ITAR Requirements for Employees: A Comprehensive Guide

If you are a business that deals in defense-related items and employs foreign workers, you must comply with International Traffic in Arms Regulations (ITAR). The regulation is designed to protect defense-related sensitive items, patents, and data to help safeguard the national security of the US. Therefore, understanding and following ITAR requirements for employees is crucial to prevent non-compliance and potential harm to the US.

Navigating ITAR compliance can be challenging without proper guidance, and failure to comply can result in monetary penalties, reputational damage, and loss of business.

Our previous guides comprehensively discussed ITAR compliance, its checklist, and the consequences of ITAR violations. This guide will walk you through the ITAR employee requirements and the best practices for maintaining compliance.

Understanding the Common ITAR Requirements for Employees

The US Government institutes ITAR to govern the international export and temporary import of military-grade items, software, and technical data covered in the United States Munitions List (USML). The Bureau of Political-Military Affairs at the U.S. Department of State's Directorate of Defense Trade Controls (DDTC) enforces this regulation.

Understanding ITAR in the employment context can be challenging but crucial. To avoid the risks of non-compliance, it is imperative that you evaluate the ITAR eligibility of the employee and ensure that they aren’t operating from any ITAR-proscribed countries or if they can have access to ITAR data or not. Apart from that, there are several other requirements that employers must fulfill to ensure compliance. Before we delve into these requirements, let's briefly discuss the categories of employees that fall under ITAR regulations.

The Types of Employees in the Context of ITAR

US Persons

The basic eligibility of all the ITAR-covered employees is that they must be US persons. The definition of a US person is provided under 22 CFR § 120.62. To summarize, any individual is a US person:

• Who’s been granted US citizenship,
• Who’s a lawful permanent resident in the US,
• Who’s been granted the status of “protected person”,
• Or an employee of the US government.

Foreign Persons

The definition of a foreign person is provided under 22 CFR § 120.63. To summarize, any individual is a foreign person:

• Who isn’t a US citizen,
• Who isn’t a lawful permanent resident,
• Who isn’t a “protected individual”,
• Or, who isn’t an employee of the US government.

ITAR Requirements for Employees

US Citizenship or Export License from DDTC

As we discussed above, ITAR is instituted to protect the US from any security threats related to the manufacturing or distribution of defense-related items or data. Therefore, the US ensures that only reliable and relevant individuals or organizations can access ITAR-related sensitive data, such as any US citizen or lawful permanent resident. Therefore, the first thing the company should do is make sure that the accessibility to ITAR data must be provided to only those employees who are US persons.

However, if the employee is a foreign person, such as in the case of remote employment, then the employer must apply for an export license for the concerned foreign employee. We can see these requirements in the following ITAR provisions, such as:

For the export of unclassified ITAR data, Part 125.2 (a)(c) states,

“a license is required for the oral, visual or documentary disclosure of technical data by U.S. persons to foreign persons.”

Similarly, for the export of classified ITAR data, Part 125.3 (c) states,

“The approval of the Directorate of Defense Trade Controls must be obtained for the export of technical data by a U.S. person to a foreign person in the U.S. or in a foreign country unless the proposed export is exempt under the provisions of this subchapter.”

However, if the foreign employee is a citizen of or operating from a country that is on the ITAR’s prohibited list of countries, then the export license will likely be void. The list contains more than 20 countries that either pose a potential threat to the US’s national security or have a history of proliferation activities.

ITAR Compliance Training

Non-compliance with ITAR provisions can result in severe fines and civil penalties. Therefore, the Directorate of Defense Trade Controls (DDTC) encourages registered employers to create and maintain an ITAR compliance program. The objective of the program is to help ITAR-registered employers who deal in the manufacturing and distribution of defense items or data to assist with the continuous monitoring and administration of ITAR-regulated activities. Hence, the compliance program includes training employees with respect to the organization's internal processes and its practices for maintaining compliance.

In general, the training program must get the employees familiarized with the key regulations of the law, such as:

• Part 120 - Purpose and Definitions: This is one of the most important sections of the regulation that discusses the key terms used across the law and some general principles and processes.
• Part 122 - Registration of Manufacturers and Exporters: In this section, ITAR lists down all the requirements for registration as an ITAR manufacturer or exporter. The section further highlights the requirements of record keeping.
• Part 124 - Agreements, Off-Shore Procurement, and Other Defense Services: Section 124 of ITAR primarily covers the provisions for the export of data, termination of manufacturing license agreements, and procurement by US persons in foreign countries, to name a few.
• Part 126 - General Policies and Provisions: Section 126 highlights the general policies related to the prohibition of export to specific countries, exceptions, and some exemptions.

All in all, the training program must help employees understand the key regulations of ITAR and prepare them to handle ITAR-covered data better, such as identification of sensitive data, obtaining licenses and agreements for export, etc.

Recordkeeping Obligations

Record keeping is an integral part of the ITAR requirements for employees. Not only does the regulation itself require the organization to keep a detailed record of all ITAR-related activities, but it also serves as evidence of ITAR compliance. ITAR requires organizations to record all sorts of activities, such as all exports and temporary imports, the transfer of technical data to foreign employees, licenses and approvals, foreign persons’ access to ITAR sensitive data, and compliance training.

ITAR compliance further requires organizations to maintain records for up to 5 years from the date of transaction and that the record must be maintained in a format readily available to the US government. Such records allow organizations to maintain and demonstrate compliance in the event of an audit or investigation. It also ensures that employees are properly trained and all their activities align with ITAR compliance best practices.

What Businesses Must Do to Ensure Compliance with ITAR

Businesses must start with determining the legal authority over their product and discover if they deal in any defense-related military goods, services, and documentation covered under USML. Once it is clarified that the business is covered under ITAR regulation, take a deep dive into ITAR regulation to understand its key provisions and requirements, especially for foreign employees.

In the case of an employee who is a foreign person, ITAR requires that the organization must apply for an export license, provided that the employee isn’t a citizen or resident of the proscribed countries. The export license provides all the necessary details for the transaction of the data, such as the end use and end user of the data, details of the foreign employee, and the recipient country. It is to be noted that licenses are valid for up to only 4 years. Therefore, after every 4 years, organizations must apply for the license renewal.

Apart from maintaining an ITAR compliance program for employees, it is also crucial for businesses to monitor and regulate access to ITAR-sensitive data. Since not all employees need access to ITAR-sensitive data, organizations must establish appropriate security controls to prevent unauthorized access, data loss, or leaks. Organizations may also refer to the ITAR Compliance Program Guidelines issued by the DDTC for a detailed account of ITAR compliance obligations.

ITAR has a very strict set of penalties for violators. ITAR fines can range up to 1 million dollars per violation in addition to any other liability or penalty that may be imposed. In the worst-case scenario, non-compliance may further lead to incarceration for up to 20 years.

Enable ITAR Compliance with Securiti’s DataControl Cloud

ITAR compliance is integral for every business that manufactures or distributes defense articles or data. The world’s leading organizations leverage Securiti’s Data Command Center to gain comprehensive visibility of all their sensitive data and establish controls across all clouds. A unified framework enables businesses to eliminate the cost and complexities of cloud data management and protection.

Request a demo to learn how Securiti’s Data Command Center can help with ITAR compliance.