Effective July 21, 2008, the U.S. Department of Defense ("DOD") issued an interim rule with a request for comments that creates a contractual obligation for all DOD contractors to comply with U.S. export control laws. See 73 Federal Register 42274. While, technically, the interim rule does not impose any new requirement on U.S. businesses, because all are already required to comply with U.S. export requirements, the interim rule does impose additional risks and liabilities on defense contractors because a violation of U.S. export laws could now also result in a breach of contract. Given the fact that many companies do not fully understand the scope or intricacies of U.S. export laws, inadvertent export violations are a common occurrence. Accordingly, this new rule could easily increase contractual (and related) risks for DOD contractors.
Background on U.S. Export Laws
Generally speaking, there are three enforcement regimes under U.S. export laws:
- The Export Administration Regulations ("EAR") (15 C.F.R. Parts 730-774), administered by the U.S. Department of Commerce, Bureau of Industry and Security ("BIS") (issued under the Export Administration Act of 1979, 50 U.S.C. App. §§ 2401-2420, as continued in effect under the International Emergency Economic Powers Act, 50 U.S.C. §§ 1701-1707);
- The International Traffic in Arms Regulations ("ITAR") (22 C.F.R. Parts 120-130), administered by the U.S. Department of State, Directorate of Defense Trade Controls ("DDTC") (issued under the Arms Export Control Act, 22 U.S.C. § 2778); and
- The sanction and embargo regulations issued by the U.S. Department of the Treasury, Office of Foreign Assets Control ("OFAC") (31 C.F.R. Parts 500-598) (issued under the authority of numerous statutes, including the Trading with the Enemy Act, 50 U.S.C. App. §§ 1-44 ), governing exports to countries subject to comprehensive trade sanctions and embargoes by the United States (such as Cuba or Iran).
The EAR broadly covers all products and technologies that are created in the U.S. or by U.S. persons, as well as foreign products that move in commerce through the United States or that incorporate more than a minimal amount of U.S. parts, materials or technologies. Despite the fact that the EAR "applies" broadly to virtually every product and technology that is created or moves in U.S. commerce, the requirement for any export license is far more limited. Many products and technologies can be exported either without a license or under a broadly applicable general license. The need for a license is generally a product of multiple factors – most notably the product or technology, the destination, and whether the product is considered to have certain military, national security, anti-terrorism, or crime control uses. While the decision with respect to the need for an export license is always fact-specific, licenses are most frequently required for the export of those products or technologies that are considered "dual-use" – that is, those products and technologies that have potential military and civilian applications. Often, export of even these products or technologies to foreign persons are permitted with a license from BIS.
More narrowly focused, the ITAR covers all hardware, services, and technical data that are developed, manufactured, or modified specifically for military or space applications. This applies broadly, regardless of whether the hardware or technical data was developed under a contract with the DOD or some other military customer. As a general rule of thumb, exports of any defense article or technical data to a foreign person will require a license from DDTC.
Notably, neither regulatory regime covers information that is considered to be properly "publicly available." Consequently, most technical information that is broadly disseminated to the public (such as basic marketing materials) or basic information such as fundamental scientific research, are considered beyond the scope of U.S. export laws and may be broadly released without additional licensing permission.
Restricted information and technology – i.e., information that is not "publicly available" under the export regulations – is potentially subject to U.S. export laws, regardless of how that information is transmitted. Information or technology may be "exported" by email, orally in a meeting or telephone call, visually via a photograph, drawing, or webpage, or even by taking a laptop containing restricted information on a personal or business trip overseas. An export is "deemed" to have occurred when restricted information or technology is provided to a foreign national within the United States. For example, showing restricted technical drawings to a Chinese engineer at a manufacturing plant in California is a "deemed export" to China.
Clearly, there are myriad ways to run afoul of the complicated (and sometimes counter-intuitive) export laws.
