Export Control Compliance

< BACK TO RICE POLICIES

Policy Number: 336

Policy Suffix:

I. General Policy

Export control laws are federal regulations that govern the export, reexport, and deemed export of controlled commodities, software, technology, and information outside the United States (U.S.) or to foreign persons in the U.S. Export and trade regulations impose controls over university activities, including the performance of specific research.

These regulations are primarily administered by three agencies – Directorate of Defense Trade Controls (“DDTC”), Bureau of Industry and Security (“BIS”), and Office of Foreign Assets Controls (“OFAC”).

The U.S. Department of State administers the International Traffic in Arms Regulations (“ITAR”) through its agency, the Directorate of Defense Trade Controls (“DDTC”). ITAR regulations control the export, reexport, in-country transfer, and temporary import of defense articles, technical data, services, such as chemical and biological agents, weapons, and satellites. These services may be in the form of providing training, engineering, production, testing, repair, maintenance, operation, destruction, or processing of a defense article. ITAR regulations apply to any item, service, or technical data that is listed on the United States Munitions List (“USML”). Technical data does not include information concerning general scientific, mathematical, or engineering principles commonly taught in schools, colleges, and universities, or information contained in the public domain. Unless an exemption is available, items controlled under the ITAR require a license before export, including sharing the technology with a non-U.S. person while in the U.S.

The U.S. Department of Commerce administers the Export Administration Regulations (“EAR”) via its agency, the Bureau of Industry and Security (“BIS”). EAR controls everyday items, software, and technology, as well as those considered to be dual-use, meaning they have both civil and military uses. Such items include GPS systems, pathogens, toxins, propulsion systems, and telecommunication systems. Most items in the U.S. are subject to the EAR, unless they are subject to the ITAR, or qualify for an exemption. While most items located in the U.S. are subject to the EAR, most do not require a license for export. Items subject to EAR are listed on the Commerce Control List (“CCL”).

The U.S. Department of the Treasury administers sanctions through its Office of Foreign Assets Controls (“OFAC”). OFAC prohibits transactions with various countries, individuals, and entities. Currently, the U.S. maintains comprehensive sanctions against Cuba, Iran, North Korea, and the Crimea, Donetsk, and Luhansk regions of Ukraine. Most activities and transactions with these countries or their citizens require a license before proceeding.

Under U.S. export control laws, the federal government may impose both civil and criminal penalties on individuals and the university for violations. Consequently, Rice expects all faculty, staff, students, visiting scholars and other personnel both in the U.S. and overseas campuses to be compliant with U.S. export control laws and regulations, including EAR, ITAR, and regulations administered by OFAC.

Failure to comply with U.S. export control laws and regulations will result in disciplinary action, up to and including loss of funding, termination of employment, and civil and criminal penalties imposed by federal authorities.

This policy applies to all Rice University faculty, staff, students, visiting scholars, and other personnel both in the U.S. and at overseas campuses, as well as all university activities in the U.S. or abroad that may require export control oversight, including those covered by any federal, state, or local regulations.

Rice University maintains an unwavering commitment to academic freedom as vital to the university's function and a foundational value of the Rice community. This commitment ensures that export control compliance activities support the discovery, improvement, and dissemination of knowledge through scholarly inquiry, open dialogue, and the pursuit of knowledge. Furthermore, the university ensures that all export control compliance activities are conducted ethically and free of discrimination, in accordance with Policy 815, Equal Opportunity/Non-Discrimination, Policy 830, Policy on Discrimination and Harassment, and Policy 100, Standards of Ethical Conduct.

II.Definitions

Commerce Control List (CCL): A list of “dual use” items, materials, software, and technology, subject to export regulation, maintained by the Department of Commerce that can be used both in military and other strategic uses (e.g., nuclear) and commercial applications.

Controlled Items: Items, technology, or software that are subject to export control regulations. These may include certain chemicals, biological agents, equipment, software, and technical data.

Controlled Technical Information (CTI): The Department of Defense (DoD) defines CTI as information with military or space applications. CTI is a type of CUI.

Controlled Unclassified Information (CUI): The DoD defines CUI as information that the United States Government creates or possesses that requires safeguarding or dissemination controls limiting its distribution to those with a lawful government purpose that may not be released to the public.

