Technology Control Plans

for Cleared Defense Contractors

Michael MillerUniversity of Central

Florida

Agenda• TCP Essentials

– What is a TCP? – Who needs to implement a TCP and when?– What are the critical elements of a TCP?

• Regulatory Authorities and Agencies• Developing a TCP - Agency Expectations • Monitoring Effectiveness• Training• Violations

What is a Technology Control Plan?• A Roadmap of how a company will control its technology. “How to

do it” document that explains how the ITAR, EAR and NISPOM will be carried out.

• Ensures classified defense information (“CI”) or controlled unclassified information (“CUI”) is not provided to a foreign person (employees, visitors, affiliates).

• A protection plan to control access to and dissemination of CI and CUI– Includes information, items, articles and technical data

• Ensures program team are informed, aware, and understand their obligations and responsibilities.

• Not a replacement for traditional security programs (SPP), but an enhancement to existing practices.

Core Principles• Multiple variations of the title “TCP”, content and layout

• Based on corporate policy, federal laws and regulations and facility clearance requirements

• Identifies the controlled “things” (e.g. CI, CUI, EAR, ITAR, materials, technical data, and services)

• Proscribes access and dissemination controls of the “things”

• Defines duties and responsibilities

• A TCP is only as strong as the training you provide to the staff who must execute the plan.

Three Main Parts1. The Plan

2. Non-Disclosure Statement

3. Acknowledgement

We will get into specific elements found in each section of the plan later.

Types of TCPs• Facility type plan

– Plan to possess export-controlled or other restricted information– Your personalized controls not specified in the NISPOM

• Project specific plan– Implement a security bubble around elements of a program, i.e.

access to various parts of a facility, or compartmentalization methods:

• Area quarantine• Time blocking• Locked storage and electronic security• Communication security

• Activity-related plan– Visits, IT systems, launch activities, shared services, etc.

• Person specific plan – Foreign person employees – a plan for the work activities.

Who Needs a TCP?• Cleared defense contractors

– FOCI arrangements (in addition to SPP)– Cleared facilities with foreign persons on-site

• Foreign employees• Short-term and long-term visitors

– Foreign person export licenses - before transfer of hardware, software, tech data or defense services

• Uncleared Defense Contractors, Manufacturers, Distributors, Brokers subject to ITAR/EAR – Registration Requirement w/ DDTC– ITAR facilities w/ FN employees, visitors, plant visits, shared

facilities– Needed even for unlicensed foreign persons w/o access to

anything– Required for licensed foreign persons or other Government

Approval– Mandated by Proviso / license condition

Who Needs a TCP? • Service Providers

– Researchers, institutes, universities for unclassified export controlled information

– Certain exports of Cat XV USML space projects and launch activity providers

– Certain encryption technology providers– FMS Freight Forwarders

EAR: “TCPs are a good practice for all holders of export controlled technology”

Regulatory AuthoritiesExport Controls Agencies

• U.S. Department of State, Directorate of Defense Trade Controls– International Traffic in Arms Regulations

• Department of Commerce, Bureau of Industry & Security– Export Administration Regulations

Department of Defense Agencies

• Department of Defense, Defense Security Service– National Industrial Security Program

• Department of Defense, Defense Technology Security Administration

– National Defense Authorization Act• Public Law 105-261, Title XV

State DepartmentArms Export Control Act• International Traffic in Arms Regulations (“ITAR”) , 22 CFR

Parts 120 – 130

• Part 126 “General Policies and Provisions”– 126.13(c) License applications for foreign person employees:

TCP required when foreign persons are employed at or assigned to security-cleared facilities.

– 126.18(c)(2) Exemptions for Intra-company transfer of unclassified defense articles to foreign person employees: TCP required as a condition to use exemption, in addition to complying with other ITAR requirement (126.1 country prohibition, NDA, screening

for substantive contacts, travel, allegiance, business relationships, etc.

– 126.5, Supplement 1, Note 14. Canadian Exemptions: (Revision to Prior TCP Requirement No specific TCP but rather a semi-annual report to state.

