Something is ITAR restricted when it appears on the United States Munitions List and therefore falls under the International Traffic in Arms Regulations, which means it cannot be exported, shared with a foreign person, or brokered without authorization from the State Department’s Directorate of Defense Trade Controls. The restriction reaches physical hardware, the technical data behind it, and the services used to build, repair, or train others on it. It applies whether the item leaves the country in a shipping container or leaves a conversation through a foreign national’s ears.
ITAR is grounded in the Arms Export Control Act and administered by the Directorate of Defense Trade Controls (DDTC). It binds anyone in the United States who manufactures, exports, brokers, or handles controlled defense technology, and the obligations begin well before anything crosses a border.
What Makes Something ITAR Restricted
The United States Munitions List (USML), codified at 22 CFR 121.1, is the catalog of defense articles subject to ITAR. It contains twenty-one categories organized by military function.1eCFR. 22 CFR 121.1 – The United States Munitions List Category I covers firearms, suppressors, and related components. Category IV covers launch vehicles, guided missiles, and ballistic projectiles. Category VI addresses surface vessels of war. Category XI captures military electronics such as radar and specialized communications gear. Category XX covers submersible vessels, and Category XXI is a catch-all for defense articles not listed elsewhere.
An item lands on the USML because of how it was designed, not because of who ends up buying it. A civilian purchaser doesn’t change the classification. If the hardware was engineered to deliver a military or intelligence capability, it stays controlled.
Significant Military Equipment
Within the USML, certain items carry an extra designation as Significant Military Equipment (SME). These articles have substantial military utility warranting tighter export controls, and they appear on the USML marked with an asterisk. All classified defense articles automatically qualify as SME.2eCFR. 22 CFR 120.36 – Significant Military Equipment Technical data directly related to manufacturing an SME item carries the same label and draws additional scrutiny during licensing.
The “Specially Designed” Test
Not every component that ends up inside a military system is ITAR restricted. A standard bolt or commercial circuit board doesn’t become controlled just because a missile happens to contain it. Under 22 CFR 120.41, a part is “specially designed” if it was developed to have properties specifically responsible for achieving the performance described in a USML category.3eCFR. 22 CFR 120.41 – Specially Designed The rule also carries release criteria that pull items back out of control. A component escapes the specially designed label if it is a general-purpose item with the same function, performance, and form as something used in civilian applications.
The ITAR/EAR Boundary
Dual-use items that have both civilian and military applications fall under the Export Administration Regulations (EAR), administered by the Department of Commerce’s Bureau of Industry and Security, and appear on the Commerce Control List rather than the USML. That distinction matters because ITAR controls are stricter and its penalties are harsher. Getting jurisdiction wrong is not a gray area: if your item belongs on the USML and you export it under EAR procedures, that is an ITAR violation regardless of how carefully the EAR process was followed.
Technical Data and Defense Services Are Restricted Too
ITAR does not stop at hardware. Technical data, defined at 22 CFR 120.33, covers the information needed to design, develop, produce, assemble, operate, repair, test, maintain, or modify a defense article. That includes blueprints, drawings, photographs, plans, assembly instructions, testing procedures, and software directly related to defense articles.4eCFR. 22 CFR 120.33 – Technical Data Basic marketing information describing what a defense article does in general terms, and general system descriptions, fall outside the definition.
Defense services, defined at 22 CFR 120.32, cover furnishing assistance or training to foreign persons in the use, repair, manufacture, or operation of defense articles. This includes formal instruction, military training of foreign forces, and informal guidance delivered through correspondence courses or technical publications.5eCFR. 22 CFR 120.32 – Defense Service Sharing controlled technical data with a foreign person is itself a defense service. Transferring knowledge carries the same regulatory weight as transferring the technology.
What Counts as an “Export”
This is where most companies first stumble. Under 22 CFR 120.50, six activities qualify as exports:6eCFR. 22 CFR 120.50 – Export
- Physically sending or taking a defense article out of the United States, in any manner.
- Releasing technical data to a foreign person inside the United States (the “deemed export”).
- Transferring registration, control, or ownership of a controlled aircraft, vessel, or satellite to a foreign person.
- Providing a defense article to a foreign embassy or consulate on U.S. soil.
- Performing a defense service for the benefit of a foreign person, whether in the U.S. or abroad.
- Releasing previously encrypted technical data under certain conditions.
The deemed export rule catches the most people off guard. When you share controlled technical data with a foreign-national colleague at your own office, the government treats that disclosure as an export to every country where that person holds citizenship or permanent residency. A conversation next to a whiteboard covered in controlled schematics can trigger a violation if the person listening is not authorized. Visual access, oral disclosure, and digital access to restricted databases all count.