Country of Concern: Defined by 28 CFR 202.209 as any foreign government that, as determined by the U.S. Attorney General with the concurrence of the Secretary of State and the Secretary of Commerce has engaged in a long-term pattern or serious instances of conduct significantly adverse to the national security of the United States or security and safety of United States persons; and poses a significant risk of exploiting government-related data or bulk U.S. sensitive personal data to the detriment of the national security of the United States or security and safety of U.S. persons. Specific countries are listed in the DOJ Data Security Program Compliance Guide as China (including Hong Kong or Macau), Venezuela, Russia, North Korea, Iran, and Cuba.

Critical and Emerging Technology: A list of technologies critical to U.S. national security interests published by the Office of Science and Technology Policy (OSTP).

Deemed Export: According to CFR 734.14, it is releasing or otherwise transferring “technology” or source code (but not object code) to a foreign person in the U.S.

Defense Article: According to CFR 120.31, any item or technical data (these include military and commercial, navigational, research satellite, and space-related items, equipment, vehicles, instrumentation, software, and materials), designated by the Department of State in the International Traffic in Arms Regulations. This term includes technical data recorded or stored in any electronic or physical form, as well as models, mockups, or other items that directly reveal technical data relating to items on the United States Munitions List. It does not include basic marketing information on function, purpose, or general system descriptions.

DOJ Bulk-Sensitive Data Rule: A rule issued by the DOJ, stemming from Executive Order 14117, that implements guardrails to protect the sensitive data of U.S. persons.

Dual-Use: According to CFR 730.3, a dual-use item is a technology, good, or software that has both legitimate civilian applications and potential applications for military, terrorism, or the development of weapons of mass destruction. These items are often subject to strict export controls and regulations, such as the U.S. Commerce Control List (CCL), to prevent misuse and proliferation for non-peaceful purposes.

Empowered Official (EO): According to CFR 120.67, a U.S. person who is legally empowered in writing by the university to sign ITAR export license applications or other requests for approval on behalf of Rice University.

Export: According to CFR 734.14, it means both (i) An actual shipment or transmission out of the United States, including the sending or taking of an item out of the United States, in any manner, or (ii) Releasing or otherwise transferring "technology" or source code (but not object code) to a foreign person in the United States (a "deemed export").

Export Administration Regulations (EAR): EAR is issued by the United States Department of Commerce, Bureau of Industry and Security (BIS), under laws relating to the control of certain exports, reexports, and activities related to dual-use items on the CCL.

Export License: According to the International Trade Administration, an export license is a government document that authorizes the specific export of certain goods, software, or technology.

Foreign Person: According to CFR 120.63, any natural person who is not a U.S. citizen or lawful permanent resident as defined by 8 U.S.C. 1101(a)(20) or who is not a protected individual as defined by 8 U.S.C. 1324b(a)(3). It also means any foreign corporation, business association, partnership, trust, society, or any other entity or group that is not incorporated or organized to do business in the United States, as well as international organizations, foreign governments, and any agency or subdivision of foreign governments (e.g., diplomatic missions).

Fundamental Research: According to CFR 734.8 (c), it is research in science, engineering, or mathematics, the results of which ordinarily are published and shared broadly within the research community, and for which the researchers have not accepted restrictions for proprietary or national security reasons.

International Traffic in Arms Regulations (ITAR): Regulations issued by the Department of State, which has responsibility for controlling the permanent and temporary export, as well as the temporary import, of defense articles and services.

National Security Presidential Memorandum 33 (NSPM-33): An Executive Order that mandates heads of funding agencies to require research institutions receiving Federal science and engineering support in excess of $50 million per year to certify to the funding agency that the institution has established and operates a research security program that includes export controls training.

Office of Foreign Assets Control (OFAC): An office within the U.S. Department of the Treasury, which administers and enforces economic and trade sanctions based on US foreign policy and national security goals against targeted foreign countries, terrorists, international narcotics traffickers, and those engaged in activities related to the proliferation of weapons of mass destruction.

OSTP Guidelines for Research Security Programs at Covered Institutions: An executive memorandum that gives an outline for how the university can fulfill the certification requirement for Export Controls training.

Prohibited Transactions: Defined in CFR 599.201.

Reexport: Defined by EAR in 15 CFR § 734.14 and ITAR in 22 CFR § 120.51.

Release: According to CFR 734.15, it is a (i) Visual or other inspection by a foreign person of items that reveal "technology" or source code subject to the EAR to a foreign person; or, (ii) Oral or written exchanges with a foreign person of "technology" or source code in the United States or abroad.

Research: According to CFR 46.102(d), it is a systematic investigation, including research development, testing, and evaluation, designed to develop or contribute to generalizable knowledge. This term is intended to be construed broadly, to cover all types of scholarly inquiry and Research that Scholars engage in at Rice University.

