Export Controls

U.S. export control regulations restrict the sending of commodities, software, and technical information outside the U.S. as well as the sharing of certain technical information to foreign nationals within the U.S.

The U.S. Department of State and the U.S. Department of Commerce each administers different export control regulations. The restrictions vary depending on what is being exported, where it is going, who is receiving it, and the purpose for which it is being used.  In addition, the U.S. Department of Treasury’s Office of Foreign Assets Control ("OFAC") imposes additional restrictions against countries, entities and individuals who are subject to U.S. economic sanctions.

Update: Covid-19 & Export Controls

Update: Covid-19 & Export Controls

Columbia’s Office of Research Compliance & Training is monitoring the Covid-19 situation as it pertains to Export Controls and will continue to inform the Columbia University community as additional information becomes available. Please visit the Covid-19 & Export Controls web page for information. 

Commerce and State Export Regulations (EAR and ITAR)

Under both the Commerce Department's EAR and the State Department's ITAR, if research involves controlled technology or equipment, Columbia University may be required to obtain prior U.S. government approval (known as a license) before allowing foreign nationals to participate in the research, partnering with a foreign entity, or sharing (including by publication or presentation at conferences) the technology in any manner with foreign nationals. ("Foreign Nationals" is defined as persons who are not U.S. citizens or legal permanent residents or legally-recognized asylees and refugees). As discussed in greater detail below, many University activities in the U.S. qualify for an "exemption" from or "exceptions" to export control regulations. Often this is because the information involved is publicly available or in the public domain, is considered "fundamental research" (as defined below), or is taught as part of a listed catalogue course at the institution. If an exception applies, no license is required.

 

"Input" versus "Output" Technology; Classification 

One important question is whether the technology at issue is the "output" of Columbia research, or whether it is "input technology" that we receive from a third party. Examples of "input technology" include instrumentation or software we purchase; or unpublished technical specifications about an instrument used for research, including operating manuals, blueprints, drawings, photographs, plans, instructions or documentation; and materials licensed in or borrowed from a collaborator. The distinction between "input" and "output" technology matters because certain exceptions to export control regulations typically only apply to the output of University research, and do not apply to "input technology." Determining whether an instrument or technology is subject to export controls can involve a nuanced analysis. It may require obtaining information from the vendor that makes the instrument or technology. It may also require a technical comparison of the specifications for the instrument at issue against the descriptions of controlled technology in the Commerce and State Department lists. Finally, the University has licensed a web-based tool called "Visual Compliance" that can facilitate classification.

 

Deemed Exports

Sharing export controlled information with a foreign national inside the U.S. is known as "deemed export." A deemed export occurs when technology or technical information regulated under the federal export control regulations is "exported," not by shipping it overseas but by "transferring" it to a foreign national in the United States. If you receive export controlled information or technology from any external party, a license may be required from the federal government before the information or technology may be shared with a foreign national (as defined above). For this reason, if you receive any information that is marked or determined to be subject to export controls, you should not disclose it to any foreign national, including international students, without guidance from the Research Compliance Export Control Officer or the Office of the General Counsel.

 

Fundamental Research

The data and information generated through many University research activities may be exempted from export controls because of a general exception for "Fundamental Research." Fundamental Research is defined as "basic and applied research in science and engineering, the results of which ordinarily are published and shared broadly within the scientific community, as distinguished from proprietary research and from industrial development, design, production, and product utilization, the results of which ordinarily are restricted for proprietary or national security reasons." In accordance with University Statutes, research at Columbia is performed without accepting publication restrictions and its results are ordinarily published (University Statute XLIII, Externally Funded Research and Instruction). As a result, most research conducted in the U.S. at Columbia meets the definition Fundamental Research, and the results of our research are typically excluded from the export regulations. Importantly, there are some limitations to the Fundamental Research exception. For example, the exception would not apply to research conducted under an agreement that restricts either publication or foreign national participation in the project. In addition, "input technology" that is subject to export controls can never be Fundamental Research. The exemption refers to "data and information" and not to tangible items that may be produced. Finally, in general, the Fundamental Research exception does not apply to research conducted outside the United States.

 

EAR’s Military End Use/ Military End User (MEU) Rule: China, Russia, Venezuela and Myanmar (Burma).

The U.S. Commerce Department recently issued a final rule that significantly expands license requirements for exports of items, software, or technical information (“technology”) to “military end users” or for “military end uses” in China (including Hong Kong), Russia, Venezuela or Myanmar (Burma)Importantly, the MEU Rule’s license requirements may apply even if an export is intended for a non-military end use.

Under the MEU Rule, the definition of “military end user” is expanded to include any person or entity whose actions or functions are intended to support “military end uses”, i.e. individuals or entities that develop, produce, maintain, or use military items. The definition of “military end use” is also expanded to include any item that contributes to the operation, installation, maintenance, repair, overhaul, refurbishing, development, or production of military items.  A complete list of items subject to the MEU Rule is available in EAR Section 744 Supplement 2. The Commerce Department recently posted MEU Rule FAQs, available here.