Commerce DepartmentExport Administration Act• Export Administration Regulations (“EAR”) , 15 CFR Parts

730 - 744

• Part 752.11, Internal Control Program Requirements– ICP is the basis for a TCP under the EAR, required for deemed

export and technology exports licenses.

– Essential elements:• Corporate commitment to export compliance• Physical security plan• Information security plan• Personnel screening procedures• Training and awareness program• Self evaluation program

• References:– http://www.bis.doc.gov/index.php/forms-documents/doc_download/387-intermediate-deemed-exports-pdf– http://www.bis.doc.gov/images/pdfs/deemedexports/foreignationals.pdf

Commerce Department• Part 734.2(b)(2)(ii) Deemed Exports

– 734.2(b)(2)(ii) Deemed Export: Release of technology is deemed to be to the home country of the foreign national, e.g. tours, foreign national employees involved in certain R&D and manufacturing activities, foreign students/scholars, hosting foreign nationals at your facility.

• Licensing of Deemed Exports: No specific EAR reference to TCP; however, license requires “safeguards to restrict access” i.e. TCP.

– Required when foreign nationals are employed at or assigned to facilities that handle export-controlled items or information

– BIS Licensing Guidance - Internal Technology Control Plan - Applicant should describe measures to prevent unauthorized access by foreign nationals to controlled technology or software. The measures may include the applicant’s internal control program to prevent unauthorized access to controlled technologies or software.

Commerce Department• License Conditions

– The applicant will establish procedures to ensure compliance with the conditions of this license, particularly those regarding limitations on access to technology by foreign nationals. The applicant's key export control management officials will ensure that the foreign national complies with conditions 1- 5. A copy of such procedures will be provided to DoC/BIS.

– The applicant will ensure that the foreign national does not have access to any unlicensed controlled technology.

– The transfer of controlled technology and software shall be limited to the minimum needed by the foreign national in his/her role as described in the license application.

– http://www.bis.doc.gov/images/pdfs/deemedexports/foreignationals.pdf

Defense Technology Security AdministrationArms Export Control Act• International Traffic in Arms Regulations (“ITAR”) , 22 CFR

Parts 120 – 130

• Part 124 “Agreements, Off-Shore Procurement, and Other Defense Services”

– 124.15(a)(1) Special Export Controls for Defense Articles and Services Controlled Under Cat. XV “Space Systems and Space Launches”: Technology Transfer Control Plan (TTCP) and Encryption Technology Control Plan (ETCP) required for use of any exemption, government approval or for any export license related to Category XV.

– Special processing procedure & rules. DTSA must monitor compliance for proliferation.

– DTSA has a TTCP Development Guideline manual– Approved by DoD, DOS, DTSA, and NSA.

Note Export Control Reform: Commercial satellites & related items transferring from the ITAR to the EAR. ITAR will retain primarily military, intelligence, and certain remote sensing satellites) and related ground systems, components, parts, software, and technical data and defense services. Services include assistance related to ANY satellite launch, satellite/launch vehicle integration, and satellite launch failure analysis.

Defense Security Service• NISPOM 2-307 – Foreign Ownership, Control or Influence

(FOCI)– A TCP shall be implemented by companies cleared under FOCI

action plans that prescribes all security measures to reasonably foreclose the possibility of inadvertent access by non-U.S. citizen employees and visitors to information for which they are not authorized.

– Referenced in 22 CFR 126.13(c) (ITAR)

• NISPOM 10-509 – International Visits & Control of Foreign Nationals– A TCP is required to control access by foreign nationals assigned

to, or employed by, cleared contractor facilities… The TCP shall contain procedures to control access for all export-controlled information.

• DSS CDSE Webinar on Technology Control Plan under the NISPOM

– http://www.cdse.edu/catalog/webinars/industrial-security/technology-control-plan.html

FOCI Required Plans• Technology Control Plan

• Affiliated Operations Plan– Shared Services, e.g. IT, banking, etc.

