered by the TCP, the TCP is updated to provide for the new scope of work, data, and/or technology.
UF RISC will periodically review the TCP and status of the controlled technology to determine whether the TCP needs to be modified, whether the export control classification of the controlled technology has changed, or whether the TCP is ready to be closed.
When the TCP is no longer necessary, the TCP closes.
A TCP may survive the life of the contract period based on the controlled technology, data, or commodity and the jurisdiction. For example, ITAR controlled articles that will be used after the contract period ends will still need to be secured appropriately.

TCP Management

UF RISC works in conjunction with UF faculty and administration to ensure compliance with TCPs. Faculty are required to inform UF RISC of changes to TCPs such as removal and addition of personnel, change in scope of work, or inclusion of subcontractor access. Faculty and all personnel listed on TCPs are required to receive training in conjunction with work on controlled projects.

In an effort to assist faculty with compliance, UF RISC regularly reviews all TCPs for consistency and accuracy. Upon closeout of the controlled project, appropriate procedures will be taken to ensure continued protection of commodities, information, and technology. Each of these steps are appropriately documented in the process.

Before any information may be published on a project under a TCP, the PI should notify the PI’s department chair to confirm whether any of the information to be published must still remain confidential or whether a sponsor or collaborator’s written authorization is required before publication. In some instances, types of information that normally would be allowed to be published may become restricted when paired with research that is under a TCP and subject to contractual confidentiality clauses.

Information Security Risk Assessment Process

All export controlled projects requiring a TCP for management will need to go through the IT risk assessment process. UF RISC engages with UF Information Security Office at an early stage in the TCP development process to ensure the IT risk assessment moves promptly. In addition, engaging the Departmental Information Security Manager (ISM) from the beginning ensures that all parties are in agreement with the required plan and process steps. Engaging the Departmental ISM for assistance in submitting the requests is essential. Find the ISM assigned to each department here: https://security.ufl.edu/it-workers/isaism/ to develop the request. Submit the request to begin the risk assessment process here: https://security.ufl.edu/it-workers/risk-assessment/.

Within two business days of the submission of the request, it will enter the Triage phase of the Risk Assessment process. In Triage, the request may be moved into several categories requiring more information to determine the level of risk assessment that is necessary. For export controlled projects this process can involve multiple units, including the Information Security Office, Research Computing, the Office of the General Counsel, UF Research, and Procurement Services.

The submitter will receive status updates via email regarding the progress of the submission.

For any questions, please email IT Risk Management at UFRM@mail.ufl.edu, noting the request number in the email’s subject line. Risk Management is here to help with this process.

Research Computing Process

The primary goal of the partnership and process between Export Controls and Research Computing Operations (RCO) is to ensure that each research project will have a secure and successful outcome. After determination that a project does need to comply with export control regulations, the RCO team will support the PI for the duration of their project in the use of the HiPerGator-RV computing environment.

In an effort to efficiently set-up controlled research projects and onboard personnel, the following steps are followed:

RCO will conduct an initial consultation with the PI.
RCO will enter the Risk Assessment Request into the Archer system.
RCO will build the Virtual Machine (VM) infrastructure within HiPerGator-RV.
UF RISC will perform the compliance review with the Information Security Office.
RCO will document and perform final review of the VM infrastructure with PI.
UF RISC and RCO will perform training on HiPerGator-RV and TCP compliance together for all project personnel.
RCO and the PI will determine project support needs for the life of the project.
At the completion of the project, UF RISC, RCO, and PI will determine long-term data storage or destruction needs for the data.

For additional information on HiPerGator-RV Services for securing controlled research, please visit: https://rc.ufl.edu/get-started/hipergator-rv/request-hipergator-rv-account/

Asset Management

University, state, and federal regulations require the University to identify and track the location of all capital assets and attractive property. UF employees report all furniture and equipment traveling to a foreign country using a Foreign Travel Request within myAssets. myAssets is the online portal for managing capital assets and attractive property which are owned or controlled by the University of Florida.

