/us-export-expert

name: us-export-expert
description: US Export Controls expert covering ITAR and EAR. Provides comprehensive guidance on defense articles (USML), dual-use commercial items (CCL), jurisdiction determination, FIPS encryption, denied party screening, and cloud compliance strategies.
allowed-tools: Read, Glob, Grep, Write

US Export Controls Expert

> **Engineering guidance only. Not legal advice.** Export-control determinations come from DDTC (ITAR) and BIS (EAR), not from this toolkit. The claims below are starting points for security engineers working with export-control counsel, not compliance positions to adopt as-is. Citations to read alongside this material: [22 CFR 120.54](https://www.ecfr.gov/current/title-22/chapter-I/subchapter-M/part-120) (the ITAR encrypted-technical-data carve-out: access to properly-keyed, end-to-end-encrypted technical data is not automatically a release), [22 CFR 122.5](https://www.ecfr.gov/current/title-22/chapter-I/subchapter-M/part-122) (ITAR recordkeeping, scoped to specific record categories), [15 CFR 734.6](https://www.ecfr.gov/current/title-15/section-734.6) (BIS is the licensing authority on EAR), [15 CFR 746.8](https://www.ecfr.gov/current/title-15/section-746.8) (Russia and Belarus sanctions). The [BIS country guidance](https://www.bis.doc.gov/index.php/policy-guidance/country-guidance) is the live sanctions list; it moves and this file will lag.

Deep expertise in both ITAR (International Traffic in Arms Regulations) and EAR (Export Administration Regulations) for US export control compliance.

Expertise Areas

Dual Framework Overview

**ITAR (International Traffic in Arms Regulations)**:

• **Authority**: US Department of State, Directorate of Defense Trade Controls (DDTC)
• **Scope**: Defense articles, services, and technical data on the US Munitions List (USML)
• **Registration**: Required ($3,000/year)
• **Key posture (simplified)**: access restricted to US persons; technical data stored in US-located systems by default. The 22 CFR 120.54 encrypted-technical-data carve-out means "US-only storage" isn't an absolute rule for properly-encrypted data, so deployment patterns vary. Validate with counsel for your USML category.

**EAR (Export Administration Regulations)**:

• **Authority**: US Department of Commerce, Bureau of Industry and Security (BIS)
• **Scope**: Dual-use commercial items on the Commerce Control List (CCL)
• **Registration**: Not required (except encryption items)
• **Key posture (simplified)**: denied-party screening and sanctions-driven access controls. Under 15 CFR 734.6, BIS (not this toolkit) determines what licensing applies to any given item; specific-country rules live in 15 CFR 746 and shift regularly (Russia and Belarus under 746.8, Crimea/DNR/LNR under 746.6, etc.).

ITAR Framework (7 Controls)

ITAR-1: US Person Verification

**Requirement**: Only "US persons" may access ITAR-controlled technical data. [22 CFR 120.62](https://www.ecfr.gov/current/title-22/chapter-I/subchapter-M/part-120/subpart-C/section-120.62) defines that term broader than "citizens or green-card holders." It covers:

• US citizens (by birth or naturalization)
• Lawful permanent residents (green-card holders)
• "Protected individuals" under [8 USC 1324b(a)(3)](https://www.law.cornell.edu/uscode/text/8/1324b) (certain refugees, asylees, and specific visa holders)
• US-incorporated entities and US governmental agencies (for entity-level access)

Access policies that say "citizens or LPRs only" over-restrict and can create avoidable HR and employment-law exposure. Use the full 120.62 definition; work with HR and counsel on how you verify each category.

**Implementation**:

• Verify US-person status using documentation appropriate to the 120.62 category (I-9 covers employment eligibility, not ITAR 120.62 scope by itself)
• Tag IAM users with US-person status
• Implement RBAC limiting access to US persons
• Re-verify periodically; document the method for each 120.62 category

**Cloud Verification**:

# AWS: Tag users with citizenship
aws iam tag-user --user-name john.smith --tags Key=Citizenship,Value=US

# List all users for verification
aws iam list-users --query 'Users[*].UserName'

**Common Gaps**:

• Foreign nationals with admin access
• Contractors without citizenship verification
• Shared accounts without individual attribution

ITAR-2: Data-Residency Posture (US-Located by Default)

**Posture summary**: ITAR technical data is stored in US-located systems by default. 22 CFR 120.54 carves out end-to-end-encrypted technical data from the release definition, so there are deployment patterns where non-US storage of encrypted data is defensible. Defaulting to US-located regions is the simplest posture; confirm with counsel before relying on the encryption carve-out or any cloud-provider attestation.

**Approved Regions**:

• **AWS GovCloud**: us-gov-west-1, us-gov-east-1 (highly recommended)
• **AWS Commercial**: us-east-1, us-east-2, us-west-1, us-west-2 (with controls)
• **Azure Government**: usgovvirginia, usgovtexas, usgovarizona (highly recommended)
• **GCP Assured Workloads**: us-central1, us-east4, us-west1 (with ITAR configuration)

**Prohibited**:

• Any non-US region (eu-west-1, ap-southeast-1, etc.)
• Cross-border replication or backup
• Edge caching outside US (CloudFront with EU edge)

**Verification**:

# AWS: Check S3 bucket locations
for bucket in $(aws s3api list-buckets --query 'Buckets[*].Name' --output text); do
  location=$(aws s3api get-bucket-location --bucket "$bucket" --query 'LocationConstraint' --output text)
  echo "$bucket: $location"
done

ITAR-3: Encryption Requirements

**Requirement**: FIPS 140-2 validated encryption for all ITAR data

**Standards**:

• **FIPS 140-2 Level 2+** (Level 3 for TOP SECRET)
• Customer-managed encryption keys (CMEK) recommended
• Hardware Security Modules (HSMs) required

**Cloud Solutions**:

• **AWS KMS**: FIPS 140-2 Level 2 valida