Export Compliance and Research Security
- Responsible Office: Research Administration and Compliance, Research and Innovation
- Current Approved Version: 11/26/2018
- Policy Type: Administrative
Policy Statement and Purpose
VCU creates new knowledge every day and seeks to foster an environment that promotes research and learning that benefits our students and community. While the purpose of research, scholarship, and education at VCU is to ultimately share information and new knowledge, there are times when access to certain data or certain laboratory spaces should be restricted for confidentiality, export compliance, national security, safety, and/or other security reasons. To that end this policy establishes a framework for identifying certain activities, research, and/or research space that requires additional security precautions.
This policy sets forth the elements of VCU’s export compliance, controlled unclassified information (CUI), and research/laboratory security programs, including classification and security requirements, and the VCU offices that provide support in these areas. This policy is designed to be supplemented by a series of Office of Research and Innovation compliance notices that will specify additional procedures related to this policy. These compliance notices must be followed in conjunction with this policy.
Security concerns may also result in safety violations under the Environmental Health and Safety and Risk Management policy which outlines escalation and disciplinary outcomes.
Noncompliance with this policy may result in disciplinary action up to and including termination. VCU supports an environment free from retaliation. Retaliation against any employee who brings forth a good faith concern, asks a clarifying question, or participates in an investigation is prohibited.
Who Should Know This Policy
All university members including faculty, staff, postdoctoral fellows, students, and all other persons studying or working at the university (including visiting scholars and scientists) or with whom the university has contracted to teach, conduct research, or provide or receive service activities at, for, or on behalf of the university are responsible for knowing this policy and familiarizing themselves with its contents and provisions.
Definitions Compliance Notice
The primary method by which the Office of the Vice President for Research and Innovation informs administrators, faculty, and staff of research-related changes and of adjustments to research operations and requirements across the university.
Controlled Unclassified Information (CUI)
Controlled unclassified information (CUI) includes information that requires safeguarding or dissemination controls pursuant to and consistent with regulations and polices created by individual government agencies.
An empowered official is someone directly employed by an organization who is legally empowered, in writing, to sign export license applications or other requests for approval of an export license on behalf of the organization.
An export occurs when an item is transferred physically from the U.S. to a foreign country, e.g., actual shipment of goods or goods carried during international travel, as well as when information is transmitted to a person or entity in a foreign country, whether in writing, or via email, phone, fax, internet, and verbal conversations.
Export Control Laws and Regulations
These include, but are not limited to, ITAR, EAR, and OFAC:
ITAR (International Traffic in Arms Regulations)
Regulations governing the exports and re-exports of items and services for military use, which include defense articles, including technical data, defense technologies, and defense services.
These regulations are under the jurisdiction of the U.S. Department of State. (22 CFR Parts 120- 130).
EAR (Export Administration Regulations)
Regulations governing the export, including deemed export and re-export, of dual use commercial items and technologies and other commercial items and technologies without an obvious military use. These regulations are under the jurisdiction of the U.S. Department of Commerce. (15 CFR Parts 730-774).
OFAC (Office of Foreign Assets Control)
The federal government office responsible for administering and enforcing the foreign asset control regulations. This includes economic and trade sanctions against targeted foreign countries, terrorists, international narcotics traffickers, and those engaged in activities related to the proliferation of weapons of mass destruction. The regulations administered by OFAC include controls with regard to specific individuals, specific organizations, and certain countries. OFAC is organized under the U.S. Department of the Treasury. (31 CFR Parts 500-598).
Technology Control Plan (TCP)
A Technology Control Plan is the formalization of the processes and procedures the University project personnel will use to ensure that any subject items and information are not disclosed to unauthorized personnel or otherwise exported without the necessary US government authorization.
The Export Compliance Office within the Office of Research and Innovation officially interprets this policy. The Export Compliance Office is responsible for obtaining approval for any revisions as required by the policy Creating and Maintaining Policies and Procedures through the appropriate governance structures. Please direct policy questions to the director of the Export Compliance Office.
Policy Specifics and Procedures
Export and CUI Compliance Program
The Export Compliance Office is responsible for conveying detailed procedural requirements specific to activities that involve export controlled items and/or CUI through this policy and compliance notices. Please see VCU Office of Research compliance notices.
The vice president for research and innovation is vested with the authority to designate an empowered official to oversee compliance with and enforcement of this policy. According to the Department of State, “an empowered official has the independent authority to: 1) enquire into any aspect of a proposed export [by the organization]; 2) verify the legality of the transaction and the accuracy of the information [contained in the application]; and 3) refuse to sign any license application or other request for approval without prejudice or other adverse recourse” (Code of Federal Regulations, title 22, section 120.25(4)). VCU’s empowered official is the senior associated vice president for Research Administration and Compliance.
Depending on the type of technology/data or end user/end use of that technology or data, an export license from the U.S. Department of Commerce or the U.S. Department of State must be obtained before a foreign person may be given access to an export-controlled item or before an export-controlled item may be transferred to a foreign country.
Export Controls in Sponsored Projects:
The Office of Sponsored Programs (OSP) assesses each new grant, contract, material transfer agreement, and data use agreement for potential export control concerns, and alerts the Export Compliance Office when potential export compliance issues arise. Investigators, schools/college, and departments must assist in addressing potential export control issues and in developing appropriate technology control plans or applying for licenses as needed. OSP will attempt to remove any publication or other dissemination restriction and will accept export controlled work only after the project is approved by the Export Compliance Office.
