Last Friday, the State Department’s Directorate of Defense Trade Controls (“DDTC”) issued a Notice of a Proposed Rule that would eliminate the requirement for DDTC approval before a foreign licensee could transfer technical data about a licensed defense article to an employee not of the same nationality as the licensee. The notice indicated the following as the reason for the change:

The current requirement for the provision of additional information within a license to cover dual national and third-country national foreign employees has created a tremendous administrative burden on approved end-users and has evolved into a human rights issue, which has become a focus of contention between the U.S. and allies and friends without a commensurate gain in national security.

The proposed rule would add a new section 126.18 to the International Traffic in Arms Regulations that would create a new exemption for intracompany transfers of technical data to employees with dual nationality or third-country nationality other than the nationality of the licensee. The transfer must take place completely within the country in which the licensee is located. Also, in order to prevent diversion of technical data transferred to third-country and dual nationals, the licensee must either require a local security clearance for such employees or must have in place a requirement that the employee sign a Non Disclosure Agreement and be subject to proper due diligence to assure that there is no risk of diversion.

The human rights concern addressed obliquely by DDTC in its justification for the rule (and more directly by me in title of this post) relates to employees who are third-country or dual nationals of a country embargoed under section 126.1 of the ITAR. Even if an employee of the licensee was a naturalized citizen of the licensee’s country, DDTC still considers that employee to be a national of the employee’s original country of citizenship. So if the employee was originally a Chinese citizen by virtue of his birth to Chinese parents, he would be considered a Chinese national even after he became a citizen of, say, the United Kingdom and would be prohibited from receiving controlled technical data because of the arms embargo imposed on China under section 126.1. Most countries, including the United States, make discrimination based solely on national origin illegal.

There had been some thought that DDTC would adopt a rule similar to that used by the Bureau of Industry and Security (“BIS”) to determine nationality for purposes of the deemed export rules, but that did not happen. BIS looks at the latest citizenship of the employee so the employee in the example above would be considered a British citizen and not a Chinese national. Although DDTC altered its rules for these intracompany transfers, the rules relating to transfers to individuals that aren’t employees, such as contractors and sublicensees, remain in place and would continue to require an inquiry to insure that the transferee wasn’t born in an embargoed country or born to parents from an embargoed country where such birth would make the employee a citizen of the embargoed country. (Approved transfers to corporate sublicensees, however, would presumably allow the use of this exemption by the sublicensee with respect to its individual employees.)

And although the rule is certainly a welcome change, it is not without its own problems. The Notice describes the due diligence obligations of licensees as follows:

The end-user or consignee must screen its employees for substantive contacts with restricted or prohibited countries listed in § 126.1. Substantive contacts include, but are not limited to, recent or regular travel to such countries, recent or continuing contact with agents and nationals of such countries, continued allegiance to such countries, or acts otherwise indicating a risk of diversion. Though nationality does not, in and of itself, prohibit access to defense articles or defense services, an employee that has substantive contacts with persons from countries listed in § 126.1(a) shall be presumed to raise a risk of diversion, unless DDTC determines otherwise.

In other words if the employee in my example went home to visit his parents in China, he could be deemed to be no longer eligible to receive controlled technical data. Actually it might be enough if the employee simply called his parents frequently in China. Without substantive guidance from DDTC on how far the employer must go in determining the extent to which the employee has renounced substantive contact with his parents in China, the licensees natural inclination would be to exclude this employee from receiving technical data in the first place. And then we are right back at the place we started.