What counts as an export under the ITAR

← All Insights

1. Six ways to export

The International Traffic in Arms Regulations (ITAR) define export broadly, subject to the carve-outs in section 120.54 and the treaty sections 126.16 and 126.17 (22 CFR 120.50(a)). The first is an actual shipment or transmission out of the United States, in any manner (22 CFR 120.50(a)(1)). The second is releasing or transferring technical data to a foreign person inside the United States, which the regulation calls a deemed export (22 CFR 120.50(a)(2)).

Transferring registration, control or ownership of a controlled aircraft, vessel or satellite from an American person to a foreign person is an export (22 CFR 120.50(a)(3)). So is releasing or transferring a defense article to an embassy, or to one of its agencies or subdivisions such as a consulate, in the United States (22 CFR 120.50(a)(4)). Performing a defense service on behalf of, or for the benefit of, a foreign person is an export, in the United States or abroad (22 CFR 120.50(a)(5)). The last is the release of previously encrypted technical data in the two ways described in section 120.56(a)(3) and (a)(4) (22 CFR 120.50(a)(6)).

2. Every nationality counts

A release of technical data to a foreign person in the United States is an export to each country of that person’s past or present citizenship, or present permanent residency (22 CFR 120.50(b)). The categories of person are set out in dual national and third-country national employees.

3. Reexports

A reexport has three meanings, subject to the same carve-outs (22 CFR 120.51(a)). It is an actual shipment or transmission of a defense article from one foreign country to another (22 CFR 120.51(a)(1)). It is also a release of technical data to a foreign person who is a citizen or permanent resident of a country other than the one where the release takes place, called a deemed reexport (22 CFR 120.51(a)(2)). The third is a transfer of registration, control or ownership of a controlled aircraft, vessel or satellite between foreign persons (22 CFR 120.51(a)(3)). Any release of technical data abroad to a foreign person counts as a reexport to all of that person’s countries of citizenship or permanent residency (22 CFR 120.51(b)).

4. Retransfers

A retransfer happens inside one foreign country (22 CFR 120.52(a)). It is a change in end use or end user, or a temporary transfer to a third party, of a defense article within the same country (22 CFR 120.52(a)(1)). It is also a release of technical data to a foreign person who is a citizen or permanent resident of the country where the release happens (22 CFR 120.52(a)(2)). Approval rules for both are covered in reexports, retransfers and end use assurances.

5. Temporary imports

A temporary import means bringing a defense article into the United States from a foreign country, either to be returned to the country it came from or in transit to another foreign destination (22 CFR 120.53(a)). Withdrawing a defense article from a customs bonded warehouse or foreign trade zone to return it, or to ship it to another foreign destination, is also a temporary import (22 CFR 120.53(b)). Permanent imports are regulated by the Attorney General through the Bureau of Alcohol, Tobacco, Firearms and Explosives (22 CFR 120.53(c)).

6. How technical data is released

Technical data is released in four ways (22 CFR 120.56(a)). The first is visual or other inspection of a defense article by foreign persons that reveals technical data to them (22 CFR 120.56(a)(1)). The second is oral or written exchanges with foreign persons, in the United States or abroad (22 CFR 120.56(a)(2)). The third is using access information to let a foreign person access, view or possess unencrypted technical data (22 CFR 120.56(a)(3)). The fourth is using access information to put technical data outside the United States into unencrypted form (22 CFR 120.56(a)(4)).

Access information means information that allows access to encrypted technical data in unencrypted form, such as decryption keys, network access codes and passwords (22 CFR 120.55). Giving such information to a foreign person needs the same authorization as releasing the technical data itself, if it can enable access to the unencrypted data (22 CFR 120.56(b)). How technical data is defined is covered in technical data and data packages.

7. What is not an export

Seven activities are not exports, reexports, retransfers or temporary imports (22 CFR 120.54(a)). Launching a spacecraft, launch vehicle, payload or other item into space is one (22 CFR 120.54(a)(1)). Sending technical data to an American person in the United States from a person in the United States is another (22 CFR 120.54(a)(2)). Transfers of technical data between only American persons in the same foreign country also qualify, if nothing reaches a foreign person or a prohibited person (22 CFR 120.54(a)(3)). So does moving defense articles within the United States, which includes Puerto Rico and American territories and possessions (22 CFR 120.54(a)(4) and 22 CFR 120.60).

Encrypted data gets its own carve-out (22 CFR 120.54(a)(5)). Sending, taking or storing technical data is not an export if the data is unclassified and secured with encryption from end to end. The encryption must meet the federal FIPS 140-2 standard or its successors, with key management and other controls that follow current National Institute of Standards and Technology guidance. Other cryptography qualifies if its security strength is at least comparable to 128-bit Advanced Encryption Standard. The data must not be sent intentionally to a person in, or stored in, a country listed in section 126.1, or sent from one. Data passing through a country over the internet is not treated as stored there. Encryption from end to end means the data stays encrypted between the originator and the intended recipient, or their in-country security boundaries (22 CFR 120.54(b)(1)). No third party may receive the means to decrypt it (22 CFR 120.54(b)(1)). Being able to reach such encrypted data is not a release or export (22 CFR 120.54(c)).

A foreign force may take an authorized article on a deployment or training exercise outside its approved country, without any change in end use or end user. Its own forces or United Nations military personnel must carry and keep the article (22 CFR 120.54(a)(6)). A foreign article that was imported and then exported under a license may move on (22 CFR 120.54(a)(7)). It must not have been altered or improved in a way that changed its basic performance, and no American-origin defense article was built into it (22 CFR 120.54(a)(7)). In both cases, the article may not be leaving or temporarily entering the United States.

8. Two carve-outs from 13 October 2026

An interim final rule published on 28 August 2026 takes effect on 13 October 2026 (91 FR 55457). It adds two activities to the list (91 FR 55460). One is temporarily bringing secured aircraft survivability equipment into the United States, if neither it nor its aircraft goes to another foreign person there without approval. The other is taking secured equipment, first exported under a license, from one foreign country to another while it is installed in a survivability-enhanced aircraft.

Key terms

Deemed export	A release of technical data to a foreign person inside the United States.
Reexport	A movement or release of a defense article from one foreign country to another.
Retransfer	A change of end use or end user within the same foreign country.
Access information	Keys, codes or passwords that open encrypted technical data.
Encryption from end to end	Protection that keeps data encrypted from sender to intended recipient.

Every statement above links to the document behind it. The full source list for this piece is on the sources page.

This page describes public United States government programs for general information. It is not legal, regulatory or procurement advice, and it does not address the facts of any particular case.

How Sentfore supports this

Controlled equipment moving with forces and contractors abroad has to stay inside these lines. Sentfore works at the delivery end of defense programs in difficult environments, providing secure movement, protective security, facilities and life support. Requirements can be sent through the contact page.