Background on New DFARS Rule
Congress recently directed DOD to issue new regulations to ensure compliance with U.S. export laws:
The Secretary of Defense shall prescribe regulations requiring any contractor under a contract with the Department of Defense to provide goods or technology that is subject to the export controls under the Arms Export Control Act or the Export Administration Act of 1979 (as continued in effect under the International Emergency Economic Powers Act) to comply with those Acts and applicable regulations with respect to such goods and technology, including the International Traffic in Arms Regulations and the Export Administration Regulations. Regulations prescribed under this subsection shall include a contract clause enforcing such requirement.
2008 National Defense Authorization Act, Pub. L. No. 110-181, § 890(a).
Additionally, Congress instructed DOD to improve its efforts in alerting contractors that they may be dealing with restricted technologies, and also directed DOD, the Department of State, and the Department of Commerce to make available additional resources to train defense contractors with regard to their obligations under U.S. export laws.
Finally, Congress requested a report from DOD regarding the utility of additional governmental oversight activities to ensure export compliance, including:
- Requiring defense contractors to report periodically on their export compliance efforts
- Requiring periodic audits to ensure that defense contractors are complying with U.S. export laws
- Requiring defense contractors to maintain a comprehensive export training program (complete with a senior corporate compliance officer charged with export compliance) and an export compliance plan
Summary of the Interim DFARS Rules
Consistent with the congressional mandate, DOD issued the interim rules on July 21. The new interim rules essentially do two things: (1) they create a new subpart (DFARS Subpart 204.73) reminding contractors of the potential applicability of U.S. export laws, and (2) they create two new contract clauses, one of which should be included in all DOD contracts, making a contractor’s export compliance efforts an express contractual requirement. As outlined in DFARS Subpart 204.73, the primary goal of these new clauses is to put DOD contractors and their suppliers on notice of the fact that they have a separate obligation, beyond a contractor’s obligations to DOD, to comply with the export control laws administered by BIS and DDTC.
1. The first clause, DFARS 252.204-7008, Requirements for Contracts Involving Export-Controlled Items (Jul 2008), will be incorporated in any contract that is expected to involve export-controlled items (including export-controlled technologies). Note that, given the expansive scope of the EAR, this clause will be included in virtually every DOD contract, with the exception of basic research and development contracts focusing on fundamental research. The new clause imposes two key obligations:
- Requires the contractor to comply with existing export laws under the EAR and ITAR (including registering with DDTC, as required under the ITAR for all manufacturers of defense articles, regardless of whether the manufacturer is actually exporting any defense articles);
- Requires the contractor to flow-down the compliance requirement to all subcontracts that are expected to involve export-controlled items.
Thankfully, DOD abandoned an earlier plan to list separately in the contract each type of restricted technology or hardware that was or would be covered under the subject contract – a plan that would have created an administrative nightmare and may also have created confusion where a contractor received differing advice from DOD, DDTC, and BIS. The interim clause merely puts the contractor on notice that it needs to conduct its own due diligence on export issues and ensure that it is properly complying with all applicable export laws.
2. The second clause, DFARS 252.204-7009, Requirements Regarding Potential Access to Export-Controlled Items (Jul 2008), will be incorporated in any research and development contract that is not expected to involve any development beyond fundamental research, or any contract where DOD is unable to determine whether export-controlled technologies may be included within the scope. Obviously, inclusion of this second clause will be much less common than the first, especially considering that DOD R&D contracts may easily expand from general R&D into applied R&D, with the latter type of research being subject to U.S. export laws.
Note also that the clause refers to "potential access" to export-controlled items. Should the contract expand to include products or technologies that are subject to U.S. export laws, the clause imposes an affirmative obligation on the contractor to notify DOD so that the contract can be modified according to DOD’s desires – whether by modifying the contract to include DFARS 252.204-7008, by reducing the scope of the contract, or by terminating the contract.
With regard to incorporation of these new clauses in contracts, there are at least two issues on which the interim rules appear silent.
- First, the interim rules as written are not clear as to how or when these clauses should be incorporated in contracts. DFARS 204.7304 directs the Government to include these clauses "prior to the issuance of a solicitation," which would seem to indicate that clauses will be included in newly solicited and newly awarded contracts going forward. The rules are silent as to whether current contracts (or even task orders newly issued under current contracts) will or even should be modified to incorporate the new clauses.
