Frequently Asked Questions

Frequently Asked Questions


Below is a list of frequently asked questions concerning the NMC’s Institutional Statement of Export Control Commitment and Support. Click on each one to learn more:

Loosely speaking, the phrase “export controls” refers most frequently to the Export Administration Regulations (EAR), the International Traffic in Arms Regulations (ITAR), and the Foreign Assets Control Regulations.  More strictly speaking, though, the term can also include the export rules of the Nuclear Regulatory Commission, the Department of Energy, and the various export licensing regimes imposed in many non-U.S. countries.

Export control regulations can apply to a number of research and educational activities in sometimes surprising and even counter-intuitive ways.  For example, the rules might impact:
  • The carriage or shipment of certain sensitive hardware, software, microorganisms, and other items out of the U.S.;
  • The disclosure of certain non-public data or source code to non-U.S. persons in the U.S. (a “deemed export”); and
  • Travel to-and activities in-countries subject to U.S. trade sanctions.
Exports or transactions that occur without the appropriate government authorization can result in federal audits and investigations, civil fines, and even incarceration, for deliberate, criminal misconduct.

Research institutions typically have students, staff, and researchers who are visiting the U.S. on some sort of visa.  How do institutions deal with the risk of “deemed exports” of data or code, given the presence of so many non-U.S. persons?

A combination of two principal approaches to the “deemed export” problem is typically employed:

  • The Fundamental Research Exclusion (FRE) is a regulatory concept that excludes the results of fundamental research typically undertaken at universities and other institutions from the scope of data subject the EAR and ITAR. In other words, the results of fundamental research may generally be disclosed to non-U.S. students, staff, and researchers without federal authorization because the results are not regulated by export controls, as a threshold matter.  (Grant or contract terms that restrict publication or impose citizenship/nationality requirements can invalidate the FRE; research results from projects subject to those terms may be subject to the EAR or ITAR.  In addition, the FRE does not apply to proprietary information that outside parties may furnish.) It is important to note that even in the conduct of fundamental research and instruction, an export control license may be required if the project involves a Non-Disclosure Agreement (NDA) covering the exchange of export-controlled information, access to export-controlled technology, a non-research function (e.g., a service agreement) where there is access to export-controlled technology, or access to ITAR-controlled equipment.
  • When data or code does not qualify for the FRE, institutions can protect that information from unauthorized release by the implementation of a Technology Control Plan (TCP). TCPs vary significantly in their details, but generally include instructions on the identification, segregation, and security of controlled information.  If a researcher identifies a need to disclose controlled information to a non-U.S. student, visitor or employee, it may be possible to obtain U.S. government authorization (or make use of a regulatory exception or exemption) for the “deemed export,” depending on the technology, nationality, and other circumstances involved.

How entities apply these approaches can fall along a spectrum.  Some institutions prefer to engage in only fundamental research as a matter of default policy, thus reducing the need for TCPs and licenses for “deemed exports.”  The benefits of this approach include lower regulatory risks and compliance costs.  The chief downside is that many grants and contracts (especially for the Department of Defense and its contractors) have mandatory terms that are inconsistent with the FRE, and cannot be accepted.

At the other end of the spectrum, some institutions readily accept grants and contracts for proprietary or restricted research that falls outside of the FRE.  These institutions must implement TCPs and related measures to ensure that they comply with the relevant export control and security requirements.  This approach grants researchers the flexibility to pursue non-fundamental research opportunities, but requires a greater investment in the institution’s compliance infrastructure.

You can be. The export control regulations provide that both the institution and the individual can be held liable. Note that these regulations apply to you in all circumstances, regardless of whether the activity is conducted as part of your University responsibilities.
The Arms Export Controls Act (AECA) and the International Traffic in Arms Regulations (ITAR) provide that willful violations of the defense controls can be fined up to $1,000,000 per violation, or ten years of imprisonment, or both. In addition, the Secretary of State may assess civil penalties, which may not exceed $500,000 per violation. The civil penalties may be imposed either in addition to, or in lieu of, any other liability or penalty.
Similar to the ITAR, violations of the Export Administration Regulations (EAR) are subject to both criminal and administrative penalties. Fines for export violations, including anti-boycott violations, can reach up to $1,000,000 per violation in criminal cases, and $250,000 per violation in most administrative cases. In addition, criminal violators may be sentenced to prison time up to 20 years and administrative penalties may include the denial of export privileges.
For violations under the Office of Foreign Assets Control, potential penalties vary depending on the country and material involved. An exporter may be subject to a maximum civil penalty of $250,000 per violation under the regulations.
In all of the above cases, voluntary self-disclosures, if made appropriately, can mitigate the seriousness of the penalty. Penalties apply to each individual violation, which means that if a violation relates to more than one controlled material or item, or occurs on more than one occasion, each item or incident may trigger a penalty. Contact NMC COO immediately if you think you have made a mistake and violated export controls; we can help assess how best to remedy the situation.