• Electronic Communications Plan– IT Systems, Tele/video conferencing– Ensures no unallowable Technology Transfer

• Visitations Plan– Foreign / U.S. company meetings

• Facility Location Plan– Close proximity, shared, and co-located

http://www.dss.mil/isp/foci/foci_info.html

Developing a TCP – Agency Expectations• Write your own plan and tailor it to your specific situation

• Know what needs to be protected and describe the things that are subject to agency controls– Ex. Information, articles, USML, CCL, Classification

• Describe procedures for protection and controls– Controls should make sense– If it is in your plan, do it– Agency specific requirements (e.g. FOCI)

• Designate & empower company officials – Technology Control Officer / Export Control Officer– Facility Security Officer

• Educate personnel – critical.

Standard Sections of the Plan• Introduction (scope, purpose, background, definitions)

• Corporate policy

• Identification of restricted technology

• Protection guidelines – Physical security – Personnel security– Operational security** NSDD-298 – Signal security (if applicable)– Computer security– IT Network security

**Deny adversaries export controlled or public info that are unclassified

Standard Sections Cont.• Licensing Procedures (TAA, MLA, Foreign Person Employees)

• Plant / Site visit

• Foreign travel

• International shipping

• Training requirements

• Recordkeeping

• Accountability and violation penalties

Optional Customized Sections

• Unique facility elements – Identification of escorted areas – Unescorted areas – Segregated work areas

• Identification of team members & responsibilities– Responsible Company Officials

• Investigation procedures

• Employee Separation

Best Practice Examples

Introductory information• Introduction, scope, purpose, background, definitions

– Delineates and informs employees and visitors: • The existence and description of technology controls, • What areas of the company controls apply, i.e. “territories,

divisions, units” etc. • Why they are necessary, i.e. “purpose”• Specific provisions applicable to your company’s defense

trade function or facility clearance, i.e. “DTRADE Registration No.”

• Definition of Terms as they relate to the TCP, i.e. “foreign persons”

Introductory information

Introduction This Technology Control Plan (“TCP”) delineates and informs employees and visitors of the controls necessary to ensure that no transfer of technical information or data or defense services occur unless authorized pursuant to federal regulations. Purpose and Scope The purpose of this plan is to describe the methods to 1) identify program activities that are subject to federal regulatory requirements; 2) identify security responsibilities and requirements of project personnel; 2) establish methods for the identification and handling of controlled unclassified information (“CUI”); 3) allowable and unallowable access to the program, data and equipment, monitoring and control protocols, physical and electronic measures for access, use, storage, transfer and destruction. The Technology Control Plan (“TCP”) provides guidance on the control of access to classified and unclassified export controlled information by foreign persons employed by, and long-term foreign national visitors assigned to, a cleared U.S. contractor facility pursuant to the International Traffic in Arms Regulations (“ITAR”) codified at 22 Code of Federal Regulations (CFR) §§ 120-130, and the Export Administration Regulations (“EAR”) codified at 15 Code of Federal Regulations (CFR) §§ 300 – 799 and the National Industrial Security program operating Manual (“NISPOM”). A TCP is a roadmap of how UCF will control restricted technology to ensure compliance with the ITAR, EAR and NISPOM.

Statement of Commitment• Corporate Directive or policy

– Reference to FCL, NISPOM, federal regulations and other commitments

– Required by the ITAR – corporate commitment http://www.pmddtc.state.gov/compliance/documents/compliance_programs.pdf

– TCP should reference the corporate directive– May include specific “foreign person” policy

UCF Statement of Commitment The University will fully comply with U.S. export control laws while ensuring that, to the extent possible, university instruction and research is conducted openly and without restriction on participation or publication. As a cleared defense contractor, UCF is committed to educating its employees, professors, students, researchers or other collaborators on U.S. export control laws and regulations and their particular application within a university research setting. As part of the University’s ongoing commitment to export control compliance and education, the University has established a website at: http:/ / www.research.ucf.edu/ ExportControl/ that contains university export control policies, forms, training modules and reference materials.

Identification of Technology• Identification and enumeration of restricted technology

– Commodity Jurisdiction determines which regulatory regime and procedures will govern the activity.