- Second, the interim rules are unclear as to whether purchases through non-DOD procurement vehicles (such as, for example, the GSA Multiple Award Schedule Program) will incorporate the new clauses. Both FAR 8.404(b) and DFARS 217.7802(d) generally require a contracting officer to apply agency-specific DOD regulatory requirements when placing orders on behalf of DOD, but it is unknown exactly how these clauses might be incorporated in practice in non-DOD contracts.
In the end, these issues may be a distinction without a meaning, given the fact that the primary goal of these new clauses is simply to put DOD contractors and their suppliers on notice of the obligation to comply with U.S. export laws.
A few general conclusions are worth noting:
1. Cost Impact and Compliance Burden. While DOD contractors will hardly welcome yet one more "compliance obligation" imposed by the Government, and while they already have objected to the additional cost impact that export compliance will have, DOD has readily rejected such objections noting that "all contractors, including small entities, are already subject to export control laws and regulations" independent of the new interim rules. All that these rules do is remind contractors of their obligations, ensure that DOD contracting personnel are more aware of export-related issues, and create additional contract-based remedies for DOD if a contractor fails to comply with its export obligations.
2. Mandatory Compliance for Subcontractors. The interim rules require contractors to flow down this requirement to subcontractors. Just as with the prime contractor, all subcontractors are already obligated to comply with U.S. export laws, so there is no "new" compliance burden. However, we do not doubt that some subcontractors – especially those who do not view themselves as engaging in any types of "exports" – will resist such requirements. We routinely recommend that a contractor’s standard Terms and Conditions should impose an export compliance obligation on subcontractors (with an accompanying indemnity obligation from the subcontractor) in order properly to manage the compliance risk, but the additional requirement under the interim rules that subcontractors must flow down the substance of the clause to all of their subcontractors and suppliers may be a tougher pill to swallow.
3. DOD Does Not Have Authority to Waive Export Requirements. The new interim rules also serve as a useful reminder that DOD is subject to U.S. export laws. Frequently, we encounter circumstances where DOD personnel instruct a contractor to transmit restricted hardware or technical data to foreign persons without regard to the export laws. The sentiment that is often expressed is that "the export rules do not apply to the United States." While this conceit may be true in limited circumstances, it is not consistent with the law in general. Historically, many contractors have been placed in the unenviable position of either: (a) complying with DOD’s instructions, at the risk of violating the export laws, or (b) disobeying DOD’s instructions and complying with the export control laws. Perhaps the new interim rules will remind DOD personnel of the need to review the EAR and the ITAR before counseling a contractor as to its obligations under U.S. export laws.
4. "Recommended" or "Mandatory" Export Compliance Plans. While the new contract clauses do not expressly require a contractor to have in place a formal export compliance program, such plans are "strongly recommended" by both DDTC and BIS. These compliance plans should include export compliance policies and procedures, processes for companies to conduct internal audits, and also plans for companies to conduct periodic training on export-related issues. While not contractually required at the present time under the interim rules, given the fact that Congress has asked DOD to issue a report on whether requiring such plans is recommended, we think that such a formal requirement will be inevitable (similar to the new Code of Business Ethics and Conduct rules that are mandatory as of December 2007) (and discussed previously in this blog). We recommend all contractors (not merely DOD contractors) try to stay ahead of this wave.
5. Enforcement Actions and False Claims Act Liability. Given the fact that a failure to comply with U.S. export laws is now a DOD contractual requirement, be aware that contractors that make express or implied false statements regarding compliance with U.S. export laws may find themselves liable for treble damages under the punitive sanctions of the civil False Claims Act ("FCA"). This puts contractors at risk for dealing with enforcement actions from the U.S. Department of Justice, the DOD, the Department of State, and the Department of Commerce. (Recent trends in export enforcement discussed previously in this blog can be found here and here. Compliance in the first place is much less expensive, far more economical (both financially and administratively), and far more prudent.