What Does ITAR Stand For? Controls, Registration, and Penalties

ITAR stands for the International Traffic in Arms Regulations, the federal rules that control the export, temporary import, and brokering of U.S. military and defense-related items. The Directorate of Defense Trade Controls (DDTC), part of the U.S. Department of State, administers the regulations and reviews license applications before any controlled item leaves the country or reaches foreign hands. The legal foundation is the Arms Export Control Act, originally enacted in 1968 as the Foreign Military Sales Act and later renamed and expanded through Public Law 94-329 in 1976.¹ For any business that touches defense technology, the rules are worth understanding early: criminal penalties reach $1 million per violation and 20 years in prison.²

What ITAR Controls

Everything ITAR governs is cataloged on the United States Munitions List (USML), codified at 22 CFR Part 121. The list is organized into 21 categories covering firearms, ammunition, military aircraft, submersible vessels, chemical and biological agents, and much more.³ It is deliberately broad. A part that looks innocuous on its own still falls under ITAR if it was specifically designed or modified for a military use, so a circuit board or sensor with no obviously military appearance can pull an entire product line into the regime.

The USML is not static. The State Department revised it in 2025, reclassifying or removing certain items, so a product that clearly sat in one category a few years ago may need a fresh look. Misclassification is one of the more common compliance failures, and small mistakes do not carry small consequences.

Who Has to Register

Any U.S. person or company that manufactures, exports, temporarily imports, or provides defense services involving USML items must register with the DDTC. The threshold is low: even a single instance of manufacturing a defense article triggers the requirement, whether or not you plan to ship anything abroad.⁴ A domestic manufacturer selling exclusively to the U.S. military still has to register. Brokers who arrange defense trade transactions between other parties register separately under Part 129.

Handling USML items without a valid registration is not a paperwork problem, it is a violation. A lapsed registration does not pause your compliance obligations either. Registration must also remain active as a prerequisite for any license or other DDTC authorization.

Registered entities must designate at least one empowered official — a U.S. person directly employed by the company in a management or policy role who signs license applications and understands the criminal, civil, and administrative consequences of ITAR violations.⁵ This person must have independent authority to investigate proposed exports, verify legality, and refuse to sign an application without retaliation. If the empowered official can be overruled or punished for blocking a questionable deal, the company does not have a genuine compliance structure, and regulators look for exactly that when assessing whether a program is real or performative.

Technical Data and Deemed Exports

ITAR does not stop at physical hardware. Technical data — information required for the design, production, operation, repair, or modification of defense articles — is controlled on the same terms, and includes blueprints, drawings, photographs, plans, instructions, and related documentation.⁶

Information that is genuinely in the public domain is excluded, but the regulations define that narrowly. It covers material available through bookstores, public libraries, published patents, unrestricted conferences, or fundamental university research where results are freely shared in the scientific community.⁷ If a university accepts restrictions on publishing its research, that research no longer qualifies as public domain under ITAR.

The concept that catches the most people off guard is the deemed export. Under 22 CFR 120.50, releasing controlled technical data to a foreign person inside the United States counts as an export to every country where that person holds citizenship or permanent residency.⁷ Showing a foreign-national colleague a restricted engineering file at your office in Virginia is legally the same as shipping that file overseas. Companies with international employees or foreign visitors need internal access controls that go well beyond ordinary cybersecurity.

Embargoed Countries and Denied Parties

Certain destinations face a blanket policy of denial for defense exports under 22 CFR 126.1. The fully embargoed list includes Belarus, Burma, China, Cuba, Iran, North Korea, Syria, and Venezuela.⁸ Additional countries face partial restrictions or country-specific conditions, among them Afghanistan, the Central African Republic, the Democratic Republic of the Congo, Eritrea, Ethiopia, Haiti, Iraq, Lebanon, Libya, Nicaragua, Russia, Somalia, South Sudan, Sudan, and Zimbabwe.

Beyond country restrictions, the DDTC maintains a list of debarred parties — individuals and entities barred from participating in defense trade after being convicted of violating the Arms Export Control Act. Debarment prohibits any direct or indirect involvement in exporting defense articles or providing defense services, and it lasts until the DDTC grants reinstatement and publishes notice in the Federal Register.⁹ The published list is only a subset of ineligible parties, and license applicants are expected to screen all parties to a transaction before submitting.

When ITAR May Not Apply: The EAR Boundary

Not every controlled item falls under ITAR. The Export Administration Regulations (EAR), administered by the Bureau of Industry and Security at the Department of Commerce, govern “dual-use” items with both civilian and potential military applications. The distinction matters because ITAR controls are far more restrictive. USML items generally require a license for export almost anywhere, while many EAR-controlled items move under license exceptions.

If you are unsure which regime applies, you can submit a commodity jurisdiction request to the DDTC using Form DS-4076. The State Department, consulting other agencies, then decides whether the item belongs on the USML or the Commerce Control List.¹⁰ You do not need to be registered with the DDTC to file one, which helps companies still deciding whether ITAR reaches them.¹¹

What Violations Cost

ITAR violations carry both criminal and civil consequences, and the government pursues individuals as well as organizations.

On the criminal side, anyone who willfully violates the Arms Export Control Act or makes a false statement in a registration or license application faces fines of up to $1 million per violation and up to 20 years in prison.² The word “willfully” is doing real work: prosecutors must show the person knew the conduct was illegal, not merely that a mistake occurred. Investigators tend to have little trouble establishing that standard when a company skipped registration entirely or never put any compliance controls in place.

Civil penalties are assessed administratively and do not require a criminal conviction. The inflation-adjusted maximum currently exceeds $1.27 million per violation, or twice the value of the underlying transaction, whichever is greater. Because civil enforcement does not require proof of willful intent, it is the more common tool for inadvertent problems like misclassifications or late filings.

Individuals convicted under the Arms Export Control Act are also subject to statutory debarment, which bars them from any direct or indirect participation in defense trade until they successfully petition for reinstatement.⁹

1
U.S. Government Publishing Office. Public Law 94-329 – International Security Assistance and Arms Export Control Act of 1976
2
Office of the Law Revision Counsel. 22 U.S. Code 2778 – Control of Arms Exports and Imports
3
eCFR. 22 CFR Part 121 – The United States Munitions List
4
eCFR. 22 CFR 122.1 – Registration Requirements, Exemptions, and Purpose
5
eCFR. 22 CFR 120.67 – Empowered Official
6
eCFR. 22 CFR 120.33 – Technical Data
7
eCFR. 22 CFR Part 120 – Purpose and Definitions
8
eCFR. 22 CFR 126.1 – Prohibited Exports, Imports, and Sales To or From Certain Countries
9
U.S. Department of State – Directorate of Defense Trade Controls. Debarred Parties
10
U.S. Department of State – Directorate of Defense Trade Controls. FAQ – What Is a Commodity Jurisdiction Determination
11
U.S. Department of State – Directorate of Defense Trade Controls. Commodity Jurisdictions (CJs)