Export Controls and Electronic Devices in International Travel

Guidance for Yale Faculty, Students and Staff on taking Laptops, Cell Phones, Global Positioning Systems (GPS), i-Pads and other Electronic Devices Outside the United States

Summary

  • Traveling outside the US with a Yale-owned laptop with standard software will probably not need an export license provided the equipment is always under your control and returns to the US within a year. If you are travelling to Iran, Cuba, North Korea, Syria, please check with the export controls office.
  • Most computer hardware is not subject to tight restrictions, as long as the hardware returns to the US. There are restrictions on “high performance” computers.
  • Most commercial and public domain software is OK to take out of the country. There are significant restrictions on encryption software. Non-commercial encryption software in source code or object code is likely to be restricted.
  • If you are working on a project that involves export-controlled technologies, your device may contain controlled technical data that cannot be shared with foreign parties without a license. There also may be concerns with other Confidential information, HIPAA, financial information. Recommended that any such data not be taken outside the US.
  • If the computer or other equipment is owned by Yale, the University of Colorado, the equipment may qualify for this exception, the equipment may be covered by the TMP exception: must be a “tool of the trade”, remain under your “effective control” while overseas. This means that it must remain in your personal possession or in a locked hotel safe (a locked hotel room is not sufficient) at all times, must be returned to the US (or destroyed) within 12 months, may not be taken to embargoed countries.
  • Do not take any equipment / software specifically designed or modified for military or space applications.

Yale faculty, staff and students commonly bring their laptops, cell phones, i-Pads and other electronic devices loaded with information and software (“Devices”) with them not only across campus, but also to other countries. Although taking Devices to international destinations or shipping them ahead seems routine, individuals doing so may be “exporting” the Device for purposes of the U.S. export control laws and regulations. Such “exports” may require a license from the U.S. government. Export here is defined as an actual shipment or transmission of items subject to export controls out of the United States, or release of technology or software subject to export controls to a foreign national in the United States. Release of export-controlled technology and source code can also occur through transmission via e-mails, faxes, designs, and verbal correspondence.

Not only is the Device or its underlying technology subject to export control regulations, but also any data, confidential information or software (particularly encryption software contained in such a Device) may also be subject to export control regulations. Custom agents, both domestic and foreign, are authorized to seize travelers’ Devices or to require the right to review their contents.

Most international travel with Devices (or the shipment of Devices) will not require a license. Yale travelers should be familiar with the applicable export control regulations, however, and strive to comply, because violations can result in the imposition of criminal sanctions and heavy civil penalties. The Director, Export Control Licensing in the Office of Research Administration, is available (in consultation with the Office of General Counsel) to assist Yale travelers in ascertaining compliance requirements. His contact information is provided below.

The licensing requirements can be summarized generally as follows:

Travelers will most likely not need a license to take or ship any Device outside the United States if all of the following apply:

  • If the Device is a standard, off-the-shelf product widely available to the public.
  • All data and information stored
  • Travel is not to a country subject to export control embargoes: Cuba, Iran, Syria, Sudan or North Korea.

Travelers are likely to require an export license to bring a Device outside the United States if:

  • The Device holds encryption software, either commercially available or research- generated;
  • The Device contains unpublished data or other information relating to items or materials on one of the technology control lists established by the U.S. government (An example of such information would be blueprints of laboratory equipment that could be used to create toxic materials.). Note that the need for an export license would probably not apply to data and information which resulted from fundamental research: basic and applied research typically associated with academia where the resulting information is ordinarily published and shared broadly in the scientific community;
  • The Device is designed for use or application with technologies associated with satellites, spacecraft or technologies with a military use, or the Device contains information or software designed for use or application with such technologies; or
  • The Device could be used in the development of weapons of mass destruction.

Travelers should not take or ship any Device outside of the United States without review and approval by the ECO if any of the following apply as a license will most likely be required:

  • The travel or shipment is to Cuba, Iran, Syria, Sudan or North Korea.
  • The Device is an ITAR-Controlled article, software or technical data. ITAR controlled articles, software and technical data are directly related to military uses, satellites or spacecraft.

One important exception to the need for a license is the “Tools of Trade” license exception. This would apply when ALL of the following apply to a Device:

  • Hand-carried with the individual while traveling,
  • Carried in the luggage or baggage that travels with the individual, and
  • Shipped no more than thirty days prior to the individual’s departure or may be shipped to the individual at any time while the individual is outside the country.

Generally, so long as the Traveler retains his or her Device under his / her personal custody and effective control for the duration of travel; (2) does not intend to keep these items outside the U.S. for longer than 1 year; and (3) the individual is not traveling to an embargoed country, no government export license is required. Note that this license exception is not available for equipment, components, or software designed for use in/by/with most satellites or spacecraft. “Effective control” means retaining physical possession of an item or maintaining it in a secure environment.

In addition to becoming familiar with applicable export control requirements, Yale travelers should note that any international travel with a Device may result in the disclosure of personal information installed on the Device. In some countries, custom officials may examine information contained in Devices or seize Devices. Instances of laptop seizures have been widely reported in the press. Travel in and out of the U.S. is no exception: Homeland Security personnel may inspect information contained in a traveler’s Device, or seize the Device. Searches conducted at the United States border or the equivalent (such as an international airport) may be completed without probable cause or a warrant. Yale travelers should therefore consider carefully which Devices, bearing what information; they wish to bring with them on international trips.

Some Common-Sense Suggestions Before Traveling with Your Laptop

  • Back up your data and leave a copy of your files in a safe and secure location such as your office or a departmental shared drive. Don’t carry the only copy of data you can’t afford to lose.
  • For encryption software that you have purchased for use with your Device, please contact the Director, Export Controls for further guidance. For encryption software you have developed in your Yale research, in almost all cases, such software should not be subject to export control regulations due to the Fundamental Research Exclusion. However, to be on the safe side, make any such software available on a publicly available website as soon as feasible.
  • Don’t carry data you don’t want others to see: medical records, data files from your research, financial information, etc.
  • Password-protect, encrypt (if allowed) or remove all personal and proprietary information stored on your laptop.
  • Ensure that your operating system has a strong password or passphrase when it boots up.
  • Ensure that anti-virus, anti-spyware, and personal firewall software is installed on your laptop.
  • Limit use of public terminals or public computers.
  • Avoid provocative media or documents.
  • Use secure VPN for secure remote access
  • When possible, bring a clean, “scrubbed” device provided by your department.
  • Set up a temporary email account for each trip and connect that email account to the devices.