Export Control Compliance

The Export Control Compliance Program at WVSOM is designed to support WVSOM faculty, staff, students and other affiliates with ensuring compliance with Federal export control laws and regulations.  These include the International Traffic in Arms Regulations (ITAR), the Export Administration Regulations (EAR) and the Office of Foreign Assests Controls (OFAC).  These laws apply to both work internationally ("exports") and work with international collaborators within the United States ("deemed exports"). 

It is important to understand that export control laws may apply to any shipment, transmission or transfer physical items, information, or technology (e.g. software) outside of the United States.  Depending on the type of these items or technology, the U.S. Government may require an export license prior to sharing the item or information with other countries or foreign nationals within the U.S. 

Though WVSOM is primarily an educational institution and many of its activities fall under a Fundamental Research Exclusion to licensing requirements, WVSOM is committed to ensuring compliance with the Federal Export Control Laws.  The following areas provide more information on how to ensure individual compliance with Federal Export Laws, and WVSOM's policies and procedures related to such activities.

Statement of commitment to the Export Controls Act by Dr. Linda Boyd Vice President for Academic Affairs and Dean

WVSOM Export Control Policy and Procedure

• R-07
• Procedures Manual

Generally, WVSOM activities are excluded from Export Control Laws through a Fundamental Research Exclusion (see below).  However, to ensure this is the case, all WVSOM personnel (staff and students) are required to submit an International Collaboration form to the Export Control office anytime they:

• plan on traveling internationally for school purposes,
• plan on traveling for personal reasons (e.g. vacation) with school property or resources (e.g. your school laptop or email), or
• plan on collaborating with a foreign national (even within the United States).

This form will be reviewed and further guidance provided.  Please ensure this form is submitted at least 30 days in advance, and if you suspect you need to apply for an export license, at least 90 days in advance.  Additionally, when traveling with electronic devices, certain forms will be required (see below).

Federal Regulations

The Export Control Laws are spread throughout various Federal Agencies.  The main three are:

• Office of Foreign Assets Controls (OFAC), which include sanctioning programs on countries and foreign individuals
• Bureau of Industry and Security (BIS), which governs the Export Administration Regulations (EAR).  The EAR regulate mainly civilian dual-use items, software and technology.
• Directorate of Defense Trade Controls (DDTC), which governs the International Traffic in Arms Regulations (ITAR).  The ITAR regulate mainly military or defense articles, including technical data.

There are other departments that oversee the execution of regulations related to Export, but the three listed above are the most commonly encountered applicable regulations related to Institutions of Higher Education.

Fundamental Research Exclusion

Sharing information while abroad, or with foreign nationals within the US, may be excluded from export control laws if it is covered by a "Fundamental Research" exclusion.  Fundamental research is basic or applied scientific or engineering research, the results of which are normally published and shared broadly within the scientific community.  This is in contrast to proprietary research by (or funded by) an industry.  A key difference is that the industry or sponsor restricts the publication or dissemination of the results.  Fundamental research is an important component of academic freedom and most of the research conducted at WVSOM falls within the Fundamental Research Exclusion related to Export Control Laws.  No license is needed to share the results of Fundamental Research, though the sharing of goods/items made through such research IS regulated by Export Control Laws.

The Fundamental Research Exclusion is not valid if the work is conducted through an agreement that:

• forbids the participation of foreign nationals,
• provides the sponsor the right to approve/disapprove publications prior to submission, or
• restricts participation in research or access or disclosure of the results.

Make sure you know what you have agreed to when you accept an agreement, written or otherwise.  The WVSOM Sponsored Programs group may help you navigate such agreements.

Traveling with electronic devices for work purposes

When you leave the United States, you should understand your obligations under export control regulations.  If you travel with electronic devices, access data remotely, or utilize encryption software, your activities may be subject to export control laws.  Keep in mind that U.S. Customs officials are authorized to review the contents of computers, laptops, or tablets without probable cause.  Thus, you should ensure you know what you have on the electronic device.  

Electronic devices exported for work purposes are often able to be temporarily exported under a "Temporary exports-Tools of the Trade" (TMP) exception.  This exception is allowable if:

• The item(s) are being used for professional purposes,
• The item(s) will be returned to the US within 12 months,
• The item(s) are kept under the individual's "effective control" while abroad,
• Appropriate security precautions are used to prevent unauthorized release of technology, and
• The individual does NOT travel to Iran, North Korea, or, Syria. There are additional embargoed countries, depending on the item.
• The individual does NOT plan any connecting flights or stop-overs to the above countries.