Research Compliance & Training works closely with SPA, CTV, CTO, ISSO and others across the University to identify and resolve potential export control risks under the MEU Rule. 

Please reach out to Research Compliance & Training if you have questions or concerns about the MEU Rule, how it might impact your research or lab, or if you plan to export items to China, Russia, Venezuela or Myanmar (Burma).

 

Physical Exports of Controlled Equipment

Export controls also limit the ability to transport controlled equipment abroad, without obtaining U.S. federal government licenses. U.S. export laws are triggered even if a controlled item leaves the U.S. temporarily and even if the item is being transferred to a wholly-owned subsidiary of Columbia University in an overseas country. In addition, U.S. export laws are triggered when an item controlled under U.S. laws is sent from one foreign country to another. This is called a "re-export." Even where the export of an item to the host country does not require a license, the re-export of the item to another country could trigger the need for another round of review. In addition, host country export control regulations may also apply to technology being used outside the United States.

 

Electronic Export Filing Requirements for Tangible Exports

When shipping or taking items outside the U.S., electronic export information (“EEI”) may need to be filed with U.S. Customs and Border Protection.  EEI is submitted through the U.S. Census Bureau’s Automated Export System (AES) prior to export.  EEI filing requirements apply to items shipped or hand-carried abroad.

EEI filings are required when -

  • The value of the export exceeds $2500,
  • An export license is required, regardless of value, or
  • An export license exemption is used, regardless of value.

Various EEI filing exemptions exist (e.g., temporary exports, exports to Canada) and may apply in specific situations.

Please contact Research Compliance & Training for more information about EEI filing exemptions or how to file EEI through AES.

 

EEI Filing Requirements for China, Russia or Venezuela

On September 29, 2020, additional EEI filing requirements went into effect for exports to China (including Hong Kong), Russia or Venezuela.  Under a new Commerce Department rule, EEI must be filed for all items listed on the Commerce Control List (“CCL”) regardless of value

EEI filing exemptions (e.g., temporary exports) are no longer available for exports to China, Russia or Venezuela.

Please contact Research Compliance & Training prior to exporting to China, Russia or Venezuela.  RCT will assist you in determining whether an EEI filing is required and how to submit through AES.

 

Laptops, Mobile Phones, and Other Personal Electronic Devices 

Columbia researchers who travel outside the United States, whether to a conference, a Columbia Global Center, for field work, or to collaborate with another institution, must be aware that their laptops, mobile phones, and other electronic devices are subject to U.S. export controls. However, with the exception of travel to designated sanctioned countries, depending on the country of travel (see section on Economic Sanctions), individuals traveling outside the United States with personal electronic devices will generally not require a license, so long as the devices are: Routinely available from commercial vendors; Kept in the traveler's immediate control while outside the U.S.; and Brought back to the U.S. within one year of the initial departure. On the other hand, licenses are likely to be required for a device that holds encryption software or contains software, materials, or information that are themselves controlled under U.S. export controls. For more information on protecting your devices and data while traveling internationally please review CUIT's data security guidelines for international travel.

 

Controlled Unclassified Information (CUI)

Controlled Unclassified Information (CUI) is information that the U.S. Government creates or possesses (or that an entity creates or possesses on behalf of the U.S. Government) that requires safeguarding or dissemination controls. The National Archives & Records Administration (NARA) administers the U.S. Government’s CUI Program. Examples of CUI include export-controlled information, controlled technical (CTI), health information, inventions among others. A complete list of CUI categories is posted on NARA’s CUI Registry.

The US Government has set minimum safeguarding standards to protect CUI. NIST 800-171 refers to National Institute of Standards and Technology Special Publication 800-171, which governs CUI.  More information about safeguarding CUI and the NIST 800-171 standard is available on NARA’s CUI website.

In certain circumstances, Columbia researchers may be asked to receive CUI from outside parties for use on a research project.  Alternatively, outside parties may ask Columbia researchers to provide CUI or NIST 800-171 management plans.  Please contact Research Compliance and Training (RCT) immediately if -

  • You are asked to receive CUI;
  • You receive information marked as CUI; or
  • You are asked questions about safeguarding CUI or the NIST 800-171 standard.

RCT, SPA and other administrative units within Columbia will work with you to determine how to move forward.  Be aware that failure to comply with CUI requirements can result in severe penalties. 

More information about data security and data management is available on RCT’s ReaDI Program website. 

