ITAR Definition: Controls, Covered Persons, and Penalties

The ITAR definition is straightforward at its core: the International Traffic in Arms Regulations are the federal rules, administered by the U.S. Department of State’s Directorate of Defense Trade Controls (DDTC), that control the export, import, and brokering of military and intelligence items listed on the United States Munitions List (USML). The rules reach further than most people expect. Sharing a controlled blueprint with a foreign coworker at your own desk in the United States counts as an export, and a willful violation carries criminal penalties of up to 20 years in prison and $1,000,000 per offense.¹

ITAR gets its authority from the Arms Export Control Act, which lets the President control defense trade and decide what belongs on the USML.¹ That authority now sits with the State Department, and the regulations themselves live in Title 22 of the Code of Federal Regulations, Parts 120 through 130. Jurisdiction turns on what an item was designed or modified to do, not how the current owner happens to use it. A commercial GPS receiver is outside ITAR. The same receiver reengineered for a guided missile is inside it.

What ITAR Actually Controls

ITAR regulates three things: defense articles, defense services, and technical data. The definitions are broader than the plain English words suggest.

Defense Articles

A defense article is any item or technical data listed on the USML. The definition covers finished weapons and reaches back into the supply chain: forgings, castings, and machined bodies count once they hit a manufacturing stage where their material composition, geometry, or function makes them clearly identifiable as defense items.² Models and mockups that reveal controlled technical data also qualify, even when they are not themselves weapons.

Defense Services

A defense service is help given to a foreign person in connection with a controlled defense article. It covers furnishing assistance or training in the design, development, engineering, manufacture, testing, repair, modification, or operation of USML items. It also covers providing controlled technical data to foreign persons and conducting military training of foreign forces, at home or abroad.³ Sending a technician overseas to maintain a controlled radar system is a defense service. So is walking a visiting foreign engineer through the integration of a controlled component at your U.S. plant.

Technical Data

Technical data is the information required to design, develop, produce, manufacture, assemble, operate, repair, test, maintain, or modify a defense article. Blueprints, drawings, photographs, plans, instructions, and documentation tied to USML items all qualify, as does classified information relating to defense articles and services regardless of format.⁴

Two carve-outs keep ITAR from swallowing ordinary academic work. General scientific, mathematical, or engineering principles commonly taught in schools, colleges, and universities are excluded, and so is information already in the public domain.⁴ Universities can teach thermodynamics without triggering export controls. The manufacturing processes and performance data behind a specific weapons system remain protected.

The United States Munitions List

The USML is the master list that decides which items are subject to ITAR. It is codified at 22 CFR 121.1 and organized into 21 categories that span nearly every type of military technology.⁵ Each category covers complete systems, components, parts, accessories, and related technical data. A few examples:

Category I covers firearms, including fully automatic weapons up to .50 caliber and related parts.
Category IV covers launch vehicles, guided missiles, ballistic projectiles, and their components.
Category XI covers military electronics, including sensors, electronic warfare systems, and communications hardware.
Category XV covers spacecraft and related items, including satellites designed for military or intelligence purposes.

Some USML entries carry an added designation as Significant Military Equipment (SME), marked by an asterisk before the paragraph. SME items face tighter controls and extra reporting, and technical data directly related to their manufacture is itself SME.⁶

Not every item with a military connection is on the USML. A decade of reform moved many items with predominantly commercial applications onto the Commerce Department’s Commerce Control List, which is governed by the Export Administration Regulations rather than ITAR. If you are not sure which regime applies to your product, DDTC accepts a formal Commodity Jurisdiction request that produces a written ruling.

What Counts as an Export

The ITAR meaning of “export” reaches well past physically shipping something abroad. The regulation defines six activities as an export:⁷

Sending or taking a defense article out of the United States in any manner.
Releasing or transferring technical data to a foreign person inside the United States.
Transferring registration, control, or ownership of a controlled aircraft, vessel, or satellite to a foreign person.
Releasing a defense article to a foreign embassy or consulate in the United States.
Performing a defense service for or on behalf of a foreign person, whether in the United States or abroad.
Releasing previously encrypted technical data.

The deemed export rule is where most companies stumble. When you release technical data to a foreign person in the United States, the release is treated as an export to every country where that person holds citizenship or permanent residency.⁷ A Chinese-born engineer with permanent residency in Canada, working at your U.S. facility, triggers a deemed export to both China and Canada when they touch ITAR-controlled data. Because China sits on the prohibited-countries list, that access cannot be authorized at all without a specific exemption. That is why ITAR-registered companies screen employees, visitors, and subcontractors before granting access to controlled information.