A “foreign person” for ITAR purposes is anyone who is not a U.S. citizen, a lawful permanent resident, or a protected individual under federal immigration law. The definition also covers foreign corporations, partnerships, governments, and international organizations.7eCFR. 22 CFR Part 120 – Purpose and Definitions – Section 120.63
Countries You Cannot Export To
Certain destinations face a blanket policy of denial for all ITAR-controlled exports. Under 22 CFR 126.1, the following countries cannot receive U.S. defense articles or services absent extraordinary circumstances: Belarus, Burma, China, Cuba, Iran, North Korea, Syria, and Venezuela.8eCFR. 22 CFR 126.1 – Prohibited Exports, Imports, and Sales to or From Certain Countries
A second tier of countries faces restrictions with narrow, case-by-case exceptions. Russia is subject to a denial policy for defense exports except for certain government space cooperation activities. Others with specific restrictions include Afghanistan, Libya, Somalia, South Sudan, and Sudan. The exemptions generally available elsewhere in ITAR do not apply to proscribed destinations, and even a sales proposal directed at one of these countries requires prior DDTC authorization.
Registering With DDTC Before You Do Anything
Before you can legally manufacture, export, temporarily import, broker, or furnish defense services, you must register with DDTC. The requirement kicks in after a single occasion of any of those activities. Even a manufacturer that never exports must register.9eCFR. 22 CFR 122.1 – Registration Requirements, Exemptions, and Purpose Registration is a prerequisite for applying for any export license.
The Statement of Registration (Form DS-2032) requires ownership details, the USML categories relevant to the business, and the names of the senior officers responsible for compliance. Annual fees follow a tiered structure:10eCFR. 22 CFR 122.3 – Registration Fees
- Tier 1 is $3,000 per year and applies to new registrants, those who received no favorable license determinations in the preceding 12 months, and nonprofits exempt under 26 U.S.C. 501(c)(3).
- Tier 2 is $4,000 per year for registrants who received five or fewer approved licenses during the preceding 12 months.
- Tier 3 is calculated for registrants with more than five approved licenses: $4,000 plus $1,100 for each approval beyond five, capped at 3% of the total value of all approvals.
Broker Registration
Entities that facilitate defense trade on behalf of others register separately under 22 CFR Part 129. Brokering includes arranging, financing, insuring, or otherwise assisting in the sale, transfer, or export of defense articles, and a single instance triggers the obligation.11eCFR. 22 CFR 129.2 – Definitions The definition covers any U.S. person worldwide, any foreign person inside the United States, and any foreign entity owned or controlled by a U.S. person. Providing office space, translation, legal advice, or information for a request-for-proposal response is not brokering, and regular employees acting for their employer are generally excluded unless the activity involves a proscribed country. Stand-alone brokers pay the Tier 1 fee regardless of licensing volume.
The Empowered Official
Every registered company must designate at least one Empowered Official under 22 CFR 120.25. This person must be a U.S. citizen or permanent resident, directly employed by the company, and senior enough to make binding compliance decisions. External consultants, attorneys, and foreign persons cannot fill the role. The Empowered Official has independent authority to review and deny any proposed export that does not comply with ITAR, and bears personal responsibility for the accuracy of every representation the company makes to the government. False statements can produce individual criminal or civil liability.
Getting an Export License
Anyone who intends to export or temporarily import a defense article must obtain DDTC approval before the transfer, unless a specific exemption applies. Permanent exports of unclassified defense articles use Form DSP-5.12eCFR. 22 CFR Part 123 – Licenses for the Export and Temporary Import of Defense Articles – Section 123.1 Temporary imports use DSP-61 and temporary exports use DSP-73. The applicant must already be registered with DDTC before submitting any license application.
Review examines the end user, the ultimate destination of the technology, and whether the transaction serves U.S. foreign policy and national security interests. All exports made under any license or exemption remain subject to end-use monitoring through the State Department’s Blue Lantern program, which verifies that defense articles arrive where they were supposed to go and are used as authorized.13eCFR. 22 CFR 120.17 – End-Use Monitoring
When a License Isn’t Required
ITAR carves out several exclusions that keep companies from applying for licenses they don’t actually need.
Public Domain and General Education
Information already publicly available is not controlled technical data. Under 22 CFR 120.34, information is in the public domain when it is generally accessible through libraries, published periodicals, books, publicly available websites, patents, or conferences open to the public. General scientific, mathematical, and engineering principles commonly taught at schools and universities are also excluded from the technical data definition.4eCFR. 22 CFR 120.33 – Technical Data
Fundamental Research
Basic and applied research at accredited universities whose results are published and shared broadly within the scientific community falls outside ITAR’s reach. This exclusion, rooted in National Security Directive 189, protects open academic inquiry from export licensing requirements. It evaporates the moment a research sponsor imposes publication restrictions or limits who can participate. It also does not cover work done outside the United States, shipments of physical items, or foreign-national access to ITAR-controlled equipment.
