Under the International Traffic in Arms Regulations, an ITAR defense service is any assistance you give a foreign person in connection with an item on the United States Munitions List, any disclosure of controlled technical data to that person, or any military training of foreign forces. It is treated as an export, which means you generally need to be registered with the Directorate of Defense Trade Controls (DDTC) and hold a written agreement before the service happens. Willful violations can bring criminal fines up to $1,000,000 and 20 years in prison per count, and civil penalties can exceed $1.27 million per occurrence.1eCFR. 22 CFR 127.10 – Civil Penalty
The Three Things That Count as a Defense Service
The definition sits at 22 CFR 120.32 and covers three distinct activities. The first is furnishing assistance, including training, to a foreign person in connection with defense articles. That assistance can involve designing, developing, engineering, manufacturing, assembling, testing, repairing, maintaining, modifying, operating, or destroying those articles.2eCFR. 22 CFR 120.32 – Defense Service Helping a foreign company calibrate a radar, refurbish an armored vehicle transmission, or configure a weapons platform qualifies whether or not any hardware changes hands.
The second is furnishing controlled technical data to a foreign person. Blueprints, software source code, engineering drawings, and performance specifications tied to a Munitions List item all count, in any format. Sending an email from Virginia to an engineer in Seoul triggers the same requirements as hand-delivering the documents in Seoul.2eCFR. 22 CFR 120.32 – Defense Service
The third is military training of foreign units or forces, regular or irregular. It reaches formal classroom instruction, informal mentoring, correspondence courses, training exercises, orientation programs, and military advice. Teaching foreign forces tactics or organizational methods used by the U.S. military qualifies even when no sensitive technical data is disclosed.2eCFR. 22 CFR 120.32 – Defense Service The rule targets the transfer of operational capability, not just technology.
Who the Rule Considers a Foreign Person
Everything above depends on the recipient being a “foreign person.” Under 22 CFR 120.63, a foreign person is any individual who is not a lawful permanent resident or a protected individual under federal immigration law, along with any corporation, partnership, trust, or other entity not organized to do business in the United States. Foreign governments, their agencies, and international organizations are included.3eCFR. 22 CFR 120.63 – Foreign Person The companion definition of “U.S. person” at 22 CFR 120.62 lists everyone excluded from the foreign-person category.4eCFR. 22 CFR 120.62 – U.S. Person
Physical location does not change the analysis. A foreign national working in your U.S. lab is still a foreign person, and giving that employee access to controlled technical data or services is treated as an export to the person’s country of nationality. This is the “deemed export” concept, and the authorization requirements are identical to shipping hardware overseas.
Dual and Third-Country Nationals Inside a Foreign Subsidiary
If your foreign subsidiary employs someone holding citizenship in two countries, 22 CFR 126.18 provides a limited exemption from separate licensing for unclassified defense articles and services, provided the transfer happens entirely within the authorized end-user country and the employer maintains effective screening and non-disclosure procedures.5eCFR. 22 CFR 126.18 – Exemptions Regarding Intra-Company Transfers to Dual Nationals or Third-Country Nationals
Screening looks for substantive contacts with countries on the restricted list at 22 CFR 126.1: regular travel there, ongoing relationships with agents or officials, continued financial ties. Employees with those contacts are presumed to pose a diversion risk. Screening records must be kept for five years and produced to the DDTC on request.5eCFR. 22 CFR 126.18 – Exemptions Regarding Intra-Company Transfers to Dual Nationals or Third-Country Nationals
How You Can Provide a Defense Service Without Meaning To
Many companies stumble in without ever sending anything overseas, because certain in-person interactions themselves count as an export. Under 22 CFR 120.50, technical data is “released” when a foreign person is allowed to visually inspect a defense article in a way that reveals controlled technical data, or when technical data is disclosed orally or by any other means.6Electronic Code of Federal Regulations (eCFR). 22 CFR 120.50 – Release
A plant tour where a foreign visitor sees proprietary manufacturing tolerances on a defense article, a whiteboard session where an engineer sketches a controlled design for a foreign colleague, or a phone call explaining performance parameters can each be a defense service. The release is treated as an export to the visitor’s country of nationality. Compliance programs that only watch outbound shipments miss the setting where violations happen most often.
What Is Not a Defense Service
The regulations draw specific boundaries so that not everything touching a defense topic is caught.
Public Domain Information
Information published and generally accessible to the public falls outside ITAR controls. Under 22 CFR 120.34, that includes information available through bookstores, unrestricted subscriptions, public libraries, patent offices, and conferences open to the public in the United States.7eCFR. 22 CFR 120.34 – Public Domain
Posting technical data on the internet does not automatically qualify. The regulation requires prior approval from the relevant U.S. government agency before information counts as publicly released through unlimited distribution. Uploading controlled technical data to a website without that approval is itself an unauthorized export, and general accessibility afterward does not cure the violation.7eCFR. 22 CFR 120.34 – Public Domain
Fundamental Research
Basic and applied research at accredited U.S. institutions of higher learning is excluded when the resulting information is ordinarily published and shared broadly within the scientific community. The exclusion disappears if the university or its researchers accept restrictions on publishing, or if U.S. government funding comes with specific access or dissemination controls attached.7eCFR. 22 CFR 120.34 – Public Domain A single access-restriction clause in a grant contract can pull the entire project back under ITAR.
General Scientific and Engineering Principles
Foundational concepts taught in schools and universities are not defense services. Teaching how heat transfer works is education. Teaching the specific thermal management approach used in a controlled missile seeker is a defense service.
