Export controls for technology aim to prevent transfers that can lead to developing or producing weapons or goods which:
could be used against theUKand allied forces
cause national security concerns
The controls aim to do this without inhibiting:
Any transfer, permanent or temporary, of controlled technology overseas requires an export licence. This applies to a variety of circumstances. It includes for the purposes of demonstration, bidding or tendering for an overseas contract through to contract fulfilment and training material for maintenance and servicing.
The location of the exporter is the country from which they are transferring controlled technology, or the location of a person who makes available controlled technology being accessed from overseas. The destination of transfers of technology is dependent upon the location of the intended recipient. For export control, the routing or storage of the controlled technology does not determine the destination.
All foreign orUKpersons based in theUKneed a licence if they wish to transfer controlled technology overseas which they have created or acquired in theUK, or brought in to theUKfrom overseas. This is irrespective of the origin of the technology, for example US origin.
Export licences are not required to transfer controlled technology in the following instances, regardless of nationality of the recipient:
transfers within theUKunless the technology is for weapons of mass destruction (WMD) end-use outside theUK.
Within export control legislation ‘technology’ is a defined term. Quotation marks denote this and other defined terms in the export control lists. You can find complete list of defined terms in theUKstrategic export control lists.
Most technology controls apply to information that is necessary for the development, production or use of controlled goods. Some technology controls apply to specific information as described in the lists. This information may take many forms, including:
engineering designs and specifications
manuals and instructions
Certain technology may also be subject to end-use controls if it is in relation to:
certain arms embargoes
unauthorised military exports
In the case of technology related toWMD, here the definition of technology is very broad.
In certain cases a transfer of technology is exempt from licensing. For example where it relates to the use of goods for a which a licence was previously granted. The scope of control is further limited by a general technology note and nuclear technology note in the(retained)EUDual-Use Regulation.
Technology controls related to nuclear goods have a broader scope as the term ‘required’ does not apply. The minimum necessary information for patent applications remains controlled.
Technology transfer: scope
The tangible transfer of technology can be in many forms. This includes information either written on physical documents or recorded on other media, such as:
USB flash drives
portable hard drives
Technology can also be transferred in an intangible form by using electronic media, such as email.
Export licences are required irrespective whether or not the controlled technology is transferred in an encrypted form.
Transfer by phone or video-conferencing
Export controls apply where the technology is contained in a document and transmitted by audio or video-conferencing means.
This applies when the relevant part of that document is:
described in such a way as to achieve substantially the same result as if it had been read out
A licence is also required where presentations display controlled technology and are viewed by overseas audiences. This may include screensharing to individuals or a wider audience.
Prior to any call, conference or presentation you should establish whether or not controlled technology will be divulged by any participant. If so, the location of each intended recipient (at the time of the call) will need to be known to ensure the appropriate licence can be used and records maintained of the transfer.
Licences will also be required where recordings of presentations containing controlled technology are viewed by overseas audiences.
Other overseas based colleagues will also need to determine if the call or conference material would be subject to their local export or re-export control requirements.
Transfer by email
Emails containing controlled technology, either in the body of the message or as an attachment, require an export licence based on the transfer to the known location of the overseas intended recipient. This means you have a responsibility to find out where someone is in the world before sending an email containing controlled information.
Sending overseas any images of controlled technology contained in documents or papers would require a licence.
Companies using automatic forwarding to addresses overseas should consider mechanisms to prevent inadvertent transfers of controlled technology.
Examples include where an email:
is diverted to a colleague overseas in the absence of the intended recipient
containing an attachment of controlled technology is diverted for manual malware checking as a result of virus scanning
You must take appropriate actions to ensure the information in an email is suitably protected. This guards against unintended access to technology should it be redirected overseas.
Transfer using laptops, phones and memory devices
If a laptop, phone or a memory device with stored controlled technology is taken overseas by any individuals this is a transfer and a licence will be required.
This also applies to visitors from overseas importing or downloading export controlled material in to theUKand subsequently travelling overseas with devices containing the controlled technology. Visitors may need someone else to apply for a licence on their behalf.
Transfers within multinational companies
Multinational companies that share common IT systems must obtain an export licence to transfer technology to the intended recipients in their overseas offices or subsidiaries.
Employees travelling betweenUKand overseas offices with controlled technology stored on company or personal devices will require an export licence.
