Understanding ITAR Mandatory Disclosures and the “Duty to Inform” DDTC
[co-author: Alex Dieter, Law Clerk]
The discovery of actual or potential International Traffic in Arms Regulations (“ITAR”) violations presents the question of whether to disclose the conduct to the Department of State Directorate of Defense Trade Controls (“DDTC”). For certain violations, the ITAR sets forth mandatory disclosure requirements, and specific circumstances may give rise to an affirmative duty to inform DDTC of certain activities and transactions. This article identifies the types of ITAR violations for which disclosure to DDTC is required. Additionally, in connection with ITAR violations that do not trigger a mandatory disclosure requirement, this article outlines some basic considerations for persons contemplating whether to file a voluntary disclosure of export violations to DDTC.
Background
The Arms Export Control Act (“AECA”), as implemented by the ITAR and administered by DDTC, generally prohibits the export, reexport, and temporary import of defense articles including technical data, the provision of defense services to foreign persons, and the brokering of defense articles or services by U.S. persons wherever located and by all persons in the United States – unless such activities are first approved by DDTC or qualify for an exemption. The ITAR also imposes a requirement to register with DDTC on any person in the United States who manufactures, exports, or temporarily imports defense articles, furnishes defense services to foreign persons, or brokers defense articles or services. In addition, the ITAR imposes reporting requirements on all persons who pay fees or commissions beyond certain threshold amounts to secure the sale of defense articles or services.
ITAR Violations: What’s at Stake?
DDTC’s Office of Defense Trade Controls Compliance (“DTCC”) is responsible for civil enforcement of the ITAR. The Department of Justice, with support from DDTC and other government bodies, oversees criminal enforcement matters. Both criminal and civil violations of the AECA and ITAR carry significant penalties, for companies and individuals.
According to the ITAR at 22 C.F.R. § 127.3, any person who “willfully” violates any provision of § 38 or § 39 of the AECA, or any rule or regulation issued thereunder, or “willfully” makes an untrue statement or omission of a material fact in a registration or license application or required report may be subject to criminal penalties. In criminal prosecutions for “willful” ITAR violations, most courts apply the legal standard articulated in Bryan v. United States (U.S. 1998), in which the Supreme Court held that to establish a “willful” violation of a statute, the Government must prove that the defendant had general knowledge that their conduct was unlawful. Under this standard, the government is not required to show that the defendant had a specific awareness that their conduct violated certain laws or regulations. As prescribed by 22 U.S.C. § 2778(c), the criminal penalties for each violation can include a fine not exceeding $1,000,000, imprisonment for a term not exceeding twenty years, or both.
Pursuant to 22 C.F.R. § 127.10, DDTC is authorized to impose civil penalties for violations of the AECA and ITAR. Civil enforcement often involves the payment of civil fines and entering into a Consent Agreement with DDTC, which typically requires certain enhancements to the company’s export compliance program. Civil fine amounts may be up to $1,200,000 or twice the value of the transaction, per violation.
Mandatory Disclosures of ITAR Violations
Any person deciding whether to disclose to DDTC a recently discovered ITAR violation should first determine whether the violation triggers a mandatory disclosure requirement. If the violation triggers an affirmative duty to inform DDTC, then failure to report it would itself constitute an ITAR violation. The following provisions trigger mandatory disclosure obligations:
State Sponsors of Terrorism, Sanctioned Countries, and Arms Embargoed Countries – Duty to Notify DDTC
The ITAR at 22 C.F.R. § 126.1(e)(1) outlines the license requirement for any “sale, export, transfer, reexport, or retransfer of, and no proposal or presentation to sell, export, transfer, reexport, or retransfer, any defense articles or defense services” to any country referred to in 22 C.F.R. § 126.1, any embassy or consulate of such a country, or any person acting on behalf of such a country. The “Proscribed Countries” listed in section 126.1 include China, Russia, and over 20 other countries that are subject to a policy of denial for defense articles and services. Importantly, the prohibition covers not only completed sales but also certain sufficiently detailed proposed sales.
Section 126.1(e)(2) provides that “[a]ny person who knows or has reason to know of a proposed, final, or actual sale, export, transfer, reexport, or retransfer of articles, services, or data as described in [§ 126.1(e)(1)] must immediately inform the [DDTC]” by submitting a notification to the DTCC. Therefore, when a person has actual or constructive knowledge of a violation of § 126.1(e)(1), the mandatory disclosure requirement is triggered and cannot be untriggered later through willful blindness or conscious avoidance of information related to the violation.
It is also important to note that sections § 126.16(h)(8) and § 126.17(h)(8) similarly require U.S. persons registered under the ITAR and approved members of the Australian Community and United Kingdom Community to disclose violations involving countries listed in § 126.1 to DDTC. Specifically, these parties must report a proposed or actual sale, reexport, or retransfer of a defense article or service that was originally exported under the exemptions in § 126.16 and § 126.17 when it involves a Proscribed Country listed in § 126.1.
