Activities that are not exports

← All Insights

1. Activities outside the definitions

The Export Administration Regulations (EAR) list activities that are not exports, reexports or transfers (15 CFR 734.18(a)). The first is launching a spacecraft, launch vehicle, payload or other item into space (15 CFR 734.18(a)(1)). The second is transmitting or otherwise transferring technology or software from one person in the United States to another person in the United States who is not a foreign person (15 CFR 734.18(a)(2)).

The third covers a transfer within the same foreign country of technology or software among only persons who are not foreign persons (15 CFR 734.18(a)(3)). It applies so long as the transfer does not result in a release to a foreign person or to a person barred from receiving the material.

The fourth is shipping, moving or transferring items between or among the United States, the District of Columbia, the Commonwealth of Puerto Rico and the Commonwealth of the Northern Mariana Islands (15 CFR 734.18(a)(4)). It also covers any U.S. territory, dependency or possession listed in Schedule C of the Census Bureau’s classification codes for U.S. export statistics.

2. Sending and storing encrypted data

The fifth activity is sending, taking or storing technology or software that meets four conditions (15 CFR 734.18(a)(5)). It must be unclassified (15 CFR 734.18(a)(5)(i)). It must be secured using encryption that keeps the data encrypted from originator to intended recipient (15 CFR 734.18(a)(5)(ii)). The rule defines that as cryptographic protection under which the data is never unencrypted between the originator and the intended recipient, or their in-country security boundaries (15 CFR 734.18(b)). The means of decryption must not be given to any third party, and the originator and recipient may be the same person.

The data must also be secured using cryptographic modules compliant with Federal Information Processing Standards Publication 140-2 (FIPS 140-2) or its successors (15 CFR 734.18(a)(5)(iii)). Those modules must be supplemented by software implementation, key management and other procedures in line with current National Institute for Standards and Technology guidance. Other equally or more effective cryptographic means also qualify. Finally, the data must not be intentionally stored in a Country Group D:5 country (15 CFR 734.18(a)(5)(iv)). Data in transit over the internet is not treated as stored.

The ability to access technology or software in encrypted form that meets those criteria is not a release or export (15 CFR 734.18(c)).

3. Access information

Where an authorization would be needed to transfer technology or software, a comparable authorization is needed to transfer access information (15 CFR 734.19(a)). That applies if the transfer is made with knowledge that it would release the technology or software without a required authorization. Access information is information that allows access to encrypted technology or software in unencrypted form, such as decryption keys, network access codes and passwords (15 CFR 772.1).

4. Software license keys

Software keys that let users use software or hardware, or that renew existing use licenses, are classified under the same Export Control Classification Numbers (ECCNs) as the software or hardware to which they provide access (15 CFR 734.19(b)). If the software or hardware needs authorization, the same level of authorization is required for the key. An authorization obtained for the software or hardware also covers the corresponding key.

If no authorization was needed at first but a license requirement is later imposed, later exports, reexports or in-country transfers of the software, hardware and key are subject to the new requirement (15 CFR 734.19(b)). The key rule does not apply to keys that activate dormant functionality in an item, though changes to features may affect classification.

5. Releases abroad that are not deemed reexports

Some releases of technology or source code abroad are not deemed reexports (15 CFR 734.20). The first case is a release by an entity outside the United States to a foreign person of a third country, where two conditions are met (15 CFR 734.20(a)). The entity must be authorized to receive the technology or source code, by a license, a license exception or because no license is required (15 CFR 734.20(a)(1)). It must also know that the person’s most recent country of citizenship or permanent residency is one to which a U.S. export would be authorized without a license or under a license exception (15 CFR 734.20(a)(2)).

6. Employees from Country Group A:5

A second case covers releases to bona fide permanent and regular employees of an authorized entity outside the United States (15 CFR 734.20(b)). The employee must not be a proscribed person and must be a national exclusively of a Country Group A:5 country (15 CFR 734.20(b)(2), 15 CFR 734.20(b)(3)). The release must take place entirely within the territory of such a country, or within the United States (15 CFR 734.20(b)(4)).

7. Other employees

A third case covers bona fide permanent and regular employees of other nationalities who are not proscribed persons (15 CFR 734.20(c)). The release must take place entirely within the country where the entity is located, does official business or operates, or within the United States (15 CFR 734.20(c)(3)). The entity must have effective procedures to prevent diversion contrary to the EAR (15 CFR 734.20(c)(4)). One of six situations must also apply (15 CFR 734.20(c)(5)).

The employee may hold a security clearance approved by the host nation government (15 CFR 734.20(c)(5)(i)). Alternatively, the entity may screen the employee, obtain a non-disclosure agreement and screen for substantive contacts with Country Group D:5 countries (15 CFR 734.20(c)(5)(ii)). In that case it keeps a technology security or clearance plan, keeps screening records for five years or the length of employment, whichever is longer, and makes them available to the Bureau of Industry and Security (BIS) on request. An employee with substantive contacts with D:5 nationals is presumed to raise a diversion risk unless BIS decides otherwise.

The other four situations cover U.K. and Canadian entities implementing section 126.18 of the International Traffic in Arms Regulations (ITAR) under the relevant exchanges, where those countries have provided appropriate implementation guidance (15 CFR 734.20(c)(5)(iii), 15 CFR 734.20(c)(5)(iv)). They also cover Australian and Dutch entities implementing exemptions in paragraphs 3.7b and 3.7c of the ITAR Agreements Guidelines (15 CFR 734.20(c)(5)(v), 15 CFR 734.20(c)(5)(vi)).

8. Substantive contacts and permanent employees

Substantive contacts include regular travel to Country Group D:5 countries, recent or continuing contact with their agents, brokers and nationals, and continued demonstrated allegiance to them (15 CFR 734.20(d)(1)). They also include business relationships with persons from those countries, a residence there, salary or other continuing compensation from those countries, or other acts indicating a risk of diversion.

A permanent and regular employee is employed for not less than a year (15 CFR 734.20(d)(2)). A contract employee also qualifies if in a long-term relationship, working at the entity’s facilities or assigned locations, under its direction and control, full time and exclusively for it, under a nondisclosure certification. The defined acts themselves are covered in exports, reexports, releases and transfers.

Key terms

FIPS 140-2	The federal standard for cryptographic modules named in the rule.
Software key	A license key controlled under the same ECCN as the item it gives access to.
Permanent and regular employee	A worker employed for a year or more, or a qualifying contract employee.
Substantive contacts	Ties to Country Group D:5 countries that indicate a diversion risk.
Proscribed person	A person barred from receiving the items or taking part in the transaction without authorization, as defined in part 772.

Every statement above links to the document behind it. The full source list for this piece is on the sources page.

This page describes public United States government programs for general information. It is not legal, regulatory or procurement advice, and it does not address the facts of any particular case.

How Sentfore supports this

Data handling rules matter to every deployed team. Sentfore works at the delivery end of defense programs in difficult environments, providing secure movement, protective security, facilities and life support. Requirements can be sent through the contact page.