Cloud storage and routing
Technology can be stored on servers and downloaded or accessed remotely. This is often referred to as cloud storage. This infrastructure may:
be private, public or hybrid
include common and shared data environments
be located in theUKor abroad
be supplied by companies as a service
For the purposes ofUKexport controls the location of the exporter and the intended recipient determines the routing of the transfer of technology, not the location of the servers containing the controlled technology.
Accessing or downloading controlled technology overseas
Uploading controlled technology to cloud-based storage is not considered a licensable transfer if it is subsequently downloaded or accessed only by persons located in theUK. In the case of controlled dual-use technology being uploaded in Northern Ireland no export licence is required if it is subsequently downloaded or accessed only by persons located in Northern Ireland or theEU[footnote 1]. This applies irrespective of the location of the IT hardware where the controlled technology is stored or countries it may be routed through in the course of its transfer.
Controlled technology uploaded by persons in theUKto a server in theUK, or sent electronically to overseas file storage, and consequently downloaded or accessed overseas by an intended recipient (includingUKpersons), is a transfer and a licence will be required. The destination of the transfer will be the location of the intended recipients.
If controlled technology is uploaded to aUKor overseas server and any subsequent access to it is controlled by a person outside theUK, then an export licence will be required as a transfer of technology to the location of that person.
When uploading controlled technology to or through the cloud, appropriate actions should be taken to ensure the information is suitably protected. This guards against unintended access to technology. For example by third parties or administrators maintaining cloud services.
Safeguards include using:
industry standard methods of end-to-end encryption
When downloading controlled technology overseas local export controls may require you to obtain an authorisation for transfers back to theUKor to another country. If this is not possible best practice would dictate that the controlled technology is removed from any devices, to ensure that you do not transfer it illegally.
The storage and subsequent transfer of controlled technology that has been uploaded from overseas to aUK-based server is not a licensable transfer from theUK.
Employee access to a company intranet when overseas
If an employee of aUKbased company accesses controlled technology belonging to their company while overseas, while on business or otherwise, then this is an electronic transfer of that technology to the country in which the individual is located. A licence would be required for any such transfer, even if theUKemployee abroad had no intention of passing the technology on to another person abroad.
This corresponds to the position for physical transfers, where taking controlled technology overseas, even if only for personal use and not for onward transmission while abroad, requires an export licence.
Third party access overseas to intranets or cloud services
Established suppliers, customers or collaborators may access controlled technology on a company or organisation’s intranet or cloud services. The company or organisation’s intranet or type of cloud service makes no difference in terms of licensing arrangements. What matters is the geographical location of the entities who access the stored controlled technology.
A licence must be obtained before controlled technology is accessed. If it is going to be fully accessible to members of a company, group, or dedicated collaborative user-group situated overseas as soon as it is saved to the site, then a licence is needed before this occurs.
If individual permissions are required for employees or other approved users overseas before they can access controlled technology on the site, then it would be advisable to obtain a licence before that permission was given.
Third party help desk and administration services
A third-party supplier may manage customer and supplier access to your technology which is stored within a cloud environment. In this case you must understand how the third party manages your controlled technology in all circumstances, including:
supplier and customer access
where the third-party staff are located
what services the help desk or administrators offer, such as remote access to desktops and laptops
Your contract with a third party should include terms that define the export control responsibilities and accountabilities of all parties.
Responsibility for compliance with export controls lies exclusively with the owner of the technology, not with the service provider. If the owner delegates to the service provider the power to grant access to controlled technology to a person located overseas, the owner still has responsibility for how this is exercised. If staff of the service provider located overseas will intentionally have access to controlled technology, an export licence will be required.
You will need to know the details of the overseas customers, suppliers and any subcontractors who need to review your controlled technology in order to register or apply for appropriate licence coverage before access is granted.
An overseas helpdesk or other overseas third parties may remotely access your laptop, for example to assist with IT issues. In this case you should ensure no controlled technology is being displayed, unless there is an export licence in place.
IT system testing and maintenance
If it is likely that controlled technology will be accessed and reviewed by an overseas entity in the course of penetration testing, then an export licence will be required prior to penetration testing.
Overseas access to controlled technology during maintenance activities, in a manner that permits the recipient of the technology to review it, would constitute a transfer to the country where the access occurs and therefore a licence would be required.