What You Need Before You Provide One
With few exceptions, all transfers of defense articles or services to foreign persons require case-by-case DDTC review.8Directorate of Defense Trade Controls. Defense Trade Controls Licensing Two things have to be in place: registration, and a written agreement.
Register First
You cannot apply for a TAA, MLA, or any other ITAR authorization until you are registered with the DDTC. Registration is annual, filed on Form DS-2032, and must be renewed between 30 and 60 days before it expires.9eCFR. 22 CFR 129.8 – Submission of Statement of Registration Fees are tiered by prior-year licensing activity, starting at $3,000 for new registrants or those with no favorable determinations in the measurement period.10eCFR. 22 CFR 122.3 – Registration Fees
Records of every defense-service activity — agreements, technical data transfers, related correspondence — must be kept for five years from the expiration of the license or, if no license was involved, from the date of the transaction.11eCFR. 22 CFR 122.5 – Maintenance of Records by Registrants
Technical Assistance Agreement
A TAA is the authorization for furnishing defense services or disclosing controlled technical data to a foreign person, whether or not hardware is also transferred. The proposal goes to the DDTC and the agreement cannot take effect until you receive written approval.12eCFR. 22 CFR Part 124 – Agreements, Off-Shore Procurement, and Other Defense Services It must describe the specific defense articles, the technical data and assistance involved, the countries where work will take place, and the duration.
Filing obligations continue after approval. You must submit a copy of the final agreement within 30 days after it takes effect. If it is not concluded within one year of approval, you must notify the DDTC in writing. At least 30 days’ written notice is required before expiration. If you decide not to go forward, the DDTC must hear from you within 60 days of that decision.12eCFR. 22 CFR Part 124 – Agreements, Off-Shore Procurement, and Other Defense Services
Manufacturing License Agreement
An MLA applies when the foreign person will actually manufacture defense articles abroad using your technical data or know-how. It must clearly distinguish between articles being exported and those being manufactured overseas.13U.S. Department of State – Directorate of Defense Trade Controls (DDTC). Guidelines for Preparing Agreements The same approval and filing timelines apply.
Changes to an Approved Agreement
Any change to the scope — new articles, new countries, new types of assistance — must go back to the DDTC for approval before you implement it. Minor administrative changes such as updated delivery schedules do not need prior approval but must be filed within 30 days. Every agreement must contain a clause stating it cannot enter into force, be amended, or be extended without prior written State Department approval.12eCFR. 22 CFR Part 124 – Agreements, Off-Shore Procurement, and Other Defense Services
Exemptions for Allied Countries
The U.S.–U.K. Defense Trade Cooperation Treaty at 22 CFR 126.17 allows license-free export of defense articles and services to approved members of the United Kingdom Community for combined military or counter-terrorism operations, cooperative research and production programs, projects where the U.K. government is the end-user, and U.S. government end-use.14eCFR. 22 CFR 126.17 – Exemption Pursuant to the Defense Trade Cooperation Treaty Between the United States and the United Kingdom A parallel treaty covers Australia at 22 CFR 126.16. Both treaties exclude items in Supplement No. 1 to Part 126 and do not apply to Foreign Military Sales. Canada has a broad exemption under 22 CFR 126.5 for unclassified articles and services destined for Canadian federal or provincial government use or Canadian-registered persons. Separate comprehensive authorizations exist for NATO members, Australia, Japan, and Sweden under 22 CFR 126.14.
What a Violation Costs
Criminal penalties apply to willful violations. Under the Arms Export Control Act, a person convicted of willfully violating ITAR — or making a material misstatement in a registration, license application, or required report — faces up to $1,000,000 in fines and up to 20 years of imprisonment per violation, or both.15Office of the Law Revision Counsel. 22 USC 2778 – Control of Arms Exports and Imports
Civil penalties do not require willfulness. The DDTC can impose a civil fine up to $1,271,078 per violation, or twice the value of the underlying transaction, whichever is greater, and can impose it on top of criminal sanctions rather than as an alternative.1eCFR. 22 CFR 127.10 – Civil Penalty The DDTC can also condition the issuance or renewal of any future license on payment of outstanding penalties, which effectively locks a company out of the defense trade until the violation is resolved.
Administrative debarment is often the most damaging consequence. A debarred company loses the ability to participate in the defense supply chain entirely: no exports, no agreements, no defense services.
If You Have Already Provided One Without Authorization
If you discover a violation, report it before the government does. Under 22 CFR 127.12, a voluntary disclosure may be considered a mitigating factor when the DDTC sets penalties, but only if you come forward before any government agency independently learns of the violation and starts an investigation.16eCFR. 22 CFR 127.12 – Voluntary Disclosures
The process has two steps. First, notify the DDTC immediately after discovering the violation. Second, submit a full written disclosure within 60 calendar days of that initial notification. It must include a description of what happened and why, the identities of everyone involved, the relevant license numbers or exemption citations, the Munitions List category and description of the items or services, and the corrective actions already taken. An empowered official or senior officer at the level of CEO, general counsel, or board member must certify that the disclosure is true and correct.16eCFR. 22 CFR 127.12 – Voluntary Disclosures
Companies that investigate quietly and delay disclosure until they have a complete picture are gambling. If the government opens its own inquiry before you file, the mitigation is gone. File the initial notification fast, then use the 60-day window (extensions are available by written request) to build the full report.