Unreturned Body Armor
The ITAR at 22 C.F.R. § 123.17(f) generally provides an exemption permitting U.S. persons to temporarily export from the United States certain articles of personal protective gear, such as helmets covered by U.S. Munitions List (“USML”) Category X(a)(6) and chemical agent protective gear covered by USML Category XIV(f)(4), without first obtaining a license or other approval from DDTC. According to 22 C.F.R. § 123.17(j), the temporarily exported items must be returned to the U.S. If the items are not returned, a detailed report must be submitted to DDTC. This mandatory disclosure requirement became effective in March 2020.
Voluntary Disclosures of ITAR Violations
When a company discovers ITAR violations that do not require mandatory disclosure, it may be in that company’s interest to submit a “voluntary disclosure” to DDTC in accordance with the 22 C.F.R. § 127.12. Companies that voluntarily disclose conduct to DDTC may receive a number of benefits if the disclosure is made timely and properly. Section 127.12 sets forth DDTC’s general policy and procedures for submissions of voluntary disclosures by persons that believe they may have violated the AECA, ITAR, or any regulation, order, license, or other authorization issued thereunder.
The ITAR provides the following list of mitigating factors that DDTC may consider in determining what, if any, enforcement action will be taken in response to the disclosed conduct:
Whether the transaction would have been authorized, and under what conditions, had a proper license request been made;
Why the violation occurred;
The degree of cooperation with the ensuing investigation;
Whether the person has instituted or improved an internal compliance program to reduce the likelihood of future violation;
Whether the person making the disclosure did so with the full knowledge and authorization of the person’s senior management. (If not, DDTC will not deem the disclosure to be voluntary.)
***
Given what is at stake, it is crucial for persons seeking to comply with the ITAR’s requirements to understand their obligations regarding mandatory disclosures and the duty to inform DDTC of certain occurrences. If a company believes it may have violated the ITAR, it should first determine whether disclosure is required under the ITAR and, if not, whether to file a voluntary disclosure. Even if disclosures are not pursued, it is imperative that companies immediately stop ongoing violations and implement corrective actions to address compliance deficiencies.
For more information on voluntary disclosures to DDTC, and how the process for self-reporting ITAR violations differs from similar voluntary self-disclosure (“VSD”) processes administered by various U.S. government bodies, see Torres Trade Law’s VSD Handbook.
The AECA is codified at 22 U.S.C. § 2778, et seq.; the ITAR is codified at 22 C.F.R. §§ 120-130.
See Bryan v. United States, 524 U.S. 184, 191-192 (1998) (holding that the term “willfully” in 18 U.S.C. § 924(a)(1)(D) requires proof only that the accused knew his conduct was unlawful, and not that the accused also knew of a specific licensing requirement); see also United States v. Bishop, 740 F.3d 927 (4th Cir. 2013) (holding that “willfulness” under the AECA, 22 U.S.C. § 2778, requires only general knowledge of illegality and not knowledge of whether a particular item is on the USML); United States v. Roth, 628 F.3d 827, 835 (6th Cir. 2011) (“Section 2778(c) does not require a defendant to know that the items being exported are on the [USML]. Rather, it only requires knowledge that the underlying action is unlawful.”)
See Nat’l Security Division, Dep’t Just., Enforcement Policy for Business Organizations, footnote 2, (Mar. 1, 2023), available at .
Civil monetary penalty amounts for ITAR violations are annually adjusted for inflation. See Department of State 2023 Civil Monetary Penalties Inflation Adjustment, 88 Fed. Reg. 1,505 (Jan. 11, 2023), available at https://www.federalregister.gov/documents/2023/01/11/2023-00353/department-of-state-2023-civil-monetary-penalties-inflationary-adjustment.
The ITAR mandates disclosures for certain types of violations, including cases involving countries listed in § 126.1 and unreturned temporary exports of personal protective gear. Failure to disclose in such cases may itself constitute an ITAR violation. See DDTC Violations and Disclosures FAQs, “Am I required to disclose the violation to DDTC?” (Nov. 2021), available athttps://www.pmddtc.state.gov/ddtc_public/ddtc_public?id=ddtc_public_portal_faq_detail&sys_id=9b16755f1b373050c6c3866ae54bcbaa.
See International Traffic in Arms Regulations: U.S. Munitions List Categories I, II, and III, U.S. Dept. of State, 85 Fed. Reg. 3,819 (Jan. 23, 2020), available at https://www.federalregister.gov/documents/2020/01/23/2020-00574/international-traffic-in-arms-regulations-us-munitions-list-categories-i-ii-and-iii (final rule amending the ITAR effective Mar. 9, 2020).
22 C.F.R. §127.12(3).