Export controls exemptions
Controls on technology aim to prevent essential information becoming available to proliferators and procurers of eitherWMDor conventional weapons or goods that may cause national security concerns. The controls are not intended to interfere unduly with normal commercial or academic practices.
Technology exceptions in the Export Control Order 2008
The intention of technology exceptions in the Export Control Order 2008 is to remove any controls on technology that is:
already in the public domain
basic scientific research
the minimum required for the installation, operation, maintenance or repair of non-military controlled items, whose export has been previously authorised
the minimum required for patent applications
Information in the public domain and for basic scientific research
The controls on technology do not apply to:
information that is in the public domain
basic scientific research
For technology to be in the public domain it has to be freely available with no restriction other than copyright placed on its further dissemination, such as in a book, on a website, at an exhibition.
Information in the public domain may come in many forms including:
general product information
Technology is not in the public domain:
if it needs to be obtained from a supplier who controls the supply
where access is restricted to certain persons, like membership of an institute or requiring passwords
where it is subject to the Official Secrets Act, orMODor government security classifications such as commercially confidential information
if it has been placed in the public domain in contravention of a statutory prohibition, for example classified material, as it is unlikely to be available without further restriction upon its dissemination
The same relaxations apply to published technical papers if the content is in the public domain. However the intention to publish a paper containing controlled technology does not in itself place that information in the public domain. Any collaboration or sharing of controlled technology overseas, such as through a peer review before publication of a technical paper or the results of research and development, would require a licence.
An example might be a product brochure taken from a publicly available website that outlines the capabilities of a piece of military equipment and this could include technology for the use of military equipment. However since the brochure is clearly in the public domain, it is not controlled.
Copyright restrictions such that no copyrighted work may be copied, published, disseminated, displayed, performed, or played without permission of the copyright holder, except in accordance with fair use or licensed agreement, does not necessarily mean that technology is not in the public domain.
For commercial reasons, exporters are unlikely to place controlled technology onto freely available sites, for access by suppliers, customers or indeed competitors,.
As for information in the public domain, technology which is basic scientific research is not controlled. The exchange of research material between an academic based in theUK, for example, and another overseas would not be controlled if it were basic scientific research.
Examples of basic scientific research might include studies of the low temperature electrical resistance of metals to determine the properties of the underlying electronic structure of these materials or the electromagnetic properties of composite surfaces.
Technology required for the installation, operation, maintenance or repair of non-military controlled items
Article 18(1)(b)(i) of the Export Control Order 2008decontrols technology that is the minimum required for activities in relation to goods or software that are not military goods or software orUKcontrolled dual-use goods or software. For example, an information notice describing the repair of the airframe of an Airbus A350 XWB could also be required to repair a military aircraft airframe, but as it is the minimum technology necessary for the repair of a non-military item it is not controlled.
Technology required for the installation, operation, maintenance or repair of controlled items
Unless the licence says otherwise, aUKlicence to export goods or software also authorises the transfer of the minimum technology required for installation, operation, maintenance or repair of the goods or software to the same destination and end-use as the goods or software (Article 26(2) of the Export Control Order 2008).
There is no time limit between the authorisation to export the goods or software and the subsequent transfer of the minimum technology for the same goods or software at a later date.
General technology note (GTN) in the dual-use regulations
The intent of theGTNis to control only that portion of technology that is specific to the development, production or use of controlled items. Technology is not controlled if it is common to both controlled and non-controlled dual-use items.
Using an analogue to digital convertor having an extended temperature range of -55 to 125 degree celsius, as an example:
if the technology used to produce the convertor with an extended temperature range is the same as that used to produce one with a reduced operating range then the technology would not be controlled.
if the technology was unique to the convertor with an extended temperature range, it would be controlled
if the controlled portion of this technology was subsequently applied to a non-controlled item, it would remain controlled.
TheGTNalso contains similar exemptions as cited in the Export Control Order 2008.
Nuclear technology note (NTN) in the dual-use regulations
This is similar to theGTNand brings into control all technology directly associated with nuclear goods controlled in Category 0 of Annex I to theEUDual-Use Regulation. Unlike theGTNit does not release information for patent applications.
Crown immunity for controlled military technology
The Crown is not bound by the provisions of the Export Control Act 2002 for goods specified by Schedule 2 or 3 to the Export Control Order 2008 save in respect of goods specified in Schedule 3 for destinations specified as prohibited destinations in that Schedule.