• Security Classification(s)

• U.S. Munitions List Category and Subcategory

• Export Control Classification Number (“ECCN”)

Identification of Technology• U.S. Munitions List Category and Subcategory

Export Control Jurisdiction, Classification and Categorization UCF will create, generate, require access, or receive technical data or defense articles regulated by the Arms Export Control Act (“AECA”) and subject to the federal restrictions specified in the ITAR in performance of this program. This TCP details the mitigation techniques UCF will implement to comply with the ITAR requirements. The Principal Investigator (PI) and Approved Project Personnel are required by law to conform to the minimum security requirements to ensure that controlled defense services, articles, and technical data or controlled commodities are adequately protected from disclosure. The applicable United States Munitions List (“USML”) Category and subcategory classifications are: Category IX: Military Training Equipment & Training, (a), (b), (d), (e) (a) Training equipment specifically designed, modified, configured or adapted for military purposes, including but not limited to weapons system trainers, radar trainers, gunnery training devices, antisubmarine warfare trainers, target equipment, armament training units, pilot-less aircraft trainers, navigation trainers and human-rated centrifuges.

(b) Simulation devices for the items covered by this subchapter. (c) Tooling and equipment specifically designed or modified for the production of articles controlled by this category.

(d) Components, parts, accessories, attachments, and associated equipment specifically designed, modified, configured, or adapted for the articles in paragraphs (a), (b) and (c) of this category.

(e) Technical data (as defined in Sec. 120.10 of this subchapter) and defense services (as defined in Sec. 120.9 of this subchapter) directly related to the defense articles enumerated in paragraphs (a) through (d) of this category.

(f) The following interpretations explain and amplify terms used in this category and elsewhere in this subchapter: (1) The weapons systems trainers in paragraph (a) of this category include individual crew stations and system specific trainers; (2) The articles in this category include any end item, components, accessory, part, firmware, software or system that has been designed or manufactured

using technical data and defense services controlled by this category;

(3) The defense services and related technical data in paragraph (f) of this category include software and associated databases that can be used to simulate trainers, battle management, test scenarios/ models, and weapons effects. In any instance when the military training transferred to a foreign person does not use articles controlled by the U.S. Munitions List, the training may nevertheless be a defense service that requires authorization in accordance with this subchapter. See e.g., Sec. 120.9 and Sec. 124.1 of this subchapter for additional information on military training.

Physical Security• Cross-reference with SPP if necessary

• Facility layout with diagram

• Physical barriers and separators– Building access– Locking requirements– Offices, doors, file cabinets– Production, lab, manufacturing areas– Visual access inhibitors

• Badges and badging– Employee– Visitor– Foreign person– Contractor

• Key control – log of who has what keys / electronic combinations

Badges & Badging• Example

Personnel Security• Written employee responsibilities

– Can be broken down by function or division (general employee, supervisor, engineer, business development, security, HR, etc.)

• Foreign person in-residence responsibilities– Licensing procedures– Indoctrination procedure– Monitoring– Separation

• Third party responsibilities– Custodian, maintenance, delivery, building management

• Random personnel inspections– Entering and exiting the facility– Bags, parcels, media, electronic devices– Notification posted on premises

Example – Foreign Person Disclosure

Example - Indoctrination

Example - Responsibilities

Access Control• Procedures for controlling and restricting access to:

– Work areas

– Information• Uncontrolled and public• Controlled • Classified • Proprietary• Derived information• Storage, destruction, transmission, dissemination

“All information that needs to be protected must be appropriately marked or otherwise identifiable to all personnel”

– Equipment, hardware, production facilities, etc.

Example – Identification of Information

Example - Hardware

Access Controls

Site Visits• Plant and site visit procedures

– Pre-visit screening– In-processing, log, facility notification, badging & briefing– Host escort and acknowledgement

Escorts• Escorts are responsible and must be trained• Must be able to control visitors at all times• Do not allow wandering, pictures, embarrassing incidents,

unannounced changes, unannounced visitors, video crews, misinterpretations, multiple requests, etc.

• Waiting room areas can be designated “safe harbor”• Lock-up restricted information / articles

Escorts The PI and approved project personnel will ensure that foreign nationals are not present when measurement is taking place. All foreign persons must be are escorted within the lab area. Foreign nationals are not permitted independent, unescorted 24 hour access to a work area until such time as all export controlled activity has ceased.