End-to-End Encryption
Sending, storing, or transmitting unclassified technical data electronically is not considered an export if the data is secured with end-to-end encryption meeting specific standards. Under 22 CFR 120.54, the encryption must use cryptographic modules compliant with FIPS 140-2 (or its successors) and provide at least 128-bit security strength. The data must be encrypted at the sender’s end and remain encrypted until the authorized recipient decrypts it, with no third party holding the keys.14eCFR. 22 CFR 120.54 – Activities That Are Not Exports, Reexports, Retransfers, or Temporary Imports Data in transit through the internet is not considered stored in whatever country it passes through. The safe harbor disappears if the data is intentionally sent to or stored in a proscribed country, or released unencrypted to an unauthorized person at any point.
Dual-National and Third-Country Employees
Under 22 CFR 126.18, a license is not required to share defense articles, including technical data, with certain dual-national or third-country-national employees. The employee must be a full-time regular employee whose permanent workplace is in a country other than their country of nationality, and cannot be a national of a proscribed country. The employer must implement screening procedures to check for substantive contacts with restricted nations, re-screen periodically, maintain those screening records for five years, and provide written notice to the employee about unauthorized disclosure.15eCFR. 22 CFR 126.18 – Exemptions Regarding Intra-Company, Intra-Organization, and Intra-Governmental Transfers to Employees Who Are Dual Nationals or Third-Country Nationals
Compliance Systems You Need to Maintain
Registration and licensing are entry points. Staying compliant day-to-day requires internal systems that most companies underestimate when they first enter defense trade.
Technology Control Plans
Any organization handling ITAR-controlled technical data should maintain a Technology Control Plan that spells out how the company prevents unauthorized access. A solid plan identifies the controlled information by project, classification, and applicable USML category. It sets physical security measures such as locked storage, restricted-access signage, and labeling of controlled documents. On the information-security side, it addresses encryption standards, password protocols, prohibitions on unencrypted email, and rules for removable storage devices. Every person with access should be identified by name and nationality, screened against the government’s denied-parties lists, and required to sign the plan before beginning work.
Recordkeeping
Registrants must maintain records covering the manufacture, acquisition, disposition, and export of defense articles and technical data, as well as the provision of defense services and brokering activities. Required documentation includes copies of all license applications, exemption-related export records, and information on any political contributions, fees, or commissions connected to the transactions.16eCFR. 22 CFR 122.5 – Maintenance of Records by Registrants
The standard retention period is five years from the expiration of the license or the date of the transaction. Electronic records are acceptable, but the system must be able to reproduce legible paper copies and must prevent untracked alterations. DDTC reserves the right to prescribe longer or shorter periods in individual cases.
What Happens If You Violate ITAR
Penalties come in three forms, and they can stack.
On the criminal side, a person who willfully violates ITAR faces fines of up to $1,000,000 per violation and imprisonment of up to 20 years, or both. This covers unlicensed exports, false statements on license applications, and willful omission of material facts from required reports.17Office of the Law Revision Counsel. 22 USC 2778 – Control of Arms Exports and Imports Penalties are assessed per violation, so a single shipment involving multiple controlled items or multiple unauthorized disclosures can produce multiple charges.
On the civil side, the Assistant Secretary of State for Political-Military Affairs can impose penalties of up to $1,271,078 per violation of 22 U.S.C. 2778, or twice the value of the underlying transaction, whichever is greater.18eCFR. 22 CFR 127.10 – Civil Penalty These amounts adjust for inflation and can be imposed alongside or instead of criminal prosecution. For violations involving prohibited incentive payments under 22 U.S.C. 2779a, penalties reach up to five times the prohibited payment.
The most operationally severe sanction is debarment. Under 22 CFR 127.7, the Assistant Secretary of State for Political-Military Affairs can bar a person or organization from participating directly or indirectly in any defense export.19eCFR. 22 CFR Part 127 – Violations and Penalties – Section 127.7 A debarred company loses the ability to fulfill government contracts, participate in international defense trade, or apply for licenses. For contractors whose business depends on defense work, debarment ends the business.
Reporting Your Own Violations
DDTC strongly encourages companies that discover potential violations to come forward before the government finds out independently. Under 22 CFR 127.12, a voluntary self-disclosure can serve as a mitigating factor when penalties are decided.20eCFR. 22 CFR 127.12 – Voluntary Disclosures To qualify as voluntary, the disclosure must reach DDTC before the government learns the same information from another source and opens an investigation.
Senior management authorization is essential. If a disclosure is filed without senior management’s knowledge, DDTC will not treat it as voluntary. And filing does not guarantee leniency: the department explicitly reserves the right to impose penalties, pursue administrative action, or refer the matter for criminal prosecution. Even so, companies that self-report consistently fare better than those that are caught, and failing to report a known violation is treated as an aggravating factor if the government discovers it later.