Where the Crown owns the military technology to be transferred, or has similar rights over its disposal, then the exporter may, subject to the appropriate letter of Crown immunity from the government department that owns the technology, carry out the transfer without a licence.
You can use theOGELchecker toolto identify if an appropriateOGELexists to cover transfers of controlled technology. If your technology is controlled and you cannot identify a suitableOGELthen you must apply for one of the following:
You must comply with the terms and conditions set out in each type of licence. If you use an open licence or aSIELfor technology transfer, you will be audited by the Export Control Joint Unit’s (ECJU) Compliance Team.
Compliance inspectors can also provide advice and information to companies. This helps companies comply with the conditions ofOIELsandOGELs. It includes a spreadsheet containing all information asked for during compliance visits such as:
a description of the technology being transferred, including the relevant control list classification
the destination overseas and to what company or who the intended recipient was
who within the company is conducting the transfers of technology
dates these transfers are taking place or range of dates if applicable
When applying for an export licence you must consider how long the licence is valid for and requirements on quantity and value.SIELsandOIELsare usually valid for 2 years and 5 years respectively. If the licence is for a specific program or the combined total number of tangible and intangible transfers is likely to be very significant you must ensure:
quantities will not run out
values are not exceeded
UKcompanies must ensure that controlled technology is no longer accessed from overseas:
beyond the date when a licence expires or is exhausted
until the issue of a new licence
Company Awould like to have outer cases for a military radio manufactured in another country byCompany B. To find out if the latter is able to produce the cases,Company Amust send some drawings of the parts to be made. As the cases are specifically for the military radio, the production drawings constitute technology for the production of a military item. Therefore a licence is required.
Company Cmanufactures night vision sights for small arms. The products are sold worldwide and a request has been made for 200 user manuals to be sent to a foreign army.Company Chas made and sold so many of the sights that the user manual can be obtained from their publicly-available web site. The foreign army is aware of this but want the manuals posted as hard copies. As a user manual for a military list item, the technology within the manual would constitute technology for the use of a controlled item, so normally an export licence would be required. However, as the user manual is available in the public domain it is released from control by Article 18 of the Export Control Order 2008. That the foreign army has asked for hard copy manuals makes no difference to the freedom to transfer without an export licence, as the public domain exception still applies.
Company Dmakes various controlled mass spectrometers and wants to send some marketing material to a trade fair in another country. The material highlights the typical products supplied and includes testimonials from satisfied customers. Although the company produces controlled items, the publicity material does not include specific information necessary for the development, production or use of the items. The marketing material is therefore not technology as defined and does not require an export licence.
An employee ofCompany Esends an email with attachments containing controlled technology to produce military aero-engine components to an overseas partner. The email is automatically routed via a third country. An export licence is only required for transfer to the country of final destination of the email where the intended recipient is located, even where a copy of it is cached (stored temporarily) on a server in the third country.
Company Fstores cryptographic activation tokens on its servers in theUKthat enables cryptographic functions in a variety of information security equipment. Company employees travelling overseas may access these tokens remotely via laptop or other mobile device. A licence would be required for every country from which such access will take place.
Company Gdecides for reasons of cost to locate its data servers in another country. Naval gun designs are uploaded from theUKto those servers. However, access to the designs are restricted so that only employees located in theUKare able to access or download the information. In this case no licence is required because all the intended recipients of the data will be in theUK.
Company Hmakes export controlledCADsoftware for development of active flight control systems available on its intranet as a service. Access to use the controlled software would not be subject to licensing. However, accessing or downloading the resultant data overseas may be subject to export licences if the data contains controlled technology.
A US employee ofCompany Iis working temporarily in theUKand remotely downloadsUKexport-controlled technology, access to which is controlled by the US company. NoUKexport licence is required as in this case the transfer is from the US into theUK. The same US employee then returns to the US with theUKexport-controlled technology that he has remotely downloaded and saved on his laptop hard drive. AUKexport licence is required for the transfer of controlled technology from theUKto the US. In this example US export controls may also apply as the US employee has accessed US data from theUK.
AUKemployee ofCompany Jtransfers controlled technology residing on a server in Iceland to the intended recipient in South Africa. The recipient’s server is located in Thailand. An export licence will be required to transfer the controlled technology from theUKto South Africa. The same licensing requirement applies if the exporter or the recipient is unaware of the location of either server.
