Export Control Decision Tree

(1) The sharing, shipping, transmission or transfer of almost all encryption software in either source code or object code is subject to U.S. export regulations.

Even most publicly available "dual-use" encryption code captured by the Export Administration Regulations (EAR) requires the availability of a license exception. A license exception under the EAR is an authorization based on a set of criteria, which when met, allows the exporter to circumvent export licensing requirements. The release of publicly available encryption code under the EAR is generally authorized by License Exception TSU (Technology and Software - Unrestricted) whereby the exporter provides the U.S. Government with a "one-time" notification of the location of the publicly available encryption code prior to or at the time the code is placed in the public domain. Notification after transmission of the code outside the U.S. is an export control violation.

In addition, U.S. persons are prohibited without prior authorization from providing technical assistance (i.e., instruction, skills training, working knowledge, consulting services) to a foreign person with the intent to assist in the overseas development or manufacture of encryption software that is subject to U.S. Government notification or authorization. This prohibition does NOT limit UAB personnel from teaching or discussing general information about cryptography or developing or sharing encryption code within the United States that arises during, or results from, fundamental research.

Two license exceptions are available for the UAB community when the tangible export of items and software containing encryption code like laptops, PDAs, and cell phones is necessary for travel or relocation:

• License Exception TMP (Temporary Exports) allows those departing from the U.S. on university business to take with them as "tools of the trade" UAB-owned or controlled, retail-level encryption items such as laptops, smartphones, and encryption software in source or object code to all countries except Cuba, as long as the items and software will remain under their "effective control" overseas and are returned to the U.S. within 12 months or are consumed or destroyed abroad;
• License Exception BAG (Baggage) allows individuals departing the U.S. either temporarily (travel) or longer-term (relocation) to take with them as personal baggage family-owned retail-level encryption items including laptops, smartphones, and encryption software in source or object code. The encryption items and software must be for personal use in private or professional activities. Citizens and permanent resident aliens of all countries except Cuba, Syria, North Korea and Iran may take with them as personal baggage non-retail "strong" encryption items and software to all locations except embargoed or otherwise restricted locations.

(2) Source code is generally understood to mean programming statements that are created by a programmer using a human-readable programming language with a text editor or a visual programming tool and then saved in a file which is later processed to run. Object code generally refers to the output, a compiled or interpreted file, which is produced when the Source Code is compiled or processed with a compiler (e.g. C, C# [to byte code], C++ or Java [to byte code]) or interpreter (e.g. a JavaScript, PHP, Powershell or Python.) The object code file contains a sequence of machine-readable instructions that is processed by the operating environment (runtime) on a computer. Operating system or application software is often in the form of compiled object code.

(1) U.S. persons are specifically prohibited from engaging in activities, either directly or indirectly, that support the proliferation of nuclear explosive devices and missiles to certain countries and their nationals without an export license. Furthermore, U.S. persons are specifically prohibited from knowingly engaging in activities that support the proliferation of chemical or biological weapons to any country and its nationals without an export license. Prohibited activities include direct support (through sharing, shipping, transmission or transfer), or indirect support (through financing, contracting, servicing, transportation, support or employment) that a U.S. person knows will facilitate the proliferation of these weapons of mass destruction (WMD) in or by those countries. In addition, an individual or organization is prohibited from proceeding with a shipment, transmission or transfer of equipment or software, or from a disclosure of information, with the knowledge that an export control violation has, or is about to, occur.

Certain chemical and biological weapons agents and precursors are listed on the U.S. Munitions List (USML) at Category V and XIV and on the Commerce Control List (CCL) in Category 1 at ECCNs 1C111 and 1C350 through 1C360.

(1) Research carrying publication and dissemination restrictions may preclude characterization of the effort as "fundamental research." As a result, you may be facing prohibitions limiting the participation of foreign persons.

"Fundamental research" is defined as basic or applied research in science or engineering, the results of which are intended to be shared with the interested scientific community or otherwise placed in the public domain. Fundamental research, by definition, is free of access, participation, or dissemination restrictions.

Fundamental research is granted special status by U.S. export regulations, such that participation by foreign persons in such research does NOT require export licenses. If the research is NOT "fundamental," then the conduct and results of that research may be subject to the full array of export control restrictions.

(1) A reminder about confidentiality agreements or similar NDAs:

UAB faculty may be asked to accept confidential, proprietary, or export-controlled data or material as part of a research project subject to a Confidentiality Disclosure Agreement (CDA) signed by both the discloser and the recipient. CDAs may include licensing agreements which limit or prohibit the disclosure or transfer of the licensed data or materials.

If you accept confidential or proprietary information subject to a confidentiality disclosure agreement or a non-disclosure agreement, and the disclosure restrictions affect your ability to publish research results, the research itself will lose its characterization as "fundamental research" for export control purposes. You may be required to obtain an export license should the research entail information or software identified on U.S. export control lists, and you wish to have foreign nationals participate in the research.