Rice-Owned Device: A Rice-owned device refers to any electronic device or hardware component purchased, leased, or otherwise acquired or issued by Rice University.

Rice-Related International Travel: Consistent with Policy 852, International Travel, a scholar traveling outside of the United States, and whose travel is funded in part or in full by Rice funds (including research funds), a component of the Rice curriculum or earning academic credit toward a Rice degree, part of a Rice-sponsored team, group, club, or organization, or a scholar representing the university or otherwise on behalf of the university.

Sanctioned Countries: Countries designated under the Foreign Access Control Regulations or through Executive Orders as having limited or comprehensive trade sanctions imposed by the United States for reasons of anti-terrorism, non-proliferation, narcotics trafficking, or other reasons.

Scholar: Includes all faculty members, including Tenured, Tenure-Track, Non-Tenure-Track, and Teaching Faculty. This term also encompasses the following: investigators, Principal Investigators, laboratory personnel, postdoctoral fellows, research scientists, visiting researchers, staff, and any other personnel engaged in research-related activities at Rice University. Furthermore, Adjunct Faculty and students who are Investigators (such as principal investigator, co-investigator, key personnel, or member of the research team) on a Rice-sponsored Research project are also considered Scholars.

Sensitive: In the context of this policy, this refers to items, technology, and data that are controlled by EAR and ITAR or are defined by the U.S. government as a Critical and Emerging Technology.

Technology Control Plan (TCP): A written plan that establishes physical, personnel, and cybersecurity measures to prevent unauthorized access to export-controlled items, technology, or data. TCPs specify the controlled items involved, the authorized personnel, and the procedures for maintaining compliance with applicable export control regulations.

The United States Munitions List (USML): a list that includes articles, services, and related technical data designated by the Department of State as defense articles and defense services pursuant to the Arms Export Control Act.

III. Roles and Responsibilities

Scholars
Scholars involved in research are responsible for ensuring compliance with U.S. export control laws and regulations by working with the Office of Research Security and Export Controls (RSEC) to determine if their research, technology, or technical data is considered fundamental research or if it is subject to U.S. export control regulations and cannot be shared or disseminated with Foreign Persons. Requests for assessment of research, technology, or technical data can be submitted on the RSEC Intake.

Prior to granting any foreign national access to laboratories, facilities, or projects involving controlled items, technology, or data, the scholar sponsoring the foreign national must coordinate with RSEC to conduct an export control screening. This screening will include verification of the individual’s identity, citizenship, and any affiliations with foreign governments, military organizations, or sanctioned entities on U.S. government lists. For foreign nationals from countries of concern, enhanced due diligence and additional access restrictions may be required.

Scholars working with export-controlled items, technologies, or data must take export controls training provided by RSEC, in compliance with NSPM-33 and related requirements.

Scholars participating in professional conferences or delivering oral presentations that involve sensitive or controlled items, technology, or data must ensure that the information they share does not include controlled technical data or 'technology' subject to the EAR or ITAR. Because a 'release' of technology can occur through oral or written exchanges, scholars are responsible for working with RSEC to verify that their presentation materials qualify as fundamental research or are otherwise eligible for public dissemination before sharing them with foreign persons, whether in the U.S. or abroad.

Scholars involved in international collaboration or foreign exchange activities, including study abroad programs, are responsible for working with RSEC to determine whether these activities comply with U.S. export control regulations. To do so, they should submit a request to the RSEC Intake.

Scholars conducting Rice-related international travel may not travel to an OFAC-sanctioned country. All scholars must register proposed Rice-related international trips through the Travel Registry, in accordance with Policy 852, International Travel.

Scholars conducting personal international travel to or with layovers in a country of concern, while using Rice-owned devices, personal devices containing research-related data, or plans to access Rice software or systems, must register their travel in the Travel Registry. Doing so will enable RSEC to provide a pre-travel briefing that includes guidance on data security and to evaluate devices and data for export controls or other concerns, like the Department of Justice Bulk-Sensitive Data Rule.

Visiting scholars, exchange students, and other foreign national personnel must be onboarded through a process that includes export control awareness training and acknowledgment of their obligations under this policy. Access to controlled items, technology, or data may only be granted after RSEC has confirmed that such access is permissible under applicable export control regulations or that the necessary export licenses or other authorizations have been obtained.

Research Administrators
Research Administrators are responsible for screening grant proposals, contracts, awards, and post-award purchases for export control concerns and notifying RSEC if export control terms are present.