 

“Emerging Technology” Export Controls

In recent months, the Commerce Department has imposed new export control restrictions on certain “emerging technologies” in a variety of areas.  These include–

  • Software to operate nucleic acid assemblers and synthesizers for the purpose of generating pathogens and toxins without the need to acquire controlled genetic elements and organisms (ECCNs 2D352.j, 2E001) (Proposed Rule, 11/6/20)
  • Hybrid additive manufacturing (AM)/computer numerically controlled (CNC) tools (Export Control Classification Number “ECCN” 2B001) (Final Rule, 10/5/20)
  • Computational lithography software designed for the fabrication of extreme ultraviolet (EUV) masks (ECCN 3D003) (Final Rule, 10/5/20)
  • Technology for finishing wafers for 5nm production (ECCN 3E004) (Final Rule, 10/5/20)
  • Digital forensics tools that circumvent authentication or authorization controls on a computer (or communications device) and extract raw data (ECCNs 5A004.b, 5D002, 5E002) (Final Rule, 10/5/20)
  • Software for monitoring and analysis of communications and metadata acquired from a telecommunications service provider via a handover interface (ECCNs 5D001.e; 5E001.a) (Final Rule, 10/5/20)
  • Sub-orbital craft (ECCNs 9A004.h, 9A515.a) (Final Rule, 10/5/20)
  • Chemical Weapons Precursors: 24 precursor chemicals and mixtures containing 30 percent or more of one of these chemicals (ECCNs 1C350.d, 1D390, 1E351, 1E350, 1E001) (Final Rule, 6/17/20)
  • Human and Animal Pathogen and Toxins: Middle East respiratory syndrome-related coronavirus (MERS-related coronavirus) (ECCNs 1C351.a, 1E001, 1E351) (Final Rule, 6/17/20)
  • Equipment Capable of Use in Handling Biological Materials: single-use cultivation chambers with rigid walls (ECCNs 2B352.b, 2E001, 2E002, 2E301) (Final Rule, 6/17/20)
  • Discrete microwave transistors used in wideband semiconductors (ECCN 3A001.b) (Final Rule, 5/23/2019)
  • Software that ensures continuity of operation when electronics are exposed to an Electromagnetic Pulse (EMP) or Electrostatic Discharge (ESD) (ECCN 3D005) (Final Rule, 5/23/2019)
  • Post-quantum cryptographic algorithms (also known as quantum-safe or quantum-resistant algorithms) (ECCN 5A002) (Final Rule, 5/23/2019)
  • Underwater transducers designed to operate as hydrophones (ECCN 6A001) (Final Rule, 5/23/2019) (Final Rule, 5/23/2019)
  • Aircraft specially designed or modified to be air-launch platforms for space launch vehicles (ECCN 9A004) (Final Rule, 5/23/2019)
  • Geospatial imagery software specially designed for training deep convolutional neural networks to automate the analysis of geospatial imagery and point clouds (ECCN 0Y521) (Interim Final Rule, 01/06/20)

This list will be updated as new “emerging technology” rules are issued.

 

Responsibility

Those performing research or accessing export controlled items, technology or software at Columbia are responsible for understanding the controls applicable to their activities and the interplay with the various exceptions. This may involve reviewing the portfolio of items, technical information or software accessed or developed in research against the USML and CCL lists, understanding the role of foreign nationals and the impact of travel outside the U.S., and reviewing any applicable exceptions. Often this involves a complex nuanced analysis. While the principal investigator is responsible for compliance in this area, the University - and in particular, the Office of Research Compliance and Training and the Office of the General Counsel ­- support the research community in this challenging area, and should be freely consulted for guidance and other assistance.

 

Penalties

Penalties for violation of export laws are severe, and can involve civil and criminal penalties for both the University and individuals. Criminal violations of EAR carry potential penalties of the greater of $50,000-$1,000,000 or five times the value of the export, and up to 10 years of imprisonment; civil penalties include fines of $10,000-$120,000. Criminal violations of ITAR can entail fines of up to $1,000,000 and up to 10 years' imprisonment; civil penalties include fines of up to $500,000.

 

Where to Go for Help

Contact Research Compliance & Training -

  • If you plan to export (i.e., ship, hand-carry, or otherwise send) items abroad.  An export control and EEI review will be conducted to determine whether an export license or EEI filing is required.
  • If you plan to export items to China, Russia or Venezuela.  Additional export restrictions or EEI filing requirements apply.
  • If you need to file Electronic Export Information (EEI) in the AES system.
  • If you are asked to receive export-controlled information or CUI, or to safeguard information under the NIST 800-171 standard.
  • If you purchase items controlled under the ITAR or that have an export control classification number (ECCN) under the EAR.
  • If you have any questions or concerns about export controls and how it might impact your research or lab.

Additional information and guidance are available in Resources below.

 

Compliance Hotline

The Compliance Hotline is a confidential channel for employees to report or seek guidance on compliance issues. It is available to Columbia employees by telephone (866)-627-3768 and online at the Compliance Hotline Website with confidential report handling and the option for anonymous reporting. There is no tolerance for retaliation against those who report a compliance concern in good faith.