ITAR Controlled Items: Categories, Licenses, and Penalties

Items controlled under the International Traffic in Arms Regulations are the defense articles, technical data, software, and services identified on the United States Munitions List (USML) at 22 CFR § 121.1. If your product, drawing, code, or expertise fits a USML description, it is an ITAR controlled item, and moving it — physically, electronically, or verbally — requires prior authorization from the State Department’s Directorate of Defense Trade Controls (DDTC). Getting the classification wrong or skipping the license carries civil penalties above $1.2 million per violation and criminal exposure of up to 20 years in prison.¹

What Counts as an ITAR Controlled Item

The USML groups defense articles into twenty-one categories organized by function rather than by product name.² Early categories cover firearms, guns and armament, and ammunition. Middle categories reach military vehicles, aircraft, and naval vessels. Later categories extend into satellites, launch vehicles, directed energy weapons, and nuclear-related equipment.

Because the list is functional, it doesn’t try to name every controlled widget. Each category describes the types of items that qualify, and each includes a catch-all for parts, components, accessories, and attachments “specially designed” for the items in that category. Something can be a defense article without appearing by name.

Beyond finished platforms, four buckets of controlled items catch most companies:

Hardware and end items on the USML — tanks, fighter aircraft, guided missiles, warships.
Parts and components engineered for a defense article — gun barrels, sighting systems, breech blocks, firing mechanisms, circuit boards or wiring harnesses designed for a military radar.³
Technical data and software related to defense articles.
Defense services — training, maintenance support, and technical assistance provided to foreign persons.

The “Specially Designed” Question for Parts and Components

Whether a component qualifies as “specially designed” for a defense article is one of the trickiest classification calls in export control. The regulation at 22 CFR § 120.41 uses a two-step framework sometimes called “catch and release.” An item is caught if it was developed or modified for use with a USML-listed article. It may then be released — excluded from ITAR — if it meets any of several conditions.⁴

Common release valves include standard fasteners (bolts, screws, rivets, washers), items with the same form, fit, and function as a commercially available product already in production, and items developed from the start as general-purpose goods with no knowledge they would be used in a defense article. If you’re relying on that last exception, the regulation requires contemporaneous documentation — design records, marketing plans, patent filings — proving the item was genuinely developed for dual or general use. Without those records, the release doesn’t apply.

The See-Through Rule

A controlled component doesn’t lose its status just because someone installs it inside a larger commercial product. DDTC has explained that when an ITAR-controlled defense article is integrated into a bigger system, the ITAR “sees through” the larger item and continues to regulate the controlled component inside it.⁵ Exporting the larger system without DDTC approval still violates ITAR because the controlled part hasn’t stopped being a defense article. Integrators need to track the classification of every subassembly in their supply chain for this reason.

Technical Data and Software

ITAR doesn’t only reach physical objects. Technical data, defined at 22 CFR § 120.33, means information required for the design, development, production, testing, or modification of defense articles.⁶ Blueprints, engineering drawings, detailed photographs of sensitive specifications, repair manuals, and instructional materials for military hardware all qualify. So does software directly related to defense articles.

Software specifically designed or modified for military applications — guidance systems, encryption tools, combat simulations — falls under separate scrutiny. The medium doesn’t matter. Controlled software on a thumb drive, in an email attachment, or on a cloud server is still a defense article. Function determines classification, not packaging.

The Public Domain Boundary

Not all defense-related information triggers ITAR. Information that is “published and generally accessible or available to the public” qualifies as public domain under 22 CFR § 120.34 and falls outside the definition of controlled technical data.⁷ That covers information available through bookstores, unrestricted subscriptions, public libraries, patent offices, and conferences open to the general public in the United States. It also covers fundamental research at accredited U.S. universities where results are ordinarily published and shared broadly within the scientific community.

The fundamental research carve-out disappears if the university or researcher accepts publication restrictions or the government imposes specific access controls on the results. And the exemption covers only information already in the public domain. You cannot make something public domain by posting it online without prior government approval. Publishing controlled technical data without DDTC authorization is itself an ITAR violation, not a path to exemption.

