ITAR Compliance: Understanding the Regulation’s Requirements

What Is ITAR Compliance?

International Traffic in Arms Regulations, or shortly ITAR, is the U.S. regulation that controls (re)export, import, brokering military equipment, and distribution of defense- and space-related goods and services, and technical data associated with them.

Who Needs the ITAR Compliance?

The next organizations fall under ITAR:

• Manufacturers and distributors of defense products.
• Companies that act directly in the defense industry.
• Providers of defense services.
• Brokers.
• Contractors.
• Vendors who produce defense software and hardware.

By its design, ITAR designates a set of critical requirements (including those relating to sensitive technical data) organizations must follow to be ITAR compliant.

ITAR Compliance Requirements

ITAR compliance requirements are called on to ensure that defense items won’t turn out in the open, i.e., become a third-party property, and sensitive technical data won’t be compromised.

For example, an organization located in the U.S., that operates with overseas contractors, mustn’t share sensitive ITAR technical data with its employees. To export items, you may need documented proof of a license or agreement from the appropriate governmental authority.

Also, organizations must have a documented ITAR compliance program. It should include monitoring and auditing of technical data.

Another requirement states that only U.S. Citizens or Residents with 3 years of residency can access goods, services, technology, and technical data.

Similarly, organizations that have a deal with manufacturing, designing, or selling items, specified in The United States Munitions List (USML), must be ITAR compliant.

U.S. Munitions List

The USML is a list of defense- and space-related items. The USML consists of twenty-one categories, controlled and regulated by the U.S. federal government.

The items that are subject to the jurisdiction of the ITAR are identified on the USML. The items that are not subject to the export control jurisdiction of the ITAR are subject to the Export Administration Regulations (EAR) jurisdiction.

That is to say, organizations engaged in exporting/importing products of defense must register with the State Department’s Directorate of Defense Trade Controls (DDTC).

The DDTC sets forth certain conditions, which companies must meet. Additionally, organizations must establish and apply their policies with DDTC in order to be compliant with ITAR requirements.

The ITAR Compliance Checklist

Organizations engaged in the defense industry must know what is required of them to be ITAR compliant. 

Here’s a checklist:

• Determine which government agency has jurisdiction over your products.
• Classify items that are considered defense products and services, specified in the USML list.
• If your products are on the list, apply for an Export License through the State Department.
• Register with the Directorate of Defense Trade Control.
• Provide records of all your ITAR entries and activities.
• Provide background screening for involved employees and party for each new export.
• Develop an Export Compliance Program.

Non-compliance comes with a price. Because great money loss can run to reputation damage, and that can lead to business loss, eventually.

ITAR Penalties for Non-Compliance

You not only have to comply with ITAR regulations, but also to control if they are not violated. 

Non-fulfillment of ITAR may result in severe penalties that include, but not limited to:

• civil fines - up $500,000 per violation;
• criminal fines of: 

• up to $1 million;
• 10 years imprisonment per violation.

Besides, restrictions may apply to your business practice; your import/export activities could be banned.

Therefore, it is of vital importance to understand how to secure your ITAR-controlled data. 

ITAR Technical Data: What You Need to Know 

ITAR is designed to regulate sensitive military information, too.

Any file, digital document, or any other data that contains sensitive information related to defense goods or service and is shared via electronic ways of communication (e.g., email) falls under ITAR.

That’s why adherence to ITAR requirements can be somewhat challenging for some organizations.

ITAR technical data is technical documentation that could be the:

• blueprints,
• figures,
• drafts,
• flowcharts,
• sheets,
• records,
• any other defense-related documentation.

ITAR also requires organizations to implement their security policy. This policy should include network security, including ways of how data is kept, transferred, and used.

ITAR Compliance Policy

It is essential to design a privacy policy that will help to exclude the human error to avoid data leak caused by employee mistakes (for example, working with data at home, transferring data using insecure communication channels, etc.).

Processing of technical information could also raise risks of unintentional infringement. Each organization engaged in transferring sensitive data has to be ITAR compliant. 

If, for instance, you transferred technical data to an organization, and that organization redirected it to another one outside of the U.S., then it is you who is among those who violated ITAR.

As an example, FLIR Systems, Inc will pay a $30 million of a civil penalty for “unauthorized export of technical data and defense services to dual national employees.”

For these reasons, you may want to use some preventive measures to be ITAR compliant.

ITAR Compliant File Sharing: Suggestions for Data Protection

To ensure you are compliant with the ITAR regulations, you need to find a solution to protect your sensitive technical data. 

For these purposes, you can use email encryption algorithms that aimed to protect your sensitive data in transit, at rest, and in use. 

When data is at rest, encryption ensures that the information is secure while stored on a server or user device. When data is in transit, encryption helps to secure information that is being transferred via vulnerable EXIM servers. Finally, when data is in use, encryption ensures information is not available for users who haven’t appropriate access to read it, i.e., have not been authorized.

In terms of technical data, being ITAR compliant means being able to provide control over your sensitive information.

How to be ITAR Compliant with StealthMail

StealthMail is an enterprise-grade software email security solution. The solution secures your confidential data and ensures the privacy of your business correspondence via email.

StealthMail ensures the security of your classified technical information about the defense goods and services and protects your employees from accidental mistakes by verifying each sender.

In StealthMail, email communication happens between AUTHORIZED users ONLY. This means no one could see your message without prior authentication.

Furthermore, if sent accidentally to a not-intended recipient, a sender can always revoke such a message. When users recall an email, they withdraw access rights on reading message content and its attachments.

The advantages of StealthMail:

• Stealth Authentication for a secure connection and enhanced security.
• Stealth Link mechanism that keeps data in a company’s secure perimeter.
• Encryption and signing of sensitive data.
• Individual encryption of email content and its attachments.
• Encryption keys are stored in a company’s secure perimeter.
• Advanced asynchronous algorithms for key generation.

To learn more about how StealthMail can ensure sensitive ITAR technical data protection to meet ITAR compliance, please download the Technical Datasheet, or Try Free Trial of the StealthMail email security solution, or visit StealthMail.com.