ITAR Compliance for Second and Third Tier Government Contractors and Suppliers

Companies in the defense industry increasingly are being asked by their customers whether they are “ITAR Compliant” and if they can document this.  Many small and mid-sized contractors and suppliers do not know how to respond to these requests, and how to respond can have important consequences for these companies.

By way of background, the International Traffic In Arms Regulations (ITAR) are the State Department regulations that apply to the manufacture and transfer of defense products, defense services and technical data.  There is a major concern within the U.S. Government that, while large prime contractors have strong ITAR compliance, many mid-sized and small companies in the defense supply chain do not, and that this gap creates significant national security risks for the U.S.

These issues apply both to companies with direct contracts on defense projects as well as independent upstream suppliers of parts, components, services and software that are ultimately used in the defense sector.

The agencies have taken a number of steps to address this risk including: (i) adopting specialized clauses in DOD contracts mandating that contractors comply with ITAR requirements and flow this requirement down to their subcontractors (see for example DFARS §225.79 and 252.225.7048); and (ii) initiating ITAR enforcement cases targeted specifically at small/mid-sized companies.  (See for example our article: “Recent ITAR Case Sends Important Message to Small/Midsized Government Contractors”).  These steps are intended to force ITAR compliance throughout the entire defense supply chain.

Many prime contractors are now worried that if their subcontractors commit ITAR violations, the prime contractor can have liability.  As a result, prime contractors are establishing requirements that their subcontractors become ITAR-compliant, and requiring the subcontractors to impose similar requirements on the subcontractors’ suppliers and subcontractors.  The prime contractor will often ask for documentation from the subcontractors providing evidence that they have done this. 

Failure to be “ITAR Compliant” can create significant problems for small and mid-sized contractors, including loss or termination of their contracts, potential civil and criminal liability for ITAR violations, and reputational damage, especially in the eyes of prime contractors and other downstream customers.

ITAR sets forth a number of requirements that apply to companies in the defense sector, including:

• The prohibition against disclosing ITAR-controlled technical data to foreign nationals overseas and in the U.S. (including to foreign nationals who are employees of your company) unless a license is obtained or an exemption applies;
• The requirement to register with the State Department under ITAR Part 122;
• The requirement to obtain State Department authorization (called a Technical Assistance Agreement) to perform “defense services;”
• The requirement to obtain export and import licenses for certain transactions;
• The requirement to adopt controls to protect ITAR-controlled technical data within the company’s data system to prohibit foreign nationals from obtaining access to such data (including foreign employees of your company);
• Restrictions on “brokering” or assisting others in the sale/transfer of defense articles and defense services;
• Restrictions on entering transactions with parties from the list of countries subject to U.S. arms embargoes set forth in ITAR §126.1 (called the “§126.1 Proscribed Countries”); and
• Reporting and recordkeeping requirements.

A more detailed discussion of ITAR requirements applicable to government contracts firms is available in our Whitepaper: “ITAR For Government Contractors.”

Penalties for ITAR violations include financial fines of up to $1,000,000 per violation and up to twenty years imprisonment.  If you discover that you have a violation there are steps you can take to deal properly with these and minimize your liability – for additional information see our articles:  “Dealing with Violations In Export Transactions”, “Seven Steps To Protect Your Company From Export Violations,” and “Voluntary Self-Disclosures – An Important Tool For Dealing With Export Violations.” 

The Commerce Department also administers a companion set of regulations entitled the Export Administration Regulations (which apply to commercial products and certain limited defense products) which must be read in conjunction with ITAR.

ITAR requirements can apply even if your company does not engage in any international activities and even if your only customer is the U.S. Department of Defense.

What should mid-sized companies do to deal with these requirements?  There is no formal process or certification for a company to become “ITAR Compliant” or “ITAR Certified.”  However, there are a number of important steps that small/mid-sized contractors can take to come into compliance with the law and address these requests from prime contractors:

1. ITAR Registration - Many companies in the defense supply chain are required to register with the State Department under ITAR Part 122.  Companies should assess if they are required to register and if so do so as quickly as possible.  For additional information regarding the requirement to register see our article: “Is My Company Required To Register Under ITAR?”
2. ITAR Compliance Program – Another important step is to learn about the general requirements under ITAR and the EAR and adopt internal written policies and procedures to comply with these – this is called an ITAR Compliance Program.  The State Department recommends that companies involved in ITAR-controlled activities adopt ITAR Compliance Programs – and if a company has an ITAR violation the State Department frequently reduces penalties or assesses no penalties for companies that have compliance programs.  Compliance Programs demonstrate to prime contractors (and government agencies if there is an ITAR violation) that your company has a formal process for ITAR compliance and project a sophisticated approach to managing these issues.
3. Risk Assessment - Unique Requirements That Apply To Your Company – A third important step is identifying the specific ITAR requirements that apply to your company based upon your business activity, customer base and countries of operation and adopting focused strategies for dealing with these.  For example, a company providing electronic components for the F-35 to a customer in Chicago will most likely have different ITAR requirements than a company providing program services to support the U.S. Navy in Japan.  This is sometimes called a “Risk Assessment” - this can help you identify the greatest legal risks/exposures for your company and strategically concentrate efforts to eliminate these. 

Other steps that you can take to protect your company include:

• Conduct due diligence reviews of your subcontractors and upstream suppliers to verify that they are taking appropriate steps to comply with ITAR/export control requirements, and if required flow down the ITAR compliance clauses to these parties.
• When you receive documents from prime contractors such as mechanical drawings or technical specifications, see if they are marked as containing ITAR/EAR-controlled technical data and if so take appropriate steps to protect such materials from improper transfer and disclosure.
• When you are sending products that are ITAR/EAR-controlled and documents that contain ITAR/EAR-controlled technical data to other parties in the U.S., mark such items as subject to export controls to provide a warning to the recipients for handling, storing and transferring such items.  (Of course, if you will be transferring ITAR-controlled items out of the U.S. or disclosing ITAR-controlled technical data to foreign persons in the U.S. you will be required to obtain an export license unless a license exemption applies.)
• Conduct ITAR compliance training for your company employees to assure that they understand the requirements under ITAR and comply with them on a regular basis.

Once you have taken these steps, you can advise your prime contractors of the actions you have taken to come into compliance with ITAR.  In addition, you will be ready to respond to future inquiries from prime contractors regarding your company’s ITAR readiness for new contracts.  This will provide your company a competitive advantage over other subcontractors in competing for new business and help in reducing your legal liability on an ongoing basis.

Please note: 
This newsletter contains general, condensed summaries of actual legal matters, statutes and opinions for information purposes. It is not meant to be and should not be construed as legal advice. Readers with particular needs on specific issues should retain the services of competent counsel. For more information, please visit our website at www.williamsmullen.com or contact Thomas B. McVey, 202.293.8118 or tmcvey@williamsmullen.com.