Combining ISO9001 and ITAR (International Traffic in Arms Regulations)

[Jeff Frost]

It is important to understand the meeting ITAR requirement is not dependent on a customer informing the organization that the product ordered it subject to ITAR requirements. This notification normally only applies to product built to customer drawings. Any product a company may supply is subject control if it has been classified on Munitions Control List (ITAR). The company’s product may also be subject to “duel use” restrictions under Export Administration Regulations (EAR.).

I would also like to point out that many people believe that the export of Technology occurs when the product is shipped out of the country. In reality, under Export Control laws, the export of the controlled Technology could occur via

• Website,
• Internet downloads,
• Memo,
• Face-to-face,
• Staff meeting,
• Verbally to Non-U.S. Employees,
• Teleconferences,
• Copies to Foreign Persons, emails,
• Letters, documents,
• U.S. Mail,
• Presentations,
• Industry meetings,
• Conferences,
• Visitors, potential customers,
• Data on computers,
• Networks and hard drives, or
• Fax, phone conversations.

 

[quality1]

What if say the headquarter of a company is in Canada and manufacturing is in the US where the computer server is centralized in Canada and used to store all technical data including, emails, contracts, drawings & processes? Is there an exemption for those information stored in Canada or do you need a separate IT system under ITAR?

Thanks

 

[Icy Mountain]

What if say the headquarter of a company is in Canada and manufacturing is in the US where the computer server is centralized in Canada and used to store all technical data including, emails, contracts, drawings & processes? Is there an exemption for those information stored in Canada or do you need a separate IT system under ITAR?

It is important to understand the meeting ITAR requirement is not dependent on a customer informing the organization that the product ordered it subject to ITAR requirements. This notification normally only applies to product built to customer drawings. Any product a company may supply is subject control if it has been classified on Munitions Control List (ITAR).

I would also like to point out that many people believe that the export of Technology occurs when the product is shipped out of the country. In reality, under Export Control laws, the export of the controlled Technology could occur via

? Website,
? Internet downloads,
? Memo,
? Face-to-face,
? Staff meeting,
? Verbally to Non-U.S. Employees,
? Teleconferences,
? Copies to Foreign Persons, emails,
? Letters, documents,
? U.S. Mail,
? Presentations,
? Industry meetings,
? Conferences,
? Visitors, potential customers,
? Data on computers,
? Networks and hard drives, or
? Fax, phone conversations.

Ideally, you would need to keep the information secure inside U.S. Borders where only "U.S. Persons" have access. If this is not feasible, then you need an export license for the information that is residing on the servers in Canada. See Jeff Frost's post above, the minute that information regarding a product on the USML is available to non-U.S persons, you need approval from the DDTC. In theory, the information could be on your server, but if your Canadian employees have access to that server, you need approval from the DDTC.

The best part is, you U.S. employees then become responsible for the actions of the Canadian employees. The Canadians are not subject to U.S. law; therefore, should they send ITAR controlled information to someone, contrary to U.S. law, you are on the hook for giving it to them.