Management Commitment
URI endorses the principles of open exchange of ideas and academic freedom and encourages collaborations with other researchers throughout the world. Nevertheless, URI faculty, staff and students must abide by all U.S. export compliance laws and regulations established to protect national security.
URI’s Vice President for Research and Economic Development (VPR) is responsible for ensuring URI’s compliance with U.S. export control laws and regulations. The Director of Research Security is designated as the “Empowered Official” and Export Control Officer (ECO) who will serve as the primary point of contact for URI faculty and staff on export control issues and will have responsibility for managing the day-to-day implementation of URI’s export control program.
Export Control Policy
Regulations
Export control regulations include the EAR administered by the Department of Commerce covering most commercial and dual-use technologies, the ITAR covering most military technologies administered by the Department of State and OFAC regulations administered by the Department of Treasury.
Penalties
Violations of export control laws have serious consequences for both the individual and URI. The penalties vary depending on the circumstances (whether it was a “knowing” or “willful” violation), but the penalties for even lesser violations can include jail time and/or fines for the individual and/or URI.
EAR
-
- Criminal: $50 thousand-$1 million or five times the value of export, whichever is greater, per violation, up to 10 years in prison.
- Civil: loss of export privileges, fines $10 thousand-$120 thousand per violation
ITAR
-
- Criminal: up to $1 million per violation and up to 10 years in prison
- Civil: seizure and forfeiture of articles, revocation of exporting privileges, fines of up to $500 thousand per violation.
OFAC
-
- Criminal: Up to $1 million and 10 years in prison
- Civil: $12 thousand-$55 thousand per instance
Exemptions from Export Controls
The most important exemption from export controls regulations for researchers is the Fundamental Research Exclusion (FRE). This principle states that research to be published or publicly disseminated is exempt from export control regulations. Educational materials for established courses identified in a university catalog are similarly exempt from export controls, therefore most undergraduate and many graduate courses are exempt from export control regulations.
Export Controlled Projects/Technology Control Plans (TCPs)
Certain URI research programs sponsored by U.S. government agencies are subject to strict export controls including controlled research sponsored by the Department of Defense (DoD). Export compliance concerns may arise if there are inadequate physical controls on laboratory security as well as inadequate controls on access to and/or use of research data. TCPs are therefore required to safeguard any controlled unclassified information (CUI). Faculty and research staff must Contact URI’s ECO or FSO for assistance in completing and for approval of a TCP. Training is mandatory for all CUI research projects. https://securityawareness.usalearning.gov/cui/index.html Federal regulations mandate that CUI data must be protected pursuant to the controls found in the CMMC/NIST SP 800-171 and all researchers must use URI’s secured research infrastructure (Sherlock) or storage devices meeting approved encryption standards (currently FIPS 140-2). For assistance contact URI’s Sr. Technical Programmer (IT Security Services) Adam_Richards@uri.edu
Certain URI research programs sponsored by industry sponsors can also be subject to strict export controls. Examples inlcude but are not limited to: Projects with restrictions on release of information (NDAs); Projects involving CUI or CTI; Projects utilizing official use only information (FUO); and projects with publication restrictions or proprietary information are most likely subject to export controls. Faculty and research staff with these restrictions must also contact URI’s ECO or FSO for assistance in completing and for approval of a TCP..
Laboratory equipment may be subject to export controls if identified by the manufacturer or vendor. In all such cases, a TCP is needed to outline export compliance requirements. Contact URI’s ECO or FSO for assistance with a TCP.
NSF and NIH have indicated that failure to disclose foreign relationships and activities may jeopardize project funding and potentially cause ineligibility for future funding for a URI Researcher and/or URI. It is important for researchers and scholars to disclose their international relationships to determine if there are any export controls restrictions, potential conflicts of commitment or interest, duplications of research, and/or diversion or disclosure of intellectual property or confidential information in the performance of their research. Faculty and research staff should contact URI’s Office of Sponsored Research for assistance disclosing any foreign relationship. For assistance URI’s Associate Director of Pre-Awards khayden@uri.edu.
Training
Export control training is mandatory for all export-controlled projects using the Collaborative Institutional Training Initiative (CITI). See https://about.citiprogram.org/en/series/export-compliance-ec/ for more information.
As noted above, CUI Training offered by the DoD DCSA can be found here: https://securityawareness.usalearning.gov/cui/index.html
Audit Certification
All URI lead Researchers are required to certify to the following:
I am the Lead Researcher for this research project and that all information in this TCP is complete and accurate to the best of my knowledge.
URI’s FSO has approved the participation of each individual listed as authorized to participate on my research project.
I will notify my FSO of any changes including new or removed individual participants, changes in information storage or transmission systems and changes in equipment.
I will review and make all necessary revisions to this TCP every six months and will immediately notify URI’s FSO or ECO if I become aware of any actual or potential violations of this TCP and/or I become aware of any Export Control violations.
I must keep a copy of my TCP on file for five years after the termination of this project.
Deviations from the requirements listed in my TCP must be reported to and approved by URI’s FSO or ECO prior to any changes.