Computer & Network Security• Computer security

– Use NIST standard as a baseline – User IDs, login, passwords, encryption, etc.– Company email only, no clouds

• IT Network security– Procedures to maintain control of networked systems– Domain access restrictions– Repository (fileserver) for restricted CUI, proprietary, trade

secret– Drawings, configuration management

NDA

TCP Acknowledgement

TCP AcknowledgementSUBJECT: Attestation of Understanding and Compliance Agreement with the Technology Control Plan

Section 1: To be completed after initial ITAR Training I, [Project Team Member], having read the subject Technology Control Plan, attest to my understanding of the following responsibilities:

a. I will refrain from sharing the research project’s Critical Information (CI) with personnel who are not part of the contract or university research teams performing under contract Number [Number]

b. I will notify my Principal Investigator (PI) of any inadvertent disclosures

c. I will comply with the management controls and Te3chnology Control Plan countermeasures prescribed in the Plan. __________________________________ ________ ___________________________________ _______ [Project Team Member] Date Dr. [Name], Professor Date

Section 2: To be completed upon exit from the research project I attest to my understanding that my obligation to protect the project’s Critical Information (CI) and Export Controlled technical data continues past my association with the project. I acknowledge that I am required to follow the same countermeasures to protect that information after my association with this project has concluded. __________________________________ ________ ___________________________________ _______ [Project Team Member] Date Dr. [Name], Professor Date

Monitoring• Internal Self Assessment

– Annual review of TCPs should be conducted– Checklist of items, measures and benchmarks that should be

reviewed• Employee knowledge• Adherence to access procedures• Corrective action plan for findings uncovered• Penalties for violations must be enforced

• Recurring Training– Personnel subject to TCP should be trained annually– Training should review policy, procedure, legal requirements

and TCP protocols

TCP Violations• Procedure for handling violations

Investigation will consist of three phases:

1. Data preservation a. Notify necessary parties of the investigation b. Require parties to preserve all materials related to the subject matter c. Categorize and review the types of information and documents relevant to the

investigation d. Demand strict compliance with data preservation e. Inform parties of how information should be preserved f. Designate a Point of Contact

2. Data collection and review

a. Document preservation and collection interviews b. Collection and review of paper and electronic data

3. Interviews of relevant employees / participants

a. Following collection, review and organization of data, interviews with all relevant parties will be conducted.

b. A formal memo and summary of all interviews will be prepared Upon conclusion of data collection, interviews and evaluation, a formal report will be prepared. Facts developed during the course of the investigation are important for VSD purposes in addition to university decision-making. Contents of the report will include:

1. Description of the subject and scope of the investigation 2. Description of each phase of the investigation, including all efforts 3. A chronology of the facts developed via the investigation 4. A description of remedial measures undertaken 5. A description of proposed corrective/preventative actions

Self-Disclosure• Regulatory Requirements 127.12(c)(2)

(i) A precise description of the nature and extent of the violation (e.g., an unauthorized shipment, doing business with a party denied U.S. export privileges, etc.); (ii) The exact circumstances surrounding the violation (a thorough explanation of why, when, where, and how the violation occurred); (iii) The complete identities and addresses of all persons known or suspected to be involved in the activities giving rise to the violation (including mailing, shipping, and e-mail addresses; telephone and fax/ facsimile numbers; and any other known identifying information); (iv) Department of State license numbers, exemption citation, or description of any other authorization, if applicable; (v) U.S. Munitions List category and subcategory, product description, quantity, and characteristics or technological capability of the hardware, technical data or defense service involved; (vi) A description of corrective actions already undertaken that clearly identifies the new compliance initiatives implemented to address the causes of the violations set forth in the voluntary disclosure and any internal disciplinary action taken; and how these corrective actions are designed to deter those particular violations from occurring again; (vii) The name and address of the person making the disclosure and a point of contact, if different, should further information be needed.

Contact InformationMike Miller

Assistant Director for Export ControlsUniversity of Central FloridaEM: Michael.Miller@ucf.edu

PH: 407-882-0660