These phrases refer to technical information beyond general and basic marketing materials about a controlled commodity. They do not refer to the controlled equipment/commodity itself, or to the type of information contained in publicly available user manuals. Rather, broadly speaking, the terms “technology” and “technical data” mean specific information necessary for the development, production, or use of a commodity, and usually takes the form of blueprints, drawings, photographs, plans, diagrams, models, formulae, tables, engineering specifications, and documentation. The U.S. government regulates the transfer of technology or technical data to foreign nationals in the U.S. (i.e., a deemed export). You may need a license prior to sharing export-controlled technology or technical data.

Generally, technology or technical data that is publicly available does not require a license to export. Such technology may become publicly available through three ways:

  • Information that arises through fundamental research where the information is ordinarily published is considered to be publicly available. 22 C.F.R. ¬ß 120.11(8); 15 C.F.R. ¬ß 734.8.
  • Information contained in a patent or published patent application. 22 C.F.R. ¬ß 120.11(5); 15 C.F.R. ¬ß 734.10.
  • Information that is published and generally accessible or available to the public 22 C.F.R. ¬ß 120.11; 15 C.F.R. ¬ß 734.7.

Information is “published” when it becomes generally accessible to the interested public in any form, including: (1) publication in periodicals, books, print, electronic, or other media available for general distribution (including websites that provide free uncontrolled access) or to a community of persons interested in the subject matter, such as those in a scientific or engineering discipline, either free or at a price that does not exceed the cost of reproduction and distribution; (2) information readily available at libraries open to the public or at university libraries; (3) patents and published patent applications available at any patent office; or (4) information released at an open conference, meeting, seminar, trade show, or other open gathering held in the U.S. (ITAR) or anywhere (EAR).

  • Note 1: Prepublication review by a sponsor of research solely to ensure that the publication does not compromise patent rights or inadvertently divulge proprietary information that the sponsor has furnished to the researchers does not change the status of the research as fundamental research, so long as the review causes no more than a temporary delay in publication of the research results. However, if the sponsor will consider as part of its prepublication review whether it wants to withhold publication of the research results, then the research would no longer qualify as “fundamental”. As used in the export regulations, it is the actual and intended openness of research results that primarily determines whether the research counts as “fundamental” and not subject to the export regulations. Research is not considered “fundamental research” if the institution or its researchers accept (at the request, for example, of an industrial sponsor) restrictions on publication of scientific and technical information resulting from the project.
  • Note 2: A conference or gathering is “open” if all technically qualified members of the public are eligible to attend and attendees are permitted to take notes or otherwise make a personal record of the proceedings and presentations. A conference is considered open notwithstanding a registration fee reasonably related to cost, and there may be a limit on actual attendance as long as the selection is either ‘first come’ or involves selection based on relevant scientific or technical competence.
  • Note 3: Some information, even if publicly available, may still be restricted depending on with whom you are sharing the information or for what purpose. For example, providing export-controlled information to a foreign military may be a defense service, which would require an export control license. In addition, certain end uses, such as research on biological weapons, or end users, such as those named on restricted lists, may also require an export control license.
The Fundamental Research Exclusion (FRE) only applies to technology or software that arises during, or results from, fundamental research and that is intended to be published. Thus, information received under a Non-Disclosure Agreement (NDA) is subject to the export control regulations.
In most cases, only the institutional representative (only CEO can sign for NMC) should sign an NDA. In addition, the NDA should specify if the information to be shared is export-controlled. Consult with NMC COO to determine if any licenses or technology control plans are necessary, and whether there may be broader impacts to your research.

No, generally this is not a concern, as long as your research is not subject to restricted publication or access. However, please contact your Research Administrator if the information you intend to release is encryption software.

