What Is Technical Data Under ITAR, EAR, and DFARS?

Technical data under ITAR, EAR, and DFARS is information detailed enough to design, build, test, operate, or maintain a controlled item, but each of the three frameworks defines it for a different purpose: the International Traffic in Arms Regulations (ITAR) uses the term to control exports of defense-related information, the Export Administration Regulations (EAR) use the parallel term “technology” to control dual-use information, and the Defense Federal Acquisition Regulation Supplement (DFARS) uses it to allocate ownership rights in information produced under a defense contract. Getting the right definition matters because the wrong call determines which agency has jurisdiction, whether a license is required, and how large the penalty is if you get it wrong.

The ITAR Definition

Under 22 CFR § 120.33, technical data is information required for the design, development, production, manufacture, assembly, operation, repair, testing, maintenance, or modification of defense articles listed on the United States Munitions List.¹ The Munitions List spans 21 categories, from firearms and ammunition to military aircraft, satellites, and toxicological agents.

The definition also pulls in classified information relating to defense articles and defense services, information covered by an invention secrecy order, and software directly related to defense articles.¹ Software is defined separately elsewhere in ITAR, but software tied to a defense article still lands inside the technical data category.

The controlling question is whether the information is tied to a specific defense article. A general fluid dynamics textbook is not technical data. The same physics inside a document explaining how to calibrate a missile guidance system is.

The EAR Equivalent: “Technology”

The EAR does not use the phrase “technical data.” Under 15 CFR § 772.1, its equivalent term is “technology,” meaning information necessary for the development, production, use, operation, installation, maintenance, repair, overhaul, or refurbishing of an item on the Commerce Control List.² That list covers dual-use items with both civilian and military applications, plus some purely military items that fall below the Munitions List threshold.³

The practical split is jurisdictional. If the underlying item sits on the Munitions List, ITAR applies and the State Department’s Directorate of Defense Trade Controls oversees it. If the item sits on the Commerce Control List, the EAR applies and the Commerce Department’s Bureau of Industry and Security oversees it. Licensing requirements, exceptions, and penalties differ between the two, and getting the jurisdiction wrong is one of the most expensive mistakes a company can make.

The DFARS Definition for Defense Contracts

DFARS clause 252.227-7013 defines technical data as recorded information of a scientific or technical nature, including computer software documentation.⁴ It explicitly excludes computer software itself, as well as financial, administrative, cost or pricing, and management information.

The DFARS definition is doing a different job from ITAR and EAR. It does not control who can see the data across borders. It controls who owns the data produced under a defense contract and what the government can do with it. A contractor generating engineering drawings under a Navy contract has to work all three definitions at once: DFARS sets the ownership rights, ITAR controls who is allowed to view the drawings, and the markings required by each framework are not the same.

Formats That Count

ITAR lists blueprints, drawings, photographs, plans, instructions, and documentation.¹ The EAR’s definition of technology adds models, formulae, tables, engineering design specifications, computer-aided design files, manuals, and information revealed through visual inspection.²

That last item surprises people. Walking a foreign visitor across a manufacturing floor and letting them observe a proprietary machining process can constitute an export of controlled technology, even though nothing was written down or emailed. Oral briefings that disclose controlled technical details count too.

The formats most often controlled in day-to-day practice include:

Engineering drawings and CAD files with dimensional specifications, tolerances, and assembly instructions for controlled components.
Test procedures and results from qualification, environmental, or performance testing of defense articles.
Maintenance and repair manuals that reveal internal configurations or operating parameters.
Manufacturing process documents describing how to fabricate, heat-treat, coat, or otherwise produce controlled items.
Algorithms and design logic tied to the performance of a controlled system.

The common thread is specificity. The information must be detailed enough that a trained professional could use it to reproduce, modify, or maintain a controlled item.

What Does Not Count

ITAR carves out several categories at 22 CFR § 120.33(b):

General scientific, mathematical, or engineering principles commonly taught in schools, colleges, and universities.
Public domain information, meaning material published and generally accessible to the public.
Basic marketing information describing a defense article’s general function, purpose, or system-level capabilities.

The public domain exclusion at 22 CFR § 120.34 is broader than most people assume. It covers information available through public sales, unrestricted subscriptions, open libraries, published patents, and unrestricted distribution at conferences held in the United States, along with information released to the public after approval by the relevant government agency.⁵ It does not cover controlled data that someone posts online without authorization. The release itself has to be lawful.