Who Must Comply

Any person in the United States who manufactures, exports, or temporarily imports defense articles, or furnishes defense services, must register with DDTC. Registration is triggered by manufacturing alone. You owe the obligation even if you never intend to ship anything overseas.⁸ Registration runs through DDTC’s online portal on Form DS-2032 and requires disclosure of owners and senior officers, a description of the business, its organizational structure, and any parent or subsidiary entities. DDTC charges an annual fee on a three-tier structure, ranging from $3,000 for first-time or low-volume registrants to a calculated fee for high-volume filers that scales with the number of approved licenses.⁹

Brokers are covered too. Anyone who facilitates a defense trade transaction on behalf of another person, even without touching the goods, may be brokering under 22 CFR Part 129. Financing, insuring, transporting, soliciting, promoting, negotiating, or otherwise arranging a purchase, sale, or transfer of defense articles or services can all qualify, and a single transaction is enough to trigger registration and, in most cases, prior approval from DDTC.¹⁰

Every registered company must designate at least one empowered official: a U.S. person directly employed in a management or policy-level role and authorized in writing to sign DDTC submissions.¹¹ The role is not ceremonial. The empowered official certifies the accuracy of every export application and carries personal responsibility for the company’s representations to the government.

Country Restrictions and Allied Exemptions

ITAR keeps a list of countries where U.S. defense exports meet a blanket policy of denial. The primary denied countries are Belarus, Burma (Myanmar), China, Cuba, Iran, North Korea, Syria, and Venezuela. A second tier of restricted countries includes Afghanistan, the Central African Republic, the Democratic Republic of the Congo, Eritrea, Ethiopia, Haiti, Iraq, Lebanon, Libya, Nicaragua, Russia, Somalia, South Sudan, Sudan, and Zimbabwe, among others, each carrying its own set of country-specific rules.¹²

Close allies get lighter treatment. Australia and the United Kingdom each hold a Defense Trade Cooperation Treaty with the United States that creates broad exemptions for approved defense trade within the treaty framework. Canada benefits from its own exemptions and expedited license processing. NATO members, Japan, and Sweden qualify for special comprehensive export authorizations that simplify recurring transfers.¹³ Even with allies, the specific item and end use still matter. An exemption in one category does not automatically extend to another.

Penalties for Violations

ITAR penalties are among the harshest in federal export-control law. DDTC does not have to prove actual harm to a foreign adversary. A willful violation of the Arms Export Control Act or any ITAR regulation, including a false statement on a registration or license application, can bring a criminal fine of up to $1,000,000 per violation and up to 20 years in prison.¹

On the administrative side, the State Department can impose civil penalties of up to $1,271,078 per violation (an inflation-adjusted figure) or twice the value of the underlying transaction, whichever is greater.¹⁴ Civil penalties can run alongside criminal prosecution, a single shipment can contain multiple violations, and DDTC can also debar a company from all future defense trade, which for many contractors is worse than any fine.

Companies that discover a potential violation are strongly encouraged to file a voluntary self-disclosure with DDTC. DDTC treats disclosure as a mitigating factor and treats a failure to disclose as an aggravating factor, but the disclosure must reach DDTC before the government learns of the violation from another source.¹⁵ Serious violations can still be referred to the Department of Justice even with a disclosure on file, though DDTC will note the voluntary nature of the report.

What Compliance Looks Like in Practice

Registration and licensing are the visible parts of ITAR compliance. The rest is internal infrastructure.

Registered companies must keep records of all controlled transactions, including exports made under license exemptions, for at least five years from the expiration of the license or the date of the transaction, and DDTC can extend that period case by case.¹⁶ Records must be available for federal inspection on request.

Most companies with meaningful ITAR exposure also maintain a Technology Control Plan governing who can access controlled data, how controlled items are stored and shipped, and how foreign visitors are handled on site. Because a deemed export happens whenever a foreign person accesses controlled technical data, employers need to know the citizenship and immigration status of everyone with potential access. In practice, ITAR compliance shapes hiring, IT security, facility layout, and vendor management, not just the shipping department.

1
Office of the Law Revision Counsel. 22 U.S. Code 2778 – Control of Arms Exports and Imports
2
eCFR. 22 CFR 120.31 – Defense Article
3
eCFR. 22 CFR 120.32 – Defense Service
4
eCFR. 22 CFR 120.33 – Technical Data
5
eCFR. 22 CFR 121.1 – The United States Munitions List
6
eCFR. 22 CFR 120.10 – Introduction to the U.S. Munitions List
7
eCFR. 22 CFR 120.50 – Export
8
eCFR. 22 CFR Part 122 – Registration of Manufacturers and Exporters
9
Directorate of Defense Trade Controls. Registration Payment
10
eCFR. 22 CFR 129.2 – Definitions
11
eCFR. 22 CFR 120.67 – Empowered Official
12
eCFR. 22 CFR 126.1 – Prohibited Exports, Imports, and Sales to or From Certain Countries
13
eCFR. 22 CFR Part 126 – General Policies and Provisions
14
eCFR. 22 CFR Part 127 – Violations and Penalties
15
eCFR. 22 CFR 127.12 – Voluntary Disclosures
16
GovInfo. 22 CFR 122.5 – Maintenance of Records by Registrants