Of course, if the confidential data pertains to such information as personal health, income, or other demographic data that does not have a strategic significance (and is thus not identified on U.S. export control lists), then export control restrictions on foreign national participation would NOT apply.

For additional information on CDAs, see our page on Confidentiality Disclosure Agreements.

(1) A defense article:

• Is specifically designed, developed, configured, adapted, or modified for a military application, and
• does not have predominant civil applications, and
• does not have performance equivalent (defined by form, fit and function) to those of an article or service used for civil applications;
• Is specifically designed, developed, configured, adapted, or modified for a military application, and has significant military or intelligence applicability (examples are satellites, spacecraft and their subsystems, fully field-deployable systems for military use, and space-qualified for radiation hardened microcircuits); or
• Is on the U.S. Munitions List (USML, the U.S. State Department ITAR list).

(1) Technical data means:

• Information, other than software, which is required for the design, development, production, manufacture, assembly, operation, repair, testing, maintenance or modification of defense articles. This includes information in the form of blueprints, drawings, photographs, plans, instructions and documentation.
• Classified information relating to defense articles and defense services.
• Information covered by an invention secrecy order.
• Software directly related to defense articles.

"Technical data" does NOT include information concerning general scientific, mathematical or engineering principles commonly taught in schools, colleges and universities, information in the public domain, or information generated in the course of performing fundamental research.

It also does NOT include basic marketing information on function or purpose or general system descriptions of defense articles.

(1) The Commerce Control List (CCL) is maintained by the Bureau of Industry and Security (an agency within the U.S. Department of Commerce) as part of the Export Administration Regulations (EAR). This list is sometimes called the "dual use" list, as its listed items may have both military and commercial applications.

The CCL is divided into 10 categories, numbered as follows:

• 0—Nuclear Materials, Facilities and Equipment and Miscellaneous
• 1—Materials, Chemicals, "Microorganisms," and Toxins
• 2—Materials Processing
• 3—Electronics
• 4—Computers
• 5—Telecommunications and Information Security
• 6—Lasers and Sensors
• 7—Navigation and Avionics
• 8—Marine
• 9—Aerospace and Propulsion

Within each category, items are arranged by group. Each category contains the same five groups:

• A—Equipment, Assemblies and Components
• B—Test, Inspection and Production Equipment
• C—Materials
• D—Software
• E—Technology

An Export Control Classification Number (ECCN) uses this system of numbers and letters to categorize items based on the nature of the item, (i.e. type of commodity, software, or technology) and its technical parameters. The first character of the ECCN is a number from 0 through 9 that identifies the broader category to which an item belongs. The second character of the ECCN is a letter from A through E that identifies the product group. The last three digits of the ECCN are specific entries listed on the Commerce Control List. (See following figure).

The BIS Interactive Commerce Control List is a helpful resource when determining if your export is controlled.

(1) Information that is, or will be, placed in the public domain, such as that generated by fundamental research, is not subject to the Export Administration Regulations (EAR) and is exempt from export control regulation.

The EAR defines regulated "technology" as:

Specific information necessary for the "development", "production", or "use" of equipment or software. Technology includes information subject to the EAR released in the form of technical assistance or technical data:

• Technical assistance includes instruction, skills training, working knowledge, consulting services. Technical assistance may involve transfer of export-controlled information.
• Technical data includes blueprints, plans, diagrams, models, formulae, tables, engineering designs and specifications, manuals and instructions written or recorded on other media or devices such as disk, tape, read-only memories.

Generally, export-controlled technology in a university environment takes the form of third-party disclosure-restricted technical information (as opposed to financial, human, and animal data), or software source code. Technical information and software source code covered by a CDA or NDA is subject to export control regulation.

(2) The EAR defines software code as a collection of one or more programs or microprograms fixed in any tangible medium of expression. Software code is comprised of source code or object code:

• Source Code: A convenient expression of one or more processes that may be turned by a programming system into equipment executable form ("object code" or object language).
• Object Code: An equipment-executable form of a convenient expression of one or more processes ("source code" or source language) that has been converted by a programming system.

(1) Under U.S. export control regulations, "disclosure" includes both oral and visual disclosure.

(2) The U.S., the United Kingdom, and many other countries have strict criminal laws governing interactions with government officials, including customs officials. Under the U.S. Foreign Corrupt Practices Act (FCPA), you may not offer or pay anything of value (this not only includes cash, but can include gifts, entertainment or other favors) to a foreign government official in order to gain an improper advantage or obtain, retain or further business activities. Enforcement actions have included cases where customs officials have requested or received bribes in exchange for agreeing not to inspect, or to release goods that have been held up.

Violations of these laws can result in significant criminal penalties for both you and UAB, including fines and potential jail time.

(3) The Consolidated Screening List (CSL) consolidates multiple lists maintained by the Departments of Commerce, State, and the Treasury of individuals and organizations subject to specified, primarily trade-related restrictions. The CSL includes four BIS restricted parties lists: Denied Persons List, Entity List, Unverified List, and Military End-User List.