WVSOM may permit you to borrow a laptop that the Information Technology Department has prepared for temporary export.  When you have completed the International Collaboration form, you may also be asked to complete a TMP exception and borrow a WVSOM laptop.

Traveling with electronic devices for non-work purposes

When you leave the United States, you should understand your obligations under export control regulations.  If you travel with electronic devices, access data remotely, or utilize encryption software, your activities may be subject to export control laws.  Keep in mind that U.S. Customs officials are authorized to review the contents of computers, laptops, or tablets without probable cause.  Thus, you should ensure you know what you have on the electronic device.

Personal electronic devices (and other items) exported for personal use are often able to be temporarily exported under a "baggage license" (BAG) exception.  This exception is allowable if:

• The item(s) are being used for personal purposes,
• The item(s) will be returned to the US,
• The item(s) will not be shipped as unaccompanied baggage,
• The item(s) are kept under the individual's "effective control" while abroad,
• Appropriate security precautions are used to prevent unauthorized release of technology, and
• The individual does NOT travel to Iran, North Korea, or, Syria. There are additional embargoed countries, depending on the item.
• The individual does NOT plan any connecting flights or stop-overs to the above countries.

It is recommended you complete and carry with you a BAG form when traveling internationally.

Technology Guidance Export Control and International Loaner Laptop

Technology Guidance for TMP WVSOM Travel

• DO NOT take WVSOM assigned devices when traveling internationally.  You must request a loaner laptop from the Information Technology Department AFTER the approval of your TMP exception form from the ECM.  This loaner device has been prepared for international travel, including the removal of local applications and encryption technology.  Microphones and cameras are intentionally disconnected.
• Only access the WVSOM O365 email and Office resources (Word, Excel, OneDrive) from the Google Chrome web browser on the international loaner laptop.  With some exceptions, under tools of the trade and the specific research being done with unrestricted data, the IT Department may install local applications.  NEVER download sensitive data (PII, HIPAA, FERPA) from the cloud to the loaner device or personal devices.
• DUO multi-factor authentication to O365 is encryption technology that is subject to export control.  For this reason, you must generate 10 passcodes through your DUO mobile app BEFORE leaving the U.S to access O365 while traveling.
• Other WVSOM cloud applications (e.g. Exam or LMS applications) should only be accessed while connected through the international VDI environment.  No restricted data will be accessible for download to USB drives or local device storage.  Please refer to the IT Department’s data categorization.
• The device should NEVER be out of your physical custody “effective control”.  It should remain with you at ALL times and be transported in carry-on luggage.
• Do not use public battery USB-based charging stations.  These stations can copy data from your device and install malicious malware code on to the device.  Only use the charger supplied with the WVSOM international loaner computer.
• Upon return the international loaner laptop will be fully inspected for compromise and sanitized.
• If the laptop is lost or stolen, the traveler MUST report it to the IT Department immediately at 304-647-6246.  Steps will then be taken to locate and wipe the device.
• Microphones and cameras should be intentionally disconnected.
• Disable Wi-Fi, Bluetooth and infrared when not in use.
• The device should NEVER be out of your physical custody “effective control”.  It should remain with you at ALL times and be transported in carry-on luggage.
• Special security precautions are used to prevent unauthorized release of technology under BAG, only if the individual is NOT traveling to Iran, North Korea, Syria or other embargoed countries, with no plans of connecting flights or stop-overs in these countries.
• Smartphones, mobile devices, USB and external drives should be encrypted IF allowed by your destination country, and should be password, passcode and/or biometric protected (fingerprint or facial recognition).  Passwords should be changed before your travel and again when returning.
• Remove all sensitive data from your device before traveling and ensure that the device has up-to-date antivirus, spyware, OS security patch protection with a personal firewall.
• Do not use public battery USB-based charging stations.  These stations can copy data from your device and install malicious malware code on to the device.  Only use chargers that you have brought from the U.S. and you are confident are safe.
• If possible, remove batteries when the device is not in use.
• Avoid Wi-Fi networks if you can, they are NOT secure.
• Do not insert removable media, open email attachments, click links or scan QR codes.  DO NOT bring these devices back to the U.S. when returning.
• RFID-enabled devices, including magnetic or smart-chip items such as debit/credit cards, should be carried in an RFID-shielded sleeve to prevent invasive scanning.

