Deemed Exports and Foreign Nationals in the Workplace

Export controls are usually explained in terms of shipments. A large part of the exposure has nothing to do with shipping. Where controlled technology is released to a foreign national working in a United States office or laboratory, the rules treat the release as an export to that person's country, and the authorization that would have been required for a shipment is required for the conversation.

What counts as a release

The dual-use rules define export to include releasing or otherwise transferring technology or source code to a foreign person in the United States. A separate section defines release, and it is broad: visual or other inspection by a foreign person of items that reveals technology or source code, and oral or written exchange of technology or source code.

Inspection is the part that surprises people. A visitor walking through a production area, a contractor with read access to a design repository, or a candidate shown a prototype during a site visit may each have received a release. Nothing has to be handed over and nothing has to be copied.

Not every viewing is a release. The definition turns on whether the inspection reveals the controlled technology, so seeing a finished product in a showroom generally reveals nothing that is controlled, while watching the process by which it is made may reveal a great deal. The practical distinction is between the item and the information needed to develop, produce or use it, and only the second is technology.

Which technology is covered

Only controlled technology matters, and technology has a defined meaning: the information necessary for the development, production or use of an item. That is narrower than everything an engineer knows and broader than the drawing package. Operating instructions, maintenance procedures, integration parameters and process know-how commonly fall inside it.

The classification of the underlying item governs. Where the item is not listed and is designated EAR99, there is generally no deemed export issue for its technology, though the party-based prohibitions still apply. Where the item sits on a control list, the associated technology usually carries its own entry and its own reason for control, which is why the analysis has to start with classification and the control number.

The country the analysis uses

There is no destination in the ordinary sense, so the rules substitute one. Under the dual-use regime the license requirement is assessed against the foreign person's most recent country of citizenship or permanent residency. A national of a country for which authorization would be required to send that technology abroad needs authorization here too, even though the release happens in an office in the United States and nothing crosses a border.

The arms regulations treat the release of technical data to a foreign person as an export as well, and they address dual and third-country nationals through their own provisions and through conditions attached to authorizations. The two regimes reach similar destinations by different routes, which is one more reason the jurisdictional question in which agency controls a product has to be settled first.

The exclusions that do most of the work

Most technical activity in the United States is not caught, because of exclusions rather than because of licenses. Information that is published, and therefore available to the public without restriction, is outside the controls. So are the results of fundamental research, meaning basic and applied research in science and engineering where the resulting information is ordinarily published and shared broadly within the research community.

Those exclusions have edges. Research becomes something other than fundamental where the sponsor imposes restrictions on publication or on participation, and accepting a prepublication approval right can change the character of an entire project. Educational information taught in catalog courses is treated separately again, and the exclusions do not reach the physical items a laboratory builds, which remain subject to the ordinary rules on their own classification.

Managing it in practice

Because the exposure runs through access rather than logistics, the controls that matter are access controls. A technology control plan identifies the controlled technology, records who may see it, segregates it in systems and physical space, and documents the screening applied to new hires, contractors and visitors. Badge systems, permission groups and network segmentation do the work that a shipping process does for goods, and the evidence an examiner asks for is the access log rather than the export declaration.

Where authorization is needed, an application is filed for the specific person and technology, and access is withheld until it is granted. Those applications take time, and the person is usually already employed and waiting, so the analysis belongs at the offer stage rather than at the start date. Employers should also anticipate that hiring and staffing decisions will be constrained by this analysis, in the same way that other categories of employment are constrained by the requirements discussed in employees of a treaty enterprise and essential skills. Screening of the individuals involved runs alongside, using the process described in end-use, end-user and red flag screening.