RSEC
RSEC is the administrative unit at Rice University responsible for overseeing compliance with all activities covered by this policy. RSEC reports to the Associate Vice President of Public Safety and Research Security, who serves as Rice University's EO for compliance with the ITAR.

A. RSEC is responsible for the following:

Implementing and maintaining TCPs, as well as TCP audits on a basis determined by RSEC.
Providing export controls training as needed, in compliance with NSPM-33, OSTP Guidelines for Research Security Programs at Covered Institutions, and other applicable regulations.
Fundamental research determinations.
Filing commodity jurisdiction requests.
Commodity classifications.
Managing export license processes.
Ensuring the proper handling and dissemination of sensitive technical data, including CUI and CTI.
Assisting the EO with instances of noncompliance

Technology Solutions & Services (TS&S) TS&S collaborates with RSEC, in accordance with Policy 808, Protection of University Data and Information, to ensure compliance with data security requirements for CTI, CUI, and any other data classified as export-controlled under the EAR, ITAR, or other U.S. export control regulations.

Office of Research Integrity (ORI)
ORI is responsible for contacting RSEC if researchers are involved in protocols and processes governed by the Institutional Animal Care and Use Committee, the Institutional Review Board, the Conflicts of Interest office, and the Institutional Biosafety Committee, and if those protocols or processes require guidance on export controls.

Office of Sponsored Projects (OSP)
OSP conducts an initial screening of the terms and conditions of proposals, incoming awards, subawards, and grants to identify potential export control restrictions. OSP is responsible for notifying RSEC when export control-related terms or conditions are present.

Office of Technology Transfer (OTT)
OTT is responsible for working with RSEC to determine whether export controls apply to any item, technology, or data before sharing as part of any agreement.

Office of General Counsel (OGC)
OGC is responsible for providing final legal interpretation of export control regulations and coordinating with and retaining outside counsel on complex matters or potential violations.

IV. Elaboration of Policy

Export control regulations apply to all University research, activities, and transactions, regardless of the source of funding (e.g., federal, state, commercial, or internal Rice funds) or whether the project is unfunded. The following section outlines university transactions subject to specific export control regulations.

A. ITAR-regulated transactions involving the export, temporary import, or brokering of defense articles and defense services as defined on the USML. These include, but are not limited to, the following:

Shipment or export of a defense article or technical data outside of the U.S.
Shipment, release, or transferring technology of a defense article to a foreign person in the U.S.
Transferring registration, control, or ownership of an aircraft, vessel, or satellite subject to ITAR.
Performing a defense service on behalf of, or for the benefit of, a foreign person.
Temporary import of a defense article subject to the USML

B. EAR-regulated transactions involving dual-use items (e.g., certain electronics, computers, lasers, and chemicals) that are listed on the CCL and assigned an Export Control Classification Number (ECCN). These include, but are not limited to, the following:

Shipment, release, or transferring technology of commodities, software, or technology listed on the CCL outside of the U.S.
Shipment or transferring technology of commodities, software, or technology listed on CCL to a foreign person in the U.S.
Transactions that violate the general prohibitions of the EAR.

C. OFAC-regulated transactions involve any transaction that consists of an entity, individual, or country targeted by U.S. economic and trade sanctions.

OFAC broadly regulates transactions that involve academic collaborations, payments, and online education with sanctioned countries, entities, or individuals.
Most transactions involving people or entities from sanctioned countries require an OFAC license.

It is essential to note that ITAR restrictions apply even to open laboratory fundamental research projects, where no citizenship or publication restrictions have been imposed. Therefore, determining whether an item is ITAR-controlled prior to incorporating it into a research inventory or utilizing it by an investigator or research team is essential. The fact that the item can be purchased commercially does not exempt it from its ITAR-controlled status. Buyers, licensees, and other recipients of ITAR items remain responsible for managing the applicable Foreign Person restrictions.

Beyond ITAR, EAR, and OFAC, several other U.S. government agencies regulate specific exports, including but not limited to the Nuclear Regulatory Commission, the Department of Energy, the Department of Health and Human Services, the Department of Agriculture, and the Drug Enforcement Administration.

V. Reporting

Any individual who becomes aware of a potential violation of U.S. export control laws or this policy must promptly report the matter to RSEC, OGC, or the Office of Ethics, Compliance and Enterprise Risk. Alternatively, an individual can report a potential violation or concern of noncompliance U.S. export control laws or this policy through the university’s EthicsPoint Reporting Line available online at www.rice.edu/ethics or by phone at 1-866-294-4633 (toll-free). The university prohibits retaliation against any individual who reports a potential violation in good faith.