Export Controls & ITAR - 101

Thank you to everyone who was kind enough to comment on my previous post about companies wanting to get into Defence prime/defence industry work. I've had some messages about what a good trade compliance program might look like and where to begin, so here's some ExIm 101 ideas if you're just starting out.

I should add, most importantly, that these are my thoughts, not my employer's, they are my ponderings, no one else's, and they do not in any way constitute legal or global trade advice for your specific situation. Unfortunately, this article is also not a 'global trade compliance program in a box' - it is intended only as a general information awareness '101' level information to those wishing to enter the Defence industry. I have added in some links to contacts that I like, and respect and know are very capable, but again, it is my personal experience only.

So, with that said, if you're just starting out on your Defence industry journey, here's some basic tips:

1. Start at the start. If you are an Australian company (without foreign products or know-how), what is the Australian export classification of the goods you produce/make/supply/create? First of all, know your own backyard rules. This includes data/ engineering know-how / 'technology' and software. Intangible supply of military end use and dual use technology is controlled - emails, secure server uploads, encrypted servers or messaging services, foreign servers - it is controlled by the Australian government.
2. Even if you don't intend to export, it is really professional to supply classification information with your products when you are selling to primes or to the Commonwealth. It will be a mark of difference and a competitive advantage for your company.
3. Australia's export regulator, Defence Export Control, are brilliant to work with, incredibly generous with their time and advice, supportive of Australian industry and willing to offer expertise. If your product (or know-how) is Australian and 'specially designed or modified' for military end use (or dual use), start here in Australia with our own regulator. @Defence Export Controls | Business & Industry | Defence
4. Read the DEC website, read the Defence Strategic Goods List, read the scenarios, and understand that Australian export laws are not subordinate to the USA, they operate in parallel. See Point 4 in the ITAR section where I explain that in more detail. You must comply with Australian export laws.
5. Now that you've classified your products, if you're in Australia, get a Global Trade person in your organisation, AND a Security person. Start with the Defence DISP page - defence.gov.au / security / industry. You cannot get one person to do both well, and both are equally important. If you don't have a Security person, go and check out the comments on my original post - there are a lot of great people offering help with DISP and Security advice, including my friends at Emilio De Stefano and Co - they reached out after my initial post and they couldn't be nicer and they have great resources.
6. If you don't have a Global trade person, get one. And then get them some training, as much training as you can afford. There are lots of companies and people in Australia who can help with that, including the amazing Suzanne Y. Kao, Esq. at Deloitte Australia, and also don't hesitate to contact Eva Galfi at International Trade Advisors.
7. You will also need reliable, secure and protected IT systems AND a process for record keeping. Australian export law (and the ITAR) require you to keep records for anywhere from 5 to 15 years. So it's important that you and your global trade person, your IT person, your Security person and your project team sit down and work out how you are going to keep records, where you are going to keep records, how you are going to record transfers and exports, how you are going to control access to ITAR data, and how you are going to audit and manage your data controls. There is no 'one size fits all'. Don't let anyone tell you there is. Design your own system.
8. You need to meet the requirements - security, protection, access controls, archiving, marking, and auditability, while making it work for your business. I do suggest finding a document storage and marking system that can handle all this for you. SharePoint is popular, and if that works for you, that's great. But make sure you have the version that allows access audits, reporting, and controls.

So - we have now figured out whether our goods are controlled by Australia.

We have a global trade person, and we have a security person. We have obtained training for them and got some professional advice.

We are working through having our factory/warehouse/ facility DISP certified.

We have put in place our record keeping and access controls.

That's a solid start and will tick a lot of boxes for the primes and the Commonwealth.

But the large elephant in the room is ITAR. The US export control regime: the International Traffic in Arms Regulations. What is it? The ITAR is the 'machinery arm' of the US Arms Export Control Act. Basically, the Act says that the USA can control the export of weapons, munitions and other military end use items, and the ITAR says how that will happen.