The Export Administration Regulations (EAR) distinguish source code from object code.  For instance, under 15 C.F.R. ¬ß 734.13, the definition of Deemed Exports is “Releasing or otherwise transferring ‘technology’ or source code (but not object code) to a foreign person in the United States.”
Source code is generally understood to mean programming statements that are created by a programmer using a human-readable programming language with a text editor or a visual programming tool and then saved in a file which is later processed to run. Object code generally refers to the output, a compiled or interpreted file, which is produced when the Source Code is compiled or processed with a compiler (e.g. C, C# [to byte code], C++ or Java [to byte code]) or interpreter (e.g. a JavaScript, PHP, Powershell or Python.) The object code file contains a sequence of machine-readable instructions that is processed by the operating environment (runtime) on a computer. Operating system or application software is often in the form of compiled object code.
Notwithstanding the above, please contact your Research Administrator if your software has encryption features or uses encryption functions as there may be reporting requirements to the U.S. government.
The lists of controlled items and technology are extensive. The lists are dependent on the regulatory framework that describes them.
Export Administration RegulationsCommerce Control List15 C.F.R. § 774
International Traffic in Arms Regulations

U.S. Munitions List, specifically, Category XIV and Category XVII may apply to NMC research

22 C.F.R. § 121


For researchers  working with biological items, there is a number of items that will require export licenses prior to being shipped outside the U.S. Examples are attenuated forms of bacteria, toxins, viruses, and fungi that are on the Select Agents and Toxins list or on the  ITAR Category XIV (Toxicological Agents, Including Chemical Agents, Biological Agents, and Associated Equipment)  list.  There are many items that  require export licenses even for minuscule quantities or for snippets of genomic elements. Lists of items controlled by EAR can be found here: Searchable ITAR list: Contact the NMC Biosafety Officer if you have any planned shipment of these items so that the required export licenses can be requested. Note that these may take 6 weeks or longer to obtain.

Dual Use Research of Concern is life sciences research that, based on current understanding, can be reasonably anticipated to provide knowledge, information, products, or technologies that could be directly misapplied to pose a significant threat, with broad potential consequences, to public health and safety, agricultural crops and other plants, animals, the environment, materiel, or national security.
There is a distinction between Dual Use Research and Dual Use Research of Concern. Research yielding new technologies or information with the potential for both benevolent and malevolent applications is referred to as “dual use research.” Some degree of dual use potential may be inherent in a significant portion of life sciences research. However, the small subset of life sciences research with the highest potential for yielding knowledge, products, or technology that could be misapplied to threaten public health or national security is referred to as “dual use research of concern.”
The United States Government has published several policies relevant to Dual Use Research of Concern, with the intention of raising awareness and limiting the potential for misuse of scientific information derived from life sciences research.
Research with one or more of the fifteen DURC agents and/or toxins currently listed in the US Government DURC Policy (6.2.1) and which produces, aims to produce or can be reasonably anticipated to produce one or more of the 7 experimental effects of concern listed in the Policy (6.2.2) must be evaluated by the responsible campus official for its DURC potential. Principal Investigators must notify the NMC COO that they are using DURC agents. Principal Investigators are responsible for assessing whether their research is DURC, reporting this assessment to the DURC Institutional Review Entity (IRE), and, if applicable, implementing a risk mitigation plan.

It depends. Fundamental research is basic and applied research where the results are ordinarily published and shared broadly within the research community. To qualify for the Fundamental Research Exclusion, you must intend to publish the results. If you are aware that a journal may restrict an article that contains information on certain biological agents while engaging in your research, then your research may not qualify for fundamental research, and would be subject to the export control regulations; a license or management plan would be necessary for a foreign national to access the biological agents and/or participate in the research.

You should consult with the Biosafety officer and COO. The shipping, receipt, and handling of such items may require import permits and licenses.

The transfer of commodities and equipment is only controlled by the export regulations when the item is shipped out of the country. Licenses to ship an item outside the United States are required even when the item or equipment is used in or results from fundamental research.
If a commodity is controlled under ITAR, then a license is always required before it can be shipped to any country outside the United States, except in limited circumstances such as shipment to a military base overseas. Licenses are also required to import such items.
For commodities controlled under EAR, whether a license is required depends upon the country to which the item is being shipped. Even in cases where license approval from the Department of Commerce is not required to ship the item to the country, there are administrative requirements and records that must be maintained regarding shipments of EAR-controlled items out of the United States; see 15 C.F.R. § 762.