Defense Services

You don’t have to ship hardware across a border to trigger ITAR. Furnishing assistance or training to a foreign person in the design, manufacture, operation, or maintenance of defense articles is a defense service under 22 CFR § 120.32.⁸ Hands-on maintenance training, consulting on military operations, and technical guidance for equipment located in another country all qualify. So does military training delivered through correspondence courses or educational publications. A verbal conversation walking a foreign engineer through a weapons-system repair counts the same as handing over a manual.

Defense services require prior authorization, typically through a Technical Assistance Agreement (TAA). A TAA is the standard mechanism for authorizing transfers of technical data, training, or defense-related services to foreign partners.⁹ Activities that commonly require a TAA include overseas maintenance support, technical evaluations or demonstrations with foreign persons, releases of manufacturing data, and support for direct commercial sales to foreign parties.

Deemed Exports: The Trap Most Companies Miss

Under 22 CFR § 120.50, an “export” doesn’t require anything to physically leave the country. Releasing or otherwise transferring technical data to a foreign person inside the United States counts as a deemed export.¹⁰ If your company employs a foreign national engineer and gives that person access to controlled technical data, you’ve made an export deemed to go to every country where that person holds citizenship or permanent residency.

This catches employers constantly. A foreign-born employee working at your Texas facility on a valid work visa, accessing ITAR-controlled specifications on a shared drive, is an export event requiring a license unless an exemption applies. The same goes for showing controlled drawings at a meeting, sharing files through collaboration platforms, or allowing visual access to controlled hardware during a plant tour. Routine use of controlled equipment following a publicly available user manual generally doesn’t trigger the deemed export rule, but anything beyond the published manual — source code, internal design data, modification procedures — likely does.

Registration Before Anything Else

Before you can apply for any license or agreement, you must register with DDTC. Under 22 CFR § 122.1, any person engaged in the business of manufacturing, exporting, or temporarily importing defense articles, or furnishing defense services, must register. The threshold is remarkably low: a single occasion of manufacturing or exporting triggers the requirement. A manufacturer who never exports must still register.¹¹

Fees are tiered based on export volume:

Tier 1 ($3,000/year) covers first-time registrants, stand-alone brokers renewing, registrants with no approved licenses in the prior 12-month window, and 501(c)(3) tax-exempt organizations. Some Tier 1 registrants can petition for a $500 discount, bringing the fee to $2,500.
Tier 2 ($4,000/year) applies to registrants who received five or fewer approved licenses or authorizations in the relevant 12-month period.
Tier 3 is calculated for registrants with more than five approved authorizations: $4,000 plus $1,100 for each approval above five, capped at 3% of the total value of all approvals or $4,000, whichever is greater.¹²

Registration is valid for one year and must be renewed before it expires. A lapse means you cannot apply for licenses, which can freeze export operations entirely.

Licenses and Agreements You’ll Need

The specific authorization depends on what you’re moving and where:

DSP-5 is the standard license for permanently exporting unclassified defense articles and related technical data. Items shipped under a DSP-5 are not expected to return.¹³
DSP-73 covers temporary exports of defense articles leaving the country for demonstrations, exhibitions, or testing and expected back within a specified period.
DSP-61 covers temporary imports of foreign defense articles brought into the U.S. for repairs, servicing, or similar purposes.
A Technical Assistance Agreement is required when the export involves defense services or technical data transfers rather than physical hardware — engineering support, training, software development for military systems.

All applications run through the Defense Export Control and Compliance System (DECCS), DDTC’s online portal. You need a DECCS account, an active ITAR registration, and your registration code to access the licensing application.¹⁴ Some transfers between approved entities and their employees fall under exemptions — notably intra-company transfers to dual nationals or third-country nationals of certain allied countries — but each exemption carries its own conditions and documentation requirements.¹⁵

When You’re Not Sure: Commodity Jurisdiction Requests

If you’re genuinely unsure whether your product belongs on the USML or falls under the Commerce Department’s commercial export controls, you can file a commodity jurisdiction (CJ) request with DDTC using Form DS-4076.¹⁶ The request needs a thorough description of the item’s function, its development history, physical specifications, and whether it was originally designed for military or civilian use. Marketing documents, technical specs, and internal design records help DDTC make the call.