Technology Guidance for BAG non-work travel:

• Take the BAG exception with you as you travel with personal electronics.
• Best practice for personal non-work-related travel is to purchase a pre-paid phone or inexpensive laptop and to communicate through a temporary email account such as Google Gmail.
• Laptops/tablets or mobile devices should not have been altered in any way from their original manufactured condition.
• Do not download email to your local devices.
• Only access email through the web.
• Do not access email from local applications on your cell phone or tablet.
• WVSOM work-related cloud resources with sensitive data SHOULD NOT be connected to.
• The only safe connections to WVSOM email should be through a web-browser.  If a BAG exception has not been completed and communicated to the IT Department, the default O365 connectivity will NOT be available internationally for WVSOM email and Office applications.
• DUO multi-factor authentication to O365 is encryption technology that is subject to export control.  For this reason, you must generate 10 passcodes through your DUO mobile app BEFORE leaving the U.S to access O365 while traveling.
• WVSOM related software (DUO, Outlook, WebEx, Teams) must be removed from personal devices when traveling internationally.

WVSOM may provide a loaner laptop for international travel. This computer has a standard image and software. It has intentionally not been encrypted. To adhere to WVSOM institutional policy R-07 regarding compliance for US export control laws and regulations no personally identifiable information (PII), HIPAA, or FERPA data should be stored on this device. As part of the international travel the individual receiving this loaner laptop should have already consulted with the WVSOM Office of Research and Sponsored Programs (ORSP). The recipient of this loaner device will follow the protocol below:The device is provided without encryption technology and should not be encrypted.

• No alterations will be made to the hardware or software related to this device.
• During international travel, the device should NEVER be out of your physical custody.
• Remove all sensitive data (PII, HIPAA, FERPA) on all devices while traveling (WVSOM loaner laptop, smartphones, mobile devices).
• While the WVSOM loaner laptop is not encrypted, smartphones, mobile devices, USB and external drives should be encrypted (if allowed by your destination country) and should be password, passcode and/or biometric protected (fingerprint or facial recognition).
• All electronic devices, WVSOM loaner laptop and personal, should remain with you at ALL times and should be transported in carry-on luggage.
• WVSOM loaner laptops are provisioned with geolocation and can be remotely wiped if lost or stolen. If the laptop is lost or stolen, the traveler is to contact the WVSOM Information Technology Department IMMEDIATELY at 304-647-6246. Steps will then be taken to locate and wipe the device.
• Upon return the WVSOM loaner laptop will be fully inspected for compromise and sanitized.

Special considerations if traveling to China or Russia

• Travelers from the United States to Russia and China are targets for cyber-attack and surveillance. Particularly those in institutional administration, faculty participating in political and/or religious activism and those fluent in the local language.
• If the traveler has need for internet access, best practice is to purchase a pre-paid phone and inexpensive laptop.
• While in these countries, assume ALL your communications are being intercepted (voice calls, text messages, HTTPS internet, and connections via VPN service)
• WVSOM integrated laptop microphones and cameras will be intentionally disconnected. If traveling with a personnel laptop, the same is recommended.
• Please be sure to disable all file sharing.
• When not in use, disable Wi-Fi, Bluetooth and infrared.
• Setup a temporary email account for your travels with services like Google Gmail. Do not use this account to receive or send any sensitive or proprietary information. This account should be removed once you return from international travel.
• Censorship circumvention tools such as Tor should be considered compromised. Use of these tools in these countries can be monitored. If used, the traveler may be expelled or punished by the country.
• Discarded items (i.e. USB drives, paper documentation, CD/DVDs) can be retrieved from trash for analysis.
• USB drives, CD/DVDs, external drives, email attachments, shortened URLs, QR codes are to be considered hostile. DO NOT insert removable media, open attachments, click links, or scan QR codes on the loaner computer within China or Russia. DO NOT bring these devices back to the United States when returning.
• RFID-enabled should be carried in an RF-shielded sleeve to prevent invasive scanning.
• Remember that powered off cell phones can still be used for geolocation and monitoring.

Embargoed Countries

The Office of Foreign Assets Control, a division of the Treasury Department, maintains a list of embargoed countries and persons on sanctions lists.  As part of knowing you who are working with, and whether any sanctions exists related to your country of travel, you can access OFAC's lists at the link below.

Sanctions Programs and Country Information

Forms

• International Collaboration form for WVSOM activities
  • Be sure to provide specific information about the activities and items you will be taking.
  • Include your dates of travel
  • Include specific make and model of any electronics or other technology
• TMP License Exception Form
• Bag Exemption form

Contacts

export@osteo.wvsom.edu