International Traffic in Arms Regulations (ITAR)

The International Traffic in Arms Regulations (ITAR) is the US regulatory framework administered by the Department of State's Directorate of Defense Trade Controls (DDTC) that controls the export, import, and transfer of defense articles, services, and technical data listed on the United States Munitions List (USML).

What is ITAR?

ITAR implements the Arms Export Control Act (AECA) of 1976 and is one of the most stringent export control regimes in the world. Any US company that manufactures, exports, imports, or brokers defense articles or technical data covered by the USML must register with DDTC, pay annual registration fees, and obtain licenses or use applicable license exemptions for controlled exports. Violations carry criminal penalties of up to 20 years imprisonment and $1 million per violation, plus civil penalties of up to $1.3 million per violation and debarment from future export privileges.

The USML categorizes controlled items and data across 21 categories covering everything from firearms and ammunition (Category I) to military electronics (Category XI) to spacecraft and launch vehicles (Category XV). Critical for contractors is that ITAR controls not only physical hardware but also technical data: drawings, specifications, engineering data, software, and other documentation that can be used to design, produce, maintain, or operate USML items. Even sharing ITAR-controlled technical data with a foreign national employee on US soil constitutes a deemed export that may require a license.

Defense contractors performing work on USML-covered systems must implement ITAR compliance programs covering employee training, access controls for technical data, visitor protocols for foreign nationals, record-keeping for exports, and procedures for identifying when a license is required. ITAR compliance is not self-certifying; DDTC audits companies for compliance and investigates reported violations.

Why ITAR matters for government contractors

ITAR compliance is non-negotiable for any defense contractor working with military systems, components, or technical data on the USML. Failure to register when required, exporting without a required license, or inadvertently sharing controlled technical data with unauthorized parties - including foreign national employees or visiting contractors - can result in severe penalties. Beyond direct ITAR obligations, defense contractors must also manage ITAR compliance in their supply chains, ensuring that foreign suppliers and teaming partners who receive controlled technical data are properly licensed and compliant.

Example

A defense electronics company develops radio frequency jamming systems covered by USML Category XI. The company is DDTC-registered and holds a Technical Assistance Agreement (TAA) authorizing it to share certain controlled technical data with a UK partner on a joint development program. The company's ITAR compliance officer maintains a database of foreign national employees, reviews hiring decisions against license requirements, controls access to ITAR-restricted technical data rooms through badging systems, and requires all employees to complete annual ITAR training. When a Canadian subcontractor requests detailed component specifications for a covered system, the compliance officer confirms the specifications are controlled, verifies that the TAA covers Canada-UK information sharing, and documents the approved data transfer before release.

Frequently Asked Questions

What is the difference between ITAR and EAR?

ITAR (State Department/DDTC) controls items and data on the United States Munitions List - specifically designed for military applications. EAR (Export Administration Regulations, Commerce Department/BIS) controls commercial items that have potential military applications on the Commerce Control List (CCL). The two systems are complementary but distinct. Defense-specific items are generally ITAR. Dual-use commercial items with potential defense applications are generally EAR. Some items migrate from ITAR to EAR under a process called export control reform (Section 1248 of the NDAA).

Does ITAR apply to US citizens working with controlled data inside the US?

ITAR applies to the export, re-export, or transfer of controlled items and data, which includes "deemed exports" - sharing controlled technical data with foreign nationals in the United States. A US company employing foreign nationals who have access to ITAR-controlled data must determine whether a license is required for that access based on the employee's country of origin and the specific data involved. This is one of the most commonly misunderstood and violated aspects of ITAR compliance.

Do I need to register with DDTC even if I never actually export anything?

Yes. Any company that manufactures (or engages in the business of manufacturing) defense articles on the USML must register with DDTC, even if the articles are never exported. This includes companies that design, produce, or maintain USML items exclusively for domestic US government customers. Registration fees are annual and scaled by the company's activity level in ITAR-controlled areas.

What is a Technical Assistance Agreement and when is it required?

A Technical Assistance Agreement (TAA) is a license authorizing the disclosure of ITAR-controlled technical data and services to foreign persons or organizations, typically in connection with joint development, licensing, or manufacturing programs. TAAs are required when a US company wants to share controlled technical data with a foreign company as part of a collaboration - such as a foreign teaming partner receiving design specifications for a covered system. TAAs must be approved by DDTC before any controlled disclosure occurs.