Export Controls for International Travel
When planning a trip abroad, VCU travelers must comply with VCU policy on the use of Chrome River for pre-approvals and Christopherson for travel bookings. Individuals traveling internationally on behalf of VCU who do not use these systems must contact the Export Compliance Office before traveling.
Each individual must ensure that any information to be discussed while abroad or any items to be taken abroad are not controlled, or if controlled, that proper licenses are in place.
Biological samples must never be transferred without an official agreement in place and prior authorization from VCU’s Export Compliance Office.
Required Actions in Advance of International Travel - These requirements apply to all VCU faculty, staff, students, and volunteers who travel internationally as part of VCU research, education, service, or employment.
Request Pre-Approval for International Travel through Chrome River. Be sure to check the “Travel Outside 48 contiguous States” box.
Respond promptly to any request for additional information from the Export Compliance Office.
All international travelers should review the Temporary Export (TMP) Exceptions section of VCU’s export compliance website.
International travelers are also strongly encouraged to consult VCU’s International Travel website to review current travel warnings.
Export Controls for International Employees and Visitors:
Federal regulations require VCU to review certain visa applications for possible export control concerns. All J and H1-B visas processed through VCU’s Global Education Office must be sent to VCU’s Export Compliance Office for review.
The required forms for an international visitor or employee can be found on the Global Education website (http://www.global.vcu.edu/students/immigration/). Once the forms have been completed, the Global Education Office forwards the export review form to the Export Compliance Office. If no export restrictions are found during the review, the Global Education Office will continue the visa application process. If restrictions are found, the faculty or sponsor of the foreign person must meet with a representative from the Global Education Office and from the Export Compliance Office to discuss possible solutions.
Export Controls for International Shipping:
Shipping tangible items outside of the United States may require an export license. The International Shipping Compliance Notice sets forth how VCU handles international shipping.
Export Controls for Scientific Equipment Purchases:
All scientific equipment purchases must be processed in accordance with VCU purchasing policies.
VCU’s Office of Procurement Services will request the Export Control Classification Number/United States Munitions List classification from each vendor. If the number for the equipment purchased is other than EAR99, the purchase order and specification information will be forwarded to the Export Compliance Office for further evaluation.
Technology control plans will be established when controlled technology is procured by VCU.
Sponsored Project and Research Volunteers:
See VCU’s Sponsored Project and Research Volunteers Compliance Notice for additional requirements.
Laboratory Security Program
In addition to export and CUI concerns, certain labs at VCU conduct work that is restricted for confidential, proprietary, national security, bio-security, bio-safety, chemical safety, radiation safety and other concerns. VCU’s Office of Research and Innovation and Environmental Health and Safety support various research projects with security concerns. This policy and the associated compliance notices are designed to address the safety and reputational issues associated with these projects.
- VCU International Employee/Visitor Export Control Review Form
- Visiting Nonemployee Scholar Agreement
- TMP Exception Form
- Sponsored Project/Research Volunteer Documentation Form
This policy supersedes the following archived policies:
Approval/Revision Date Title
December 04, 2014 Compliance with United States Export Control Laws
What is an export?
An export is an actual shipment or transmission out of the United States of items, services, or technical data subject to either the EAR or the ITAR, or a release of technology, software, or technical data subject to either EAR or ITAR to a foreign person in the United States. Technology, software, or technical data could be "released" as an export through any of the following:
Visual inspection by foreign person of U.S. origin equipment and facilities
Oral exchanges of information in the United States or abroad
Transfer or shipment via any means (physical or electronic) to a foreign entity
Providing a service, or the application to situations abroad of personal knowledge or technical experience acquired in the United States
How do I know if Export Controls apply to my grant/contract?
The Export Compliance Office assesses the potential for export control applicability to grants and contracts at the time of award. If concerns arise, the principal investigator will be contacted prior to acceptance of the award. If a sponsor raises the issue of export controls during the conduct of a project, contact the Export Compliance Office immediately.
What is involved in obtaining an export license?
A request must be submitted to the Department of Commerce for EAR-controlled items or the Department of State for ITAR-controlled items. Export licenses can take up to three to six months for review before a final determination is made. A request for an export license must be coordinated through the Office of the Vice President for Research, Export Compliance Office.
Why should I be concerned about an export?
Access to restricted or export controlled technology, commodities, defense articles, and defense services by an unauthorized foreign person could result in severe criminal or civil penalties for the university and the university employee making the export. Prosecution of an export violation may result in fines of up to $1M and/or a prison sentence of up to 20 years.
What is a "Deemed" Export?
Release of technology or source code subject to the EAR to a foreign person in the United States is "deemed" to be an export to the home country of the foreign person.
What is a laboratory security risk?
Providing a secure location for the storage, use and disposal of hazardous materials protects authorized users and the community. In some cases enhanced security is mandated by regulations and/or permits and licenses that VCU holds. Particular concerns include DEA regulated drugs and precursors, DHS Chemicals of Interest (COI), CDC/NIH select agents, dual use research of concern materials or technologies, sealed radioactive sources on the NRC theft control and diversion program list or other materials of concern. All labs should have basic locks and key control but additional security, monitoring and response procedures will be outlined in compliance notices associated with this policy.