UF personnel are required to get approval for all UF owned or UF controlled equipment or attractive assets, whether exported permanently or temporarily and whether on business travel or vacation, from Asset Management and UF RISC before the item leaves the United States. A Foreign Travel Request in myAssets can be submitted by the traveler or anyone associated with the department. UF RISC collaborates with Asset Management to review and approve all equipment or furniture submitted via Foreign Travel Requests.

Asset Management and UF RISC have developed a process to minimize the approval time for the traveler while decreasing the risk to the University of non-compliance with applicable regulations. Low-risk Foreign Travel Requests automatically receive approval in myAssets. For Foreign Travel Requests indicating a potential export control requirement, UF RISC reviews, approves or denies, and provides additional services including facilitation of license applications, use of export control exceptions, and filing of Electronic Export Information through the AES filing system, when necessary.

UF RISC has established the following criteria to determine the risk level of a Foreign Travel Request. A Foreign Travel Request is not low-risk when any one of the following scenarios occur:

The country of destination is a high-risk country;
The item will remain out of the U.S. for more than 365 days;
The item will not remain in the effective control of the traveler;
The item has a designated ITAR category or an ECCN which requires additional review; or
The traveler is listed as project personnel on a TCP.

Foreign Travel Requests route through myAssets to UF RISC for review and, when necessary, UF RISC reaches out to the traveler for additional information. Additional information required to complete the review may include items such as recipient of the export, entity the traveler is visiting, and purpose of travel.

Upon completion of review, the traveler will receive notification by email from myAssets stating the approval or denial of the Foreign Travel Request. Attached within the Foreign Travel Request approval email is a PDF the traveler can utilize to assist with customs questions. For additional information on registration of Foreign Travel Requests, please visit the Asset Management website.

International Physical Exports

Physical Shipments may require additional steps beyond registration in Asset Management, especially when the export is permanent or being exported to a comprehensively sanctioned country. Each export may have varying factors which are carefully considered. For assistance with licensing and authority to export, please reach out to UF RISC directly. Please note, UF RISC cannot assist with import regulations and customs negotiation for foreign countries.

Training Requirements

All individuals working with technology, technical data or items controlled via a Technology Control Plan are required to attend training. Additional trainings are offered to Research Administrators and faculty through various face-to-face meetings.

For export control training courses, visit UF RISC’s Export Control Training page.

Restricted Parties

Each U.S. Government agency with oversight for export controls administers various lists of restricted (or denied) parties. The lists include individuals, organizations, or companies that the federal agency has identified as a party the U.S. may not be able to conduct certain transactions with, such as exporting, investments, or, in some cases, any transaction.

The University will not enter into contracts or other agreements, do business with, or engage in any activity with entities on a U.S. government restricted party list without the prior written approval of the Export Control Officer.

U.S. Department of State, Directorate of Defense Trade Control (DDTC)

The U.S. Department of State maintains six lists, which are found below. Each list contains individuals which are debarred from receiving ITAR controlled items and technical data, all of which the University cannot engage with barring additional in-depth review. The Cuba Restricted List is comprised of entities that U.S. Persons cannot conduct financial transactions with while traveling to or engaging with Cuba.

Department of State Arms Export Control Act Debarred Parties [DDTC]
Department of State Cuba Restricted List
Department of State Nonproliferation Orders
Department of State Munitions Export Control Orders [DDTC]
Department of State Designated Terrorist Organizations
Department of State Terrorist Exclusion List

U.S. Department of Commerce, Bureau of Industry and Security (BIS)

BIS maintains three lists of parties of concern. In the event an individual or entity is listed, an exporter cannot continue the proposed action without further requirements or authorization.

Denied Persons List – A list of individuals and entities that have been denied export privileges. Any dealings with a party on this list that would violate the terms of its denial are prohibited.
Entity List – Identifies foreign parties that are prohibited from receiving some or all items subject to the EAR unless the exporter secures a license from BIS.
Unverified List – A list of parties whose bona fides BIS has been unable to verify. No license exceptions may be used for exports to unverified parties. A statement must be obtained from such parties prior to shipping items not subject to a licensing requirement.