Don't let anyone tell you that ITAR is a nightmare. It is really not. It takes common sense, logic, laser focus attention to detail, and elbow grease. That's all. Is it complex? Of course. It controls the export and transfer of the most cutting-edge military capabilities on the planet. How would it not be complex? But that doesn't mean you can't do it and do it well. If you do it well, you will excel in this work.

Understand firstly that not everything American is ITAR. Only what is listed on the United States Munitions List (google it).

Obviously the big ticket items are controlled by ITAR: military jets, tanks, ships, submarines. And that's why we're here.

So, let's talk about the ITAR 101 version for beginners.

1. The same controls that apply to Australian military exports apply to US ITAR exports. So, you can't send anything ITAR overseas without a US ITAR licence. You also can't share anything ITAR unless the entity you want to share it with is specifically named on a US licence ('approved end user'). The US also controls their citizens - US citizens must be licensed or authorised to share their technical expertise, no matter where they are located in the world.
2. There are a wide variety of different types of US ITAR export licences. The best place to start reading about them and what they do is the US Government website itself. eCFR :: 22 CFR Chapter I Subchapter M -- International Traffic in Arms Regulations. My advice is read it once, read the sections again that interest you, then find some 'everyday English' explanations. There is a lot of information about the ITAR online, particularly some good 'layman's' articles from US law firms. But all you really need to know is that there is a variety of licences for different purposes, ranging from marketing to manufacturing. Your global trade person should advise you on the best license solution for your situation.
3. The ITAR also has the famous (infamous) 'see-through' rule, or you might hear it called 'ITAR contamination'. What this actually stems from is the fact that ITAR controls are timeless and global. They control the US item forever. So, for example, you buy an ITAR widget from a US company, receive it under an ITAR licence, and you build it into your machine. You cannot sell your machine, you cannot export your machine, you cannot transfer your machine even inside Australia, without specific written permission from the US government. Because of the widget. The US government controls your machine because they control the widget - forever. And before anyone gets outraged, this is what you agree to when you sign up to a US export licence. You came to them, remember.
4. Something else really important. ITAR does not override Australian export controls. Australia has our own sovereign laws, and they are not subordinate to the USA. So, for example, if you have some submarine technical data, even though you have a US ITAR license that says you may send it to a partner in the United Kingdom, you cannot export it without an Australian export permit as well. You need both the US license and the Australian permit.
5. How do you handle ITAR data and hardware? First, know exactly what the extra-territorial controls are. Ask the OEM or the company who supplied to you - what export controls apply to my item or my data? What license did you use to export it to me? May I have a copy?
6. Also very important - know what you're signing up to. If the US OEM asks you to sign a Data Gathering Form, or you're asked to sign a Letter of Assurance or a Prior Consignee Statement, never be afraid to ask what the questions mean, and what you are signing.
7. You are committing your company to the US government (or the Commonwealth), so make sure you get these details and these documents correct, and that you understand your obligations completely. No one has ever lost a contract by asking clarifying questions, seeking explanations of terms and jargon or acronyms, or having a meeting to completely understand their contract and license obligations.
8. Then you need to understand access restrictions. The ITAR contains a provision that defines an export or re-transfer to a dual citizen as an export or transfer to every country that person holds or has held citizenship or is a current permanent resident of. When you put that together with the list of 'proscribed countries' - a list of countries that simply may not access US ITAR articles or data, you understand why dual or third nationals may be a problem for your organisation's access to US military items.
9. For example: if you have a dual Australian-Russian citizen working for your organisation. Russia is a 'proscribed country' under the ITAR. The fact that your dual citizen has not been to Russia since they were 3 years old is irrelevant in light of the citizenship. This is an incredibly complex issue, because there may be some solutions regarding Australian Defence security clearances, and there are different rules for classified and unclassified articles, and also in the case of FMS (Foreign Military Sales) transfers.

My best advice is: know the citizenship (past and current) of your team and potential employees, have them all get and keep security clearances and then immediately advise your global trade person so that a path may be found - or worst case, if a path can't be found, you know well ahead of the time you may need them.