The International Traffic in Arms Regulations (ITAR)—administered by the U.S. Department of State, Directorate of Defense Trade Controls (DDTC)—is a set of U.S. regulations (22 C.F.R. Parts 120-130) that control defense and space-related items, and data and services related to such items. These include even the most minor components, and can apply to related technical data and services even if no physical exports are taking place.

What is controlled under ITAR?

Defense Articles: Any items specifically designed, developed, configured, adapted or modified in any way for a military/defense or satellite application, or otherwise listed on the U.S. Munitions List are defense articles. 

Examples could include truck components that are modified for a defense-related customer for use on a military vehicle, electrical components that are designed or adapted for use in a military radio, or sensors that are intended for use on a commercial satellite or in a ground control facility.

 Manufacturers of defense articles are required to be registered with DDTC—even if they do not export defense articles—and are expected to implement compliance mechanisms that will prevent unauthorized exports or foreign access to controlled technology.

Technical Data: Information required for the design, development, assembly, production, operation, repair, testing, maintenance or modification of a defense article (e.g., drawings, diagrams, specifications, instructions, or software) is referred to as technical data. DDTC interprets this quite strictly. 

Virtually any technical information used to make or operate defense articles or even the observation of ITAR manufacturing may be subject to controls that prevent foreign persons (including foreign employees who do not have “green cards”) from having access to such information.

Defense Services: Any form of assistance to a foreign person (located wherever) in the design, engineering, development, production, processing, manufacture, use, operation, overhaul, repair, maintenance, modification or reconstruction of defense articles is a defense service. A defense service can be performed without providing any ITAR-controlled information.

For example, helping a foreign customer integrate a commercial component into an ITAR item, suggesting solutions to technical problems with defense articles from public information, providing training related to such articles, or responding to a RFP for a defense- or space-related item may require advanced authorization from DDTC.

Brokering: Any person or entity that facilitates the sale or export of defense articles may come within DDTC’s broad interpretation of brokering, including, but not limited to, contracted sales agents or foreign affiliates. Brokers must be registered with DDTC and must file annual brokering reports. U.S. brokers who are involved in the transfer of technical data or defense services to foreign persons also need to be registered as exporters. Similarly, foreign brokers who receive technical data or defense services need to be included in export authorizations.

ITAR challenges

A DDTC license/authorization (or a written ITAR exemption) is always required to export, re-export or re-transfer a defense article, associated technical data or defense services to foreign destinations, as well as to provide defense services or technical data to a foreign person in the U.S. This includes drawings that are sent overseas for production of components and parts that are sent out of the U.S. for machining or manufacturing. 

In addition, there is a list of prohibited countries to which these items cannot be exported, which is much broader than the sanctioned countries to which other goods or services cannot normally be sent, the most important of which is China. 

In order to deal with the complex requirements of the ITAR, large, sophisticated companies often hire in-house staff/counsel and outside experts to assist them. However, for a wide variety of reasons ranging from inadequate training or mistakes to difficulties in interpreting the ITAR, even these companies still often end up with violations that result in regular voluntary disclosures. 

On the other end of the spectrum, small and mid-sized companies may not recognize the scope of ITAR or its application to their business, which can result in unforeseen violations. Even manufacturers that do not intend to produce ITAR components may be doing so because they have not asked for end-use information for new products or do not understand the implications of defense or space use. 

Companies may also run afoul of the ITAR by not ensuring that their suppliers provide components that are not ITAR-controlled, which can lead their products being “contaminated” with ITAR-controlled components that may impact their business and that of their customers. Even companies that do recognize their compliance obligations frequently lack or have not committed the resources necessary to adequately manage export compliance functions. 

The bottom line

ITAR compliance is important for several reasons. First, the ITAR are intended to protect the nation’s vital national security interests. Second, violations of the ITAR can lead to severe penalties, including fines, confinement and exclusion from defense sector business through debarment, and to reputational harm and customer relations disasters. The maximum penalty is $1 million per violation ($500,000 and 10 years confinement for individuals). 

In the past few years, ITT and BAE plc (U.K.) were fined $100 million and $79 million, respectively, and both were required to hire outside monitors as well. The tiny Pennsylvania company, Electro-Glass Products, was barred from participation in defense exports (even as a supplier) after a criminal conviction that appeared to result from ignorance about the ITAR. 

Fortunately, DDTC has been lenient with companies that identify and remediate their own compliance failures. As a result, more than 1,200 voluntary disclosures are being submitted annually. The simple reason for this is that ITAR compliance can be challenging even for the biggest and most experienced companies. For smaller companies, it can be a trap that leads to costly investigations, government scrutiny, penalties, supply interruptions, impact on mergers and acquisitions and harm to customer relationships. 

It is critical, therefore, for companies to understand their export risk profile, gauge their compliance processes, and discover and remediate compliance gaps.