U.S. Department of the Treasury, Office of Foreign Assets Control (OFAC)

OFAC publishes lists of individuals and companies owned or controlled by, or acting for or on behalf of, targeted countries. It also lists individuals, groups, and entities, such as terrorists and narcotics traffickers designated under programs that are not country-specific. Collectively, such individuals and companies are called “Specially Designated Nationals”. Their assets are blocked and U.S. persons are generally prohibited from dealing with them.

Applicable U.S. Laws and Regulations

The primary export control governing bodies exist to oversee the export of technology, items, and services to foreign countries and to foreign individuals within the U.S. These include the International Traffic in Arms Regulations (ITAR), the Export Administrations Regulations (EAR), and the sanctions and embargoes administered by the Office of Foreign Assets Control (OFAC).

Various other U.S. government agencies administer limited controls on the export, reexport, or transfer of certain types of items and technologies, which UF may be involved in, such as the following:

Nuclear Regulatory Commission (“NRC”) regulates nuclear equipment and materials;
Department of Energy (“DOE”) regulates nuclear technology and high-energy lasers, etc.;
Food and Drug Administration (“FDA”) regulates drugs and medical devices; and
Drug Enforcement Agency (“DEA”) regulates drugs and certain chemicals.

International Traffic in Arms Regulations (ITAR)

Regulatory Authority and Scope

The Arms Export Control Act (AECA), as amended, authorizes the President of the U.S. to control the export and import of defense articles and defense services. The authority delegated in the AECA promulgates the ITAR regulations.

The ITAR controls articles, services, and related technical data which are inherently military in nature and designated on the United States Munitions List (USML) enumerated at 22 C.F.R. § 121.1. The USML contains Twenty-One (21) Categories varying in scope and including firearms and ammunition, submersible vessels, military electronics, and radar.

The U.S. Department of State, via the Directorate of Defense Trade Controls (DDTC) ensures commercial exports of defense articles and defense services are consistent with U.S. national security and foreign policy objectives. The agency provides regulatory updates and guidance, is the authority to issue licenses and registrations, and provides commodity jurisdictions.

Important ITAR Definitions

A Defense article (22 C.F.R § 120.6) includes any item or technical data designated in the USML.

Defense service (22 C.F.R § 120.9) is defined to mean:

The furnishing of assistance (including training) to foreign persons, whether in the United States or abroad in the design, development, engineering, manufacture, production, assembly, testing, repair, maintenance, modification, operation, demilitarization, destruction, processing or use of defense articles;
The furnishing to foreign persons of any technical data controlled, whether in the United States or abroad; or
Military training of foreign units and forces, regular and irregular, including formal or informal instruction of foreign persons in the United States or abroad or by correspondence courses, technical, educational, or information publications and media of all kinds, training aid, orientation, training exercise, and military advice.

Technical data (22 C.F.R § 120.10), as defined in the ITAR, means information required for the design, development, production, manufacture, assembly, operation, repair, testing, maintenance, or modification of defense articles. This includes information in the form of blueprints, drawings, plans, instructions or documentation.

Exporting Under ITAR

An export (22 C.F.R § 120.17) has a broad definition within the ITAR including the actual shipment, transmission, release or transfer of control out of the United States or to a foreign person. This includes any release of technical data to a foreign person within the U.S.; this is “deemed” an export to all countries in which the foreign person holds or held citizenship or permanent residency.

In order to legally export defense articles, technical data or defense services, an entity must maintain registration with the DDTC prior to export. UF maintains active DDTC registration as an exporter and renews this registration on an annual basis through UF Research. This registration allows UF to conduct ITAR controlled research and activities, as well as apply for export licenses when necessary. Before applying for export licenses, UF RISC will conduct Restricted Party Screenings of parties on an ITAR-controlled project. For more information on Restricted Parties, review the Restricted Parties section above or visit UF RISC’s Restricted Parties webpage.

In conjunction with the responsible faculty member, UF RISC drafts license applications based on case specifics and regulatory applicability. Only an individual formally designated as an Empowered Official can sign a Department of State license application. The University has designated the Vice President for Research, as well as the Export Control Officer of UF RISC, as the Empowered Officials registered with the Department of State.

