Controlled Technology

Controlled technology refers to technical data, computer software, and hardware items that are subject to U.S. government export controls, primarily under the International Traffic in Arms Regulations (ITAR) or Export Administration Regulations (EAR), and that cannot be transferred to foreign nationals, foreign governments, or foreign companies without a license or other government authorization.

What is Controlled Technology?

Two regulatory regimes govern U.S. export controls. ITAR (22 CFR Parts 120-130), administered by the State Department's Directorate of Defense Trade Controls (DDTC), controls items on the U.S. Munitions List (USML), primarily items specifically designed, developed, or configured for military or defense purposes. EAR (15 CFR Parts 730-774), administered by the Commerce Department's Bureau of Industry and Security (BIS), controls items on the Commerce Control List (CCL), primarily commercial and dual-use items with both commercial and potential military applications.

The export control concept of "deemed export" is particularly important for government contractors: any transfer of controlled technology to a foreign national inside the United States, even a briefing, an email, or access to a computer system containing controlled data, is treated as an export to that person's home country and requires the same license as a physical export. This creates significant compliance obligations for contractors who employ foreign nationals or work with foreign partners.

Defense contractors working with ITAR-controlled technology must: register with DDTC annually; obtain export licenses or Technical Assistance Agreements before transferring controlled items or technology to foreign persons; implement Technology Control Plans (TCPs) describing how controlled technology is protected at contractor facilities; and provide export control training to all employees who may encounter controlled technology.

Violations of ITAR or EAR can result in severe penalties: ITAR civil penalties up to $1.356M per violation, criminal penalties including imprisonment, and debarment from export privileges. Several major defense contractors have paid hundreds of millions of dollars in ITAR settlement penalties for systematic export control violations.

Why Controlled Technology matters for government contractors

Export compliance is a mandatory operational requirement for virtually any defense contractor. Failures can result in contract termination, debarment, and criminal prosecution. Conversely, companies with strong export compliance programs can pursue international work, FMS, DCS, NATO cooperation, that requires robust export control infrastructure.

Example

A defense contractor develops an advanced radar signal processing algorithm under a classified DoD contract. The algorithm is ITAR-controlled as USML Category XI (military electronics). When the contractor hires three software engineers who are citizens of allied NATO nations, it must obtain ITAR licenses (or rely on applicable license exemptions for NATO countries) before allowing those engineers to access the algorithm, even inside the U.S. contractor facility. The contractor implements a Technology Control Plan that restricts access to the algorithm to U.S. persons and specifically authorized license holders.

Frequently Asked Questions

What is the difference between ITAR and EAR control?

ITAR controls items specifically designed, developed, or configured for military or defense purposes, they are inherently military items. EAR controls commercial and dual-use items that have both commercial applications and potential military applications. If an item falls on the USML (ITAR), ITAR applies. If it falls on the CCL (EAR), EAR applies. Some items not on either list are "EAR99", still subject to EAR but not requiring a license for most destinations.

What is a Technology Control Plan (TCP)?

A TCP is a written plan describing how a contractor will protect ITAR-controlled technology at its facilities, limit access to U.S. persons and appropriately licensed individuals, physically secure controlled items and data, and train employees on export control obligations. TCPs are often required by DDTC when granting Technical Assistance Agreements and are a best practice for any contractor working with controlled technology.

Does ITAR apply to work done overseas by U.S. companies?

Yes. U.S. companies and U.S. persons are subject to ITAR regardless of where they operate. A U.S. contractor employee working at a foreign customer site who discusses controlled technology with foreign nationals without a license is violating ITAR even though the activity occurred outside U.S. borders.

Are cloud computing systems subject to export controls?

Yes. Storing or processing ITAR-controlled technical data or software in a cloud environment requires analysis of whether foreign nationals might have access to the data (a deemed export), whether the cloud provider's infrastructure includes foreign nationals who could access the data, and whether the geographic distribution of cloud data centers might result in physical transfer to foreign locations. DDTC has issued guidance on cloud computing and ITAR that contractors must review before uploading controlled data to any cloud system.