Fundamental research at accredited U.S. universities also qualifies, but only when the results are ordinarily published and shared broadly within the scientific community. That protection disappears if the researchers accept publication restrictions or if government funding comes with specific access and dissemination controls.⁵ Universities running open research alongside restricted government contracts have to draw and defend that line carefully.

Deemed Exports: Sharing Data Without Sending It Anywhere

One consequence of the technical data definition catches companies flat-footed. Under ITAR, releasing technical data to a foreign person inside the United States counts as a deemed export to every country where that person holds or has held citizenship or permanent residency.⁶ The EAR contains a parallel rule for controlled technology and source code.⁷

The hiring implications are significant. A defense contractor that employs a non-U.S.-citizen engineer and gives that engineer access to ITAR-controlled drawings has effectively exported those drawings to the engineer’s home country. If no license was obtained first, the company has committed an export violation without a single package or file crossing a border. Employers filing H-1B petitions must certify on Form I-129 whether access to controlled technology requires a license and confirm they will obtain one before granting access.

Data Rights Under DFARS

Once technical data exists inside a defense contract, DFARS 252.227-7013 sorts rights in the data by who paid for its development.

Unlimited Rights

Technical data developed entirely with government funding carries unlimited rights, meaning the government can use, modify, reproduce, release, or disclose the data in any manner and for any purpose, including sharing it with other contractors.⁴ The contractor retains no exclusive control.

Limited Rights

Technology developed entirely at private expense carries only limited rights for the government. The government can use the data internally but generally cannot release it externally or use it for manufacturing.⁴ Narrow exceptions exist for emergency repair, release to covered government support contractors, and sharing with foreign governments for evaluation, each with further restrictions. Contractors must mark limited rights data with a specific restrictive legend identifying the contract number, contractor name and address, and the disclosure limitations.⁸ Data delivered without the legend can lose its restricted status.

Government Purpose Rights

Data developed with a mix of private and government funding sits in the middle. The government can use it internally and share it outside the government for government purposes, but cannot authorize commercial use. These rights last five years from contract execution unless the parties negotiate a different duration, and they automatically convert to unlimited rights when the period ends.⁴ Contractors who lose track of the timeline can be surprised when data they still treat as proprietary is freely available across the government’s other contractors.

Penalties for Getting It Wrong

The consequences for mishandling technical data come from more than one enforcement agency and stack quickly.

Under the Arms Export Control Act, criminal violations carry fines up to $1,000,000 per violation and imprisonment up to 20 years, or both.⁹ Civil penalties for ITAR violations can reach the greater of $1,271,078 or twice the value of the underlying transaction. That figure was set by the State Department’s 2025 inflation adjustment and remains in effect for 2026 after the Office of Management and Budget canceled the 2026 annual adjustment when the Bureau of Labor Statistics did not publish the required consumer price data.

EAR violations run on their own track. Criminal fines for willful violations can reach $1,000,000 or five times the value of the exports, and individuals face up to 10 years of imprisonment. Beyond monetary penalties, the Bureau of Industry and Security can deny export privileges entirely, cutting a company off from international commerce in controlled items.

Both agencies can pursue enforcement in parallel, and violations discovered during audits usually reveal patterns rather than one-off mistakes. A single classification failure repeated across dozens of files, employees, or projects becomes dozens or hundreds of counted violations. Self-disclosure and cooperation typically produce reduced penalties, but the baseline exposure is high enough that classifying technical data correctly on the front end is always cheaper than defending the call later.

1
eCFR. 22 CFR 120.33 – Technical Data
2
eCFR. 15 CFR 772.1 – Definitions of Terms as Used in the Export Administration Regulations
3
Bureau of Industry and Security. 15 CFR Part 730 – General Information
4
eCFR. 48 CFR 252.227-7013 – Rights in Technical Data – Other Than Commercial Products and Commercial Services
5
eCFR. 22 CFR 120.34 – Public Domain
6
eCFR. 22 CFR Part 120 – Purpose and Definitions
7
eCFR. 15 CFR 734.13 – Export
8
Acquisition.GOV. Rights in Technical Data – Other Than Commercial Products and Commercial Services
9
Office of the Law Revision Counsel. 22 USC 2778 – Control of Arms Exports and Imports