Export Administration Regulations (EAR)

Regulatory Authority and Scope

The regulations contained within the EAR implement the Export Administration Act of 1979, as amended. The EAR controls the export of purely commercial items in support of U.S. embargoes and trade sanctions. The U.S. Department of Commerce’s Bureau of Industry and Security (BIS) is responsible for implementing and enforcing the EAR.

An Export Control Classification Number (ECCN) on the Commerce Control List (CCL) designates the items subject to specific control and licensing authority under BIS within the EAR. Frequently referred to as “dual-use”, items on the EAR generally have both commercial and military or proliferation applications.

There are a number of exclusions which have previously been discussed that remove items from the scope of the EAR. These include fundamental research, published information, and educational information.

EAR Definitions and Concepts

Fundamental Research (15 C.F.R. § 734.8), as defined previously, may include the development of “technology”. “Technology” or “software” that arises during, or results from, fundamental research and is intended to be published is not subject to the EAR.

Software (15 C.F.R. § 772) is a collection of one or more programs or microprograms fixed in any tangible medium of expression.

Technology (15 C.F.R. § 772) means information necessary for the development, production, or “use” of an item. “Technology” may be tangible or intangible in form, such as written or oral communications, blueprints, drawings, photographs, plans, diagrams, models, formulae, tables, engineering designs and specifications, computer-aided design files, manuals or documentation, electronic media or information revealed through visual inspection.

Use (15 C.F.R. § 772) means operation, installation (including on-site installation), maintenance (checking), repair, overhaul and refurbishing. NOTE: If an ECCN specifies one or more of the six elements of “use” in the heading or control text, only those elements specified are included under that ECCN.

For more definitions, jump to the Definitions section of this manual.

License Exceptions

Various license exceptions authorize the export or temporary transfer of items abroad without the need for a specific license. Two of the BIS exceptions most frequently used by UF personnel are TMP and SCP. All license exceptions require approval for their official use through UF RISC.

Temporary exports (TMP) (15 C.F.R. § 740.9) – authorizes temporary use abroad of tools of the trade by the exporter to all destinations other than Iran, North Korea, or Syria as long as the following conditions are met:

Tools of the trade must be items which are reasonably used in the individual’s professional capacity while abroad;
Tools of the trade must remain in the “effective control” of the employee at all times;
Tools of the trade must not remain abroad longer than 365 days; and
No release of ITAR or EAR controlled “technology” will occur in conjunction with the temporary export unless otherwise authorized.

UF RISC serves as the authorized official to make decisions on the applicability of EAR licenses providing documentation when necessary. In addition, UF RISC drafts, signs, and submits all specific license applications to BIS in cases deemed appropriate.

Office of Foreign Assets Control (OFAC)

The Office of Foreign Assets Control (OFAC) of the U.S. Department of the Treasury administers and enforces economic and trade based sanctions based on foreign policy and national security goals against targeted countries and regimes, terrorists, international narcotics traffickers, those engaged in activities related to the proliferation of weapons of mass destruction, and other threats to the national security, foreign policy or economy of the United States. OFAC acts under Presidential national emergency powers, as well as authority granted by specific legislation.

Comprehensive Sanctions

OFAC sanctions can be comprehensive or selective, using the blocking of assets and trade restrictions. Comprehensive sanctions are nation-wide sanctions and include the export or import of all goods and services to a specific country or individual normally resident in that country. Each comprehensive sanction varies in its application and licensing policy. For additional information on specific sanctions and their application to UF and for UF RISC’s contact information, please visit UF RISC’s homepage.

Selective Sanctions

Selective sanctions are sanctions programs targeted at a specific activity or regime. These sanctions are more specific in nature and often exclude interactions with the general population of the country.

Selective sanctions change frequently with fluctuations in political regime, national security concerns, and economic interests. Examples of selective sanctions include the Venezuelan Sanctions Regulations and the Rough Diamond Trade Controls.