DDTC must provide a preliminary response within 10 working days of receiving a complete request. If no final determination comes within 45 days, you can request expedited processing in writing from the Director of the Office of Defense Trade Controls Policy.¹⁷ A CJ determination tells you which agency has jurisdiction over your item. It is not itself a license or approval to export.¹⁸

Brokering Activities

ITAR doesn’t just regulate manufacturers and exporters. Under 22 CFR Part 129, anyone who facilitates the sale, transfer, or export of defense articles on behalf of another person is engaged in brokering and must register with DDTC separately.¹⁹ Brokering includes soliciting, promoting, negotiating, financing, insuring, or transporting defense articles or services. A single transaction is enough to trigger the requirement.

The rule applies to any U.S. person wherever located, any foreign person inside the United States, and any foreign person outside the U.S. if owned or controlled by a U.S. person. Some activities are excluded — general goodwill promotion at trade shows, collecting pricing data for a proposal response, providing legal advice, and purely administrative support like translation. Banks and financial firms lose their exclusion if they directly arrange defense transactions or hold title to defense articles, even without physical custody.

Recordkeeping and the Empowered Official

Every registrant must designate an empowered official: a U.S. person directly employed by the company in a management or policy role, legally authorized in writing to sign license applications and other DDTC submissions on the company’s behalf.²⁰ This person carries real personal accountability. Without a qualified empowered official, a company cannot legally submit license applications.

You must also maintain records on the manufacture, acquisition, and disposition of defense articles, technical data transfers, defense services provided, and any brokering activities, for a minimum of five years from the license expiration date or transaction date.²¹ DDTC can prescribe longer retention periods in individual cases. Records must cover exports made under exemptions, not just licensed transactions.

Penalties for Getting It Wrong

ITAR violations carry both civil and criminal consequences, and DDTC does not treat them as paperwork technicalities.

Civil penalties reach up to $1,271,078 per violation, or twice the transaction value, whichever is greater. The figure is adjusted periodically for inflation.¹
A willful criminal violation can result in fines up to $1,000,000 and imprisonment up to 20 years, or both.
The Assistant Secretary of State for Political-Military Affairs can debar any person from participating in defense exports entirely — career-ending for individuals and business-ending for small contractors.²²

Violations also produce collateral consequences: license revocations, denial of future applications, mandatory compliance oversight, and lost business with prime contractors who can’t afford the association. Most violations DDTC encounters aren’t dramatic. They’re companies that failed to register, employees who emailed controlled technical data to the wrong person, and manufacturers that didn’t realize a component in their supply chain carried a USML classification.

1
eCFR. 22 CFR Part 127 – Violations and Penalties
2
eCFR. 22 CFR Part 121 – The United States Munitions List
3
eCFR. 22 CFR 121.1 – The United States Munitions List
4
eCFR. 22 CFR 120.41 – Specially Designed
5
Directorate of Defense Trade Controls. ITAR / USML Updates FAQ
6
eCFR. 22 CFR 120.33 – Technical Data
7
eCFR. 22 CFR 120.34 – Public Domain
8
eCFR. 22 CFR 120.32 – Defense Service
9
Directorate of Defense Trade Controls. Agreement Guidance
10
eCFR. 22 CFR Part 120 – Purpose and Definitions
11
eCFR. 22 CFR 122.1 – Registration Requirements, Exemptions, and Purpose
12
Directorate of Defense Trade Controls. Registration Payment
13
Directorate of Defense Trade Controls. License Application Types
14
Directorate of Defense Trade Controls. DECCS – Defense Export Control and Compliance System
15
eCFR. 22 CFR Part 126 – General Policies and Provisions
16
Directorate of Defense Trade Controls. Commodity Jurisdictions
17
eCFR. 22 CFR 120.12 – Commodity Jurisdiction Determination Requests
18
U. S. Department of State. Instructions for Request for Commodity Jurisdiction – Form DS-4076
19
govinfo.gov. 22 CFR Part 129 – Registration and Licensing of Brokers
20
eCFR. 22 CFR 120.67 – Empowered Official
21
GovInfo. 22 CFR 122.5 – Maintenance of Records by Registrants
22
U.S. Department of State Directorate of Defense Trade Controls. DDTC Compliance Actions