Deemed export: proving who authorized a foreign national's access to technical data
Export control has a concept most engineering organisations handle by accident: showing a drawing to a colleague can be an export. The authorisation that makes it lawful is a determination by an empowered official, recorded in a compliance system that has no runtime relationship with the file server.
Who authorised the foreign national's access to technical data?
A release decision made by an empowered official, usually recorded as a permission grant in a system. Deemed export rules treat that access as an export, so the question is not whether a control existed but whether you can show which individual authorised which person's access to which data.
- Access control systems model permission. They do not model the authorisation basis — licence, exemption or exception — that makes the access lawful.
- Drift between the technology control plan and the actual access lists is invisible until an audit or a voluntary disclosure.
- Foreign person status is a legal category, not a suspicion, and any design or article that blurs that is doing harm.
Part of Defense industrial base identity
A definition first, stated carefully
Under US export control regimes, releasing controlled technology or technical data to a foreign person located in the United States is treated as an export to that person's country — a deemed export. It may require a licence or fall under an exemption or exception.
A foreign person is a legal category defined by immigration and citizenship status. It is not a risk indicator, not a loyalty judgement, and not a reason for suspicion. Engineers subject to these rules are colleagues doing their jobs under a regulatory constraint imposed on their employer.
Any compliance programme — or article — that drifts from that framing produces both legal exposure and real harm to people. It is worth stating explicitly before discussing mechanism.
Why this became an operational problem
Deemed export used to be an occasional licensing event: a named researcher, a defined project, a licence application months in advance.
Three changes made it continuous. Engineering teams are globally distributed. Technical data lives in cloud-hosted product lifecycle and collaboration systems rather than in a controlled room. And role changes happen weekly rather than annually.
Where the two systems diverge
| System | What it holds | What it does not |
|---|---|---|
| Access control (directory, PLM, file shares) | Who can open what | Why they are permitted to |
| Technology control plan | The authorisation basis per person and data class | Any enforcement |
| HR system | Employment and, sometimes, status | Access |
| Licence file | The licence, its scope and conditions | Which files it covers |
Nothing joins them at the moment of access. The join is performed periodically, by hand, by a compliance officer comparing lists — and drift accumulates between those comparisons.
What a voluntary disclosure costs
When drift is discovered, the responsible course is usually a voluntary self-disclosure. Preparing one means reconstructing, retrospectively, who had access to what, when, and under what authorisation.
That reconstruction is the expensive part. It takes months of counsel and compliance time, and its quality is limited by the logs that happen to exist. Companies that have done it describe the reconstruction as costing more than the underlying issue.
The Deemed Export Authorization Chain
Bind the authorisation basis to the access event.
delegation:
issuer: [empowered official, credential]
subject: [individual, credential]
basis: licence = [number] | exemption = [citation] | exception = [citation]
scope: data_classification = [USML category | ECCN]
projects = [list]
notAfter: [licence expiry or review date]
conditions: [licence provisos, as stated]
access_receipt:
artifact: [identifier, hash]
accessor: [credential assertion]
under: [delegation reference]An access to controlled technical data now references the authorisation that permits it. Drift becomes visible immediately — an access with no valid delegation fails rather than succeeding silently.
Revocation, which is where the operational value is
Status changes. A licence expires, a project ends, an exemption ceases to apply, an individual's circumstances change.
Today each of those requires someone to remember to update an access list. With expiring delegations, the default is that authority ends and must be renewed — which inverts the failure mode from silent over-permission to visible under-permission, and the second is far easier to detect and fix.
What an empowered official gets
A record of their own determinations, signed by them, referencing the licence and its provisos. Empowered officials carry personal responsibility for these determinations, and currently their record is an entry in a compliance system maintained by someone else.
That framing tends to be what gets this funded, because the person who has to sign the voluntary disclosure is also the person who signs the determinations.
What the record must connect
| Element | Usual home |
|---|---|
| The individual and their nationality | HR system |
| The technical data and its classification | Engineering or PLM |
| The licence or exemption relied on | Trade compliance spreadsheet |
| The authorising official's decision | An IAM permission change |
Four systems, four records, no binding. An investigation has to reconstruct the decision from a permission grant, which shows that access was configured rather than that a release was authorised.
Objections and honest limits
“Our trade compliance team reviews every grant.” And records the review where? If the answer is an email or a spreadsheet row, the reconstruction problem remains.
“The licence covers the category, so individual records are unnecessary.” The licence establishes what is permissible. The obligation is to show what actually happened, which is per-person and per-dataset.
Binding a deemed export decision
- Make the release decision an explicit event. Not a side effect of a permission change.
- Render what is being released. The data scope, the classification and the basis relied on.
- Sign it as the empowered official. A named individual, not the IAM administrator who executed it.
- Bind the grant to the decision. So a scope change requires a new decision rather than inheriting the old one.
Terms used here
- Deemed export
- Release of controlled technical data to a foreign national within the country, treated as an export to their country of nationality.
- Empowered official
- The individual authorised to make export control determinations on the organisation's behalf.
- Technical data
- Information required for the design, development, production or use of a controlled item.
Frequently asked questions
Is foreign person status a security concern? No. It is a legal category defined by immigration and citizenship status, and the regulatory constraint applies to the employer. Treating it as a suspicion is both wrong and a source of discrimination exposure.
Do agencies prescribe an evidence format? No. ITAR and EAR establish the authorisation requirements. The evidentiary form is left to the company, which is why this is a proposal rather than a compliance requirement.
How does this handle licence provisos? The provisos are carried in the delegation, so an access that would breach a proviso has no valid authorisation rather than relying on someone remembering the condition.
What about cloud-hosted engineering systems? Those are where drift is worst, because access is provisioned quickly and reviewed slowly. They are the right place to start.
Isn't a permission grant the record? It shows access was configured. It does not show that a release decision was made, by whom, or on what basis.
Who should sign? The empowered official making the determination, not the administrator who executed the permission change.
Why bind the grant to the decision? So that widening the data scope requires a new determination rather than silently inheriting the original one.
Where this fits in Manav
Manav binds the authorising individual to the exact access or release being authorised, and produces a receipt a prime, a government customer or an investigator can verify without access to the contractor's systems.
Sources and further reading
- Bureau of Industry and Security — Export Administration Regulations
- Published export enforcement actions and consent agreements.
- Industry practice guidance on technology control plans.
- 22 CFR Parts 120-130 — ITAR