OFAC Licensing

Authorization from OFAC to engage in a transaction otherwise prohibited by a sanctions program must be acquired in the form of either a general or specific license. A general license authorizes a specific transaction for a group of people without a need to apply for specific authorization. A specific license is a written document issued by OFAC to a particular person or entity, authorizing a specific transaction. Both come with specified terms and conditions to which individuals must adhere.

UF RISC serves as the authorized official to make decisions on the applicability of OFAC general licenses providing documentation when necessary. In addition, UF RISC drafts, signs, and submits all specific license applications to OFAC in cases deemed appropriate.

Other Considerations

Records and Record Retention

The ITAR, EAR and OFAC have stringent record retention requirements related to licensing and the use of exceptions and exemptions. Under each set of regulations, the record keeping period is five (5) years following the completion of the activity. When a license or exception is used, additional records documenting the applicability of the license exception may be required. This requirement extends to the employee as well as the University. Records that should be kept include memoranda, notes, correspondence, financial records, shipping records, and schedules of activities (OFAC).

Shipment of items controlled under the EAR and ITAR should be clearly marked as controlled with regulatory information cited. Any licensed export, as well as exports with a value greater than $2,500, requires filing of registration in the Automated Export System (AES) prior to the export of the item or information. While commercial freight forwarders can assist with this entry into AES, UF RISC is also available to file Electronic Export Information (EEI) on behalf of the University.

Penalties for Violations

Violation of export control laws and regulations can result in both civil and criminal fines up to and including imprisonment. These penalties can be applied to the individual(s), the University, or all parties involved. While the regulations establish maximum fines, the maximum fines established are per instance of violation. The resulting final or penalty can be extrapolated, for instance, by each item exported incorrectly or each occurrence of export, often resulting in large fines. In addition to fines and imprisonment, violations may lead to the loss of export privileges for future transactions or even debarment from participation in federal contracts.

When assessing penalties, government agencies consider mitigating and aggravating factors. Mitigating factors may include Voluntary Self-Disclosure of exports, whether the violation was a first offense, appropriate compliance procedures, and whether the export was inadvertent or a misapplication of the law.

UF faculty, staff or students who have witnessed a potential violation of export controls should report immediately through the UF compliance hotline or directly to the UF Export Control officer at exportcontrol@research.ufl.edu or 352-392-9174.

UF RISC will fully investigate each potential violation, in conjunction with the Office of General Counsel as needed. All reports and circumstances receive careful consideration. Violation reporting to the appropriate governing body occurs when deemed necessary through the proscribed Voluntary Self-Disclosures.

Definitions

Comprehensively Sanctioned Country: A country embargoed under the authority of the U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC). Comprehensive sanctions include the blocking of assets and trade restrictions.

Defense article (22 C.F.R § 120.6) includes any item or technical data designated in the USML.

Defense service (22 C.F.R § 120.9) is defined to mean:

The furnishing of assistance (including training) to foreign persons, whether in the United States or abroad in the design, development, engineering, manufacture, production, assembly, testing, repair, maintenance, modification, operation, demilitarization, destruction, processing or use of defense articles;
The furnishing to foreign persons of any technical data controlled, whether in the United States or abroad; or
Military training of foreign units and forces, regular and irregular, including formal or informal instruction of foreign persons in the United States or abroad or by correspondence courses, technical, educational, or information publications and media of all kinds, training aid, orientation, training exercise, and military advice.

Denied Persons List: A list of individuals and entities maintained by the U.S. government that have been denied export privileges. Any dealings with a party on this list that would violate the terms of its denial are prohibited.

Entity List: Identifies foreign parties that are prohibited from receiving some or all items subject to the EAR unless the exporter secures a license from BIS.

Export: (15 C.F.R. §734.13)
(a) Except as set forth in §§ 734.17 or 734.18, Export means:

An actual shipment or transmission out of the United States, including the sending or taking of an item out of the United States, in any manner;
Releasing or otherwise transferring “technology” or source code (but not object code) to a foreign person in the United States (a “deemed export”);
Transferring by a person in the United States of registration, control, or ownership of:
1. A spacecraft subject to the EAR that is not eligible for export under License Exception STA (i.e., spacecraft that provide space-based logistics, assembly or servicing of any spacecraft) to a person in or a national of any other country; or
2. Any other spacecraft subject to the EAR to a person in or a national of a Country Group D:5 country.

