Under the ITAR, technical data is information required for the design, development, production, manufacture, assembly, operation, repair, testing, maintenance or modification of defense articles (22 CFR 120.33). The ITAR controls this information much like the defense article itself. It can be exported by email, through a shared drive or in a conversation in a meeting room, and each of those can need a State Department authorisation.
What counts as ITAR technical data?
The definition in 22 CFR 120.33 covers information required for the activities above, in forms such as blueprints, drawings, photographs, plans, instructions and documentation. It also covers classified information relating to defense articles, information covered by an invention secrecy order, and certain software directly related to defense articles.
Whether information is ITAR technical data or EAR technology follows the jurisdiction of the item it relates to. Know-how for a USML item is ITAR technical data. Know-how for a CCL item is EAR technology, in product group E. The jurisdiction rules are in ITAR vs. EAR, and worked ITAR or EAR examples include maintenance manuals for both kinds of item.
What is not technical data
- Public domain information, meaning information that is published and generally accessible to the public (22 CFR 120.34), for example through libraries, publications or open conferences.
- General scientific, mathematical or engineering principles commonly taught in schools, colleges and universities.
- Basic marketing information on function or purpose, or general system descriptions.
Putting information on the internet to make it "public domain" is no shortcut. Releasing technical data to the public without authorisation can itself be a violation.
How technical data is exported
The main routes are:
- sending or taking it out of the United States, by email, file transfer or a laptop on a trip;
- releasing it to a foreign person in the United States, by visual inspection, oral exchange or system access;
- furnishing a defense service, which is technical assistance to foreign persons using it.
In everyday engineering these exports happen through ordinary work. An engineer shares a drawing with a foreign colleague or supplier by email or chat. A product lifecycle or file system has access permissions broad enough to include foreign persons. Results containing technical data are presented at a conference or in a paper without authorisation or a public-domain basis. Drawings go abroad with a supplier request for quote. A laptop with project data goes to a meeting abroad. Each of these can be an unauthorised export, and most violations involving technical data are routine engineering practices applied without export awareness.
The EAR has a parallel concept for dual-use technology, covered in deemed exports and foreign nationals.
Authorisations for technical data
- DSP-5 licences cover permanent exports of unclassified technical data.
- Technical Assistance Agreements (TAAs) and manufacturing licence agreements cover defense services and ongoing data exchange.
- Exemptions in Part 125 and elsewhere cover specific situations, each with conditions.
A licence application can only be made once the company has registered with DDTC under the ITAR.
How to control technical data in practice
- Identify and mark ITAR technical data at creation.
- Restrict access by nationality and need, both physical and IT.
- Control storage. Know where servers are and who administers them. The ITAR allows certain end-to-end encrypted storage and transmission under specific conditions.
- Control travel with laptops and phones carrying data abroad.
- Screen visitors and control what they see.
- Train engineers, who create and share most technical data.
- Record authorisations and releases.
Checklist before releasing information
- Is this information technical data for a defense article? If you are unsure which USML category the article falls in, check the 21 USML categories.
- Is it already in the public domain, and how do you know?
- Who will receive it, and what is their nationality or residency status?
- Is there an authorisation (licence, TAA or exemption) that covers this release?
- Is the release recorded?
Technical data and ECCN.help
ECCN.help classifies EAR technology (product group E) as well as hardware and software, and its scope check flags items described on the USML before any EAR answer. Do not upload technical data to ECCN.help. Ordinary descriptions and published specifications are enough, and the service is hosted in the United States.
ECCN.help provides research and assistance, not legal advice. Verify every result against the regulation.