Company Jis a cloud service provider.Company Kstores controlled technology onCompany Jservers located in theUKor elsewhere.Company Khas protected the controlled technology stored in the cloud from unintended access, for example by using industry standard encryption, identity and access management or other safeguards. To provide, support and maintain the cloud services, someCompany Jtechnical, administrative and maintenance personnel are located outside theUK.Company Kmay requireCompany Jpersonnel to manage technical issues inCompany K’scloud environment. No export licence is required becauseCompany Jpersonnel are not the intended recipients of the controlled technology.
A person in Great Britain uploads dual-use controlled technology to an Icelandic server and responsibility for the controlled technology falls on someone in Northern Ireland. The transfer of technology will be from Great Britain to Northern Ireland. The person in Northern Ireland who is responsible for the controlled technology then grants access to someone in Singapore. Here the export is Northern Ireland to Singapore even though the technology was originally uploaded by a person in Great Britain.
This section lists the definitions most relevant to technology, as set out in:
Technology means specific ‘information’ necessary for the development, production or use of goods or software.
‘Information’ may take forms including, not limited to: blueprints, plans, diagrams, models, formulae, tables, ‘source code’, engineering designs and specifications, manuals and instructions written or recorded on other media or devices (for example disk, tape, read-only memories).
‘Source code’ (or source language) is a convenient expression of one or more processes which may be turned by a programming system into equipment executable form.
Technology means specific information necessary for the development, production or use of goods. This information takes the form of ‘technical data’ or ‘technical assistance’.
‘Technical assistance’ may take forms such as instructions, skills, training, working knowledge and consulting services and may involve the transfer of ‘technical data’.
‘Technical data’ may take forms such as blueprints, plans, diagrams, models, formulae, tables, engineering designs and specifications, manuals and instructions written or recorded on other media or devices such as disk, tape, read-only memories.
Transfer, in relation to software or technology, means transfer by electronic or non-electronic means (or any combination of electronic and non-electronic means) from a person or place within the United Kingdom to a person or place outside the United Kingdom, except in articles 10 and 11 where the limitations as to the origin and destination of the transfer do not apply, and cognate expressions shall be construed accordingly.
Transfer by electronic means (UK)
Transfer by electronic means, in relation to software or technology, means transmission by facsimile, telephone or other electronic media (except that oral transmission of technology by telephone is included only where the technology is contained in a document the relevant part of which is read out over the telephone, or is described over the telephone in such a way as to achieve substantially the same result as if it had been so read).
Transfer by non-electronic means (UK)
Transfer by non-electronic means, in relation to software or technology, means disclosure of technology by any means (or combination of means), including oral communication, other than as the exportation of goods or the transfer by electronic means.
Basic scientific research (EU) (UK)
Basic scientific research means experimental or theoretical work undertaken principally to acquire new knowledge of the fundamental principles of phenomena or observable facts and not primarily directed towards a specific practical aim or objective.
Development means all stages prior to production (for example. design, design research, design analyses, design concepts, assembly and testing of prototypes, pilot production schemes, design data, process of transforming design data into goods or software, configuration design, integration design, layouts).
Development is related to all phases prior to serial production, such as design, design research, design analyses, design concepts, assembly and testing of prototypes, pilot production schemes, design data, the process of transforming design data into a product, configuration design, integration design, and layouts.
In the public domain (UK)
In the public domain means available without restriction upon further dissemination (no account being taken of restrictions arising solely from copyright).
In the public domain (EU)
In the public domain, as it applies herein, means technology or software which has been made available without restrictions upon its further dissemination (copyright restrictions do not remove technology or software from being in the public domain).
Production means all production stages (for example as product engineering, manufacture, integration, assembly (mounting), inspection, testing, quality assurance);
Production means all production phases, such as construction, production engineering, manufacture, integration, assembly (mounting), inspection, testing and quality assurance.
Required (EU) (UK)
Required as applied to technology, it refers only to that portion of technology which is peculiarly responsible for achieving or extending the controlled performance levels, characteristics or functions. Such required technology may be shared by different goods.
Use means operation, installation (for example on-site installation), maintenance, checking, repair, overhaul and refurbishing.
Use means operation, installation (including on-site installation), maintenance (checking), repair, overhaul and refurbishing.
This does not apply to technology described in Annex IV of theEURegulation. ↩