(b) Any release in the United States of “technology” or source code to a foreign person is a deemed export to the foreign person’s most recent country of citizenship or permanent residency.

(c) The export of an item that will transit through a country or countries to a destination identified in the EAR is deemed to be an export to that destination.

Export Controls: the set of regulations that govern the export of commodities and technology outside of the U.S. or to a foreign person, including but not limited to, the International Traffic in Regulations, the Export Administration Regulations and all sanctions and embargoes enacted by the OFAC.

Export Control Officer (ECO): A U.S. person, appointed by the Vice President for Research, who is legally empowered to submit documentation on behalf of U.S. Governing Bodies, including license applications. The ECO is the UF official who makes determinations related to export controls, including but not limited application for license exclusions, exceptions, and exemptions, or to designate such determinations to other qualified individuals.

Export License: A license is an authorization from a U.S. Governing Body to engage in a transaction that would otherwise be prohibited. Only UF’s designated Export Control Officer, or the Export Control Officer’s supervisor(s) may apply for export licenses on behalf of UF.

Reexport: (15 C.F.R. § 734.14)
(a) Except as set forth in §§ 734.18 and 734.20, Reexport means:

An actual shipment or transmission of an item subject to the EAR from one foreign country to another foreign country, including the sending or taking of an item to or from such countries in any manner;
Releasing or otherwise transferring “technology” or source code subject to the EAR to a foreign person of a country other than the foreign country where the release or transfer takes place (a deemed reexport);
Transferring by a person outside the United States of registration, control, or ownership of:
1. A spacecraft subject to the EAR that is not eligible for reexport under License Exception STA (i.e., spacecraft that provide space-based logistics, assembly or servicing of any spacecraft) to a person in or a national of any other country; or
2. Any other spacecraft subject to the EAR to a person in or a national of a Country Group D:5 country.

(b) Any release outside of the United States of “technology” or source code subject to the EAR to a foreign person of another country is a deemed reexport to the foreign person’s most recent country of citizenship or permanent residency, except as described in § 734.20.

(c) The reexport of an item subject to the EAR that will transit through a country or countries to a destination identified in the EAR is deemed to be a reexport to that destination.

Release: (15 C.F.R. § 734.15)
(a) Except as set forth in § 734.18, “technology” and “software” are “released” through:

Visual or other inspection by a foreign person of items that reveals “technology” or source code subject to the EAR to a foreign person; or
Oral or written exchanges with a foreign person of “technology” or source code in the United States or abroad.

(b) Any act causing the “release” of “technology” or “software,” through use of “access information” or otherwise, to yourself or another person requires an authorization to the same extent an authorization would be required to export or reexport such “technology” or “software” to that person.

Restricted Party: Each U.S. Governing Body with oversight for export controls publishes lists of restricted (or denied) parties. Individuals, groups or entities a U.S. government agency has identified as a restricted party cannot engage in certain aspects of business U.S persons without specific authorization.

Restricted Party Screening (RPS) is the process by which UF RISC and other faculty and staff use Visual Compliance to search names of foreign entities and individuals. UF RISC analyzes RPS results to determine if any parties are on a restricted or denied party list, have false matches regarding the name, or have country notes that impact what exports are allowed to particular destinations.

Software (15 C.F.R. § 772) is a collection of one or more programs or microprograms fixed in any tangible medium of expression. (For a definition of Export of Encryption Source Code and Object Code Software, please see 15 C.F.R. § 734.17.

Transfer (In-Country): (15 C.F.R. § 734.16) Except as set forth in § 734.18(a)(3), a Transfer (in-country) is a change in end use or end user of an item within the same foreign country. Transfer (in-country) is synonymous with In-country transfer.

U.S. Governing Body: the three principal U.S. regulatory governing bodies that oversee Export Controls: the U.S. Department of State, the U.S. Department of Commerce, and the U.S. Department of the Treasury.