{
 "slug": "deemed-export-authorization-chain",
 "topic_id": "TOPIC-201",
 "cluster": "Defense Industrial Base, CUI & Export-Control Identity",
 "tier": "Tier A",
 "title": "Deemed export: proving who authorized a foreign national's access to technical data",
 "summary": "Releasing controlled technical data to a foreign person in the United States is an export requiring authorization. In practice access is governed by directory groups, and the authorization basis lives in a spreadsheet.",
 "lede": "Export control has a concept most engineering organisations handle by accident: showing a drawing to a colleague can be an export. The authorisation that makes it lawful is a determination by an empowered official, recorded in a compliance system that has no runtime relationship with the file server.",
 "date": "2025-11-14",
 "category": "Compliance",
 "author_id": "tobias-lindqvist-rao",
 "tags": [
  "deemed export",
  "ITAR",
  "EAR",
  "export control",
  "technical data",
  "technology control plan"
 ],
 "image_title": "Deemed Export Authorization Chain",
 "schema": "Article",
 "key_takeaways": [
  "Access control systems model permission. They do not model the authorisation basis — licence, exemption or exception — that makes the access lawful.",
  "Drift between the technology control plan and the actual access lists is invisible until an audit or a voluntary disclosure.",
  "Foreign person status is a legal category, not a suspicion, and any design or article that blurs that is doing harm."
 ],
 "body": [
  {
   "type": "h2",
   "text": "A definition first, stated carefully"
  },
  {
   "type": "diagram",
   "kind": "chain",
   "alt": "A deemed export is an access grant with export consequences",
   "caption": "The record is a permission change. The obligation is about a release decision.",
   "nodes": [
    {
     "label": "Foreign national joins a project",
     "note": "HR event"
    },
    {
     "label": "Access granted",
     "note": "a permission change",
     "bad": true
    },
    {
     "label": "Technical data viewed",
     "note": "= an export"
    },
    {
     "label": "Who authorised the release?",
     "note": "an account in an IAM log",
     "bad": true
    }
   ]
  },
  {
   "type": "p",
   "html": "Under US export control regimes, releasing controlled technology or technical data to a foreign person located in the United States is treated as an export to that person's country — a deemed export. It may require a licence or fall under an exemption or exception."
  },
  {
   "type": "p",
   "html": "A foreign person is a legal category defined by immigration and citizenship status. It is not a risk indicator, not a loyalty judgement, and not a reason for suspicion. Engineers subject to these rules are colleagues doing their jobs under a regulatory constraint imposed on their employer."
  },
  {
   "type": "p",
   "html": "Any compliance programme — or article — that drifts from that framing produces both legal exposure and real harm to people. It is worth stating explicitly before discussing mechanism."
  },
  {
   "type": "h2",
   "text": "Why this became an operational problem"
  },
  {
   "type": "p",
   "html": "Deemed export used to be an occasional licensing event: a named researcher, a defined project, a licence application months in advance."
  },
  {
   "type": "p",
   "html": "Three changes made it continuous. Engineering teams are globally distributed. Technical data lives in cloud-hosted product lifecycle and collaboration systems rather than in a controlled room. And role changes happen weekly rather than annually."
  },
  {
   "type": "h2",
   "text": "Where the two systems diverge"
  },
  {
   "type": "table",
   "head": [
    "System",
    "What it holds",
    "What it does not"
   ],
   "rows": [
    [
     "Access control (directory, PLM, file shares)",
     "Who can open what",
     "Why they are permitted to"
    ],
    [
     "Technology control plan",
     "The authorisation basis per person and data class",
     "Any enforcement"
    ],
    [
     "HR system",
     "Employment and, sometimes, status",
     "Access"
    ],
    [
     "Licence file",
     "The licence, its scope and conditions",
     "Which files it covers"
    ]
   ]
  },
  {
   "type": "p",
   "html": "Nothing joins them at the moment of access. The join is performed periodically, by hand, by a compliance officer comparing lists — and drift accumulates between those comparisons."
  },
  {
   "type": "h2",
   "text": "What a voluntary disclosure costs"
  },
  {
   "type": "p",
   "html": "When drift is discovered, the responsible course is usually a voluntary self-disclosure. Preparing one means reconstructing, retrospectively, who had access to what, when, and under what authorisation."
  },
  {
   "type": "p",
   "html": "That reconstruction is the expensive part. It takes months of counsel and compliance time, and its quality is limited by the logs that happen to exist. Companies that have done it describe the reconstruction as costing more than the underlying issue."
  },
  {
   "type": "h2",
   "text": "The Deemed Export Authorization Chain"
  },
  {
   "type": "p",
   "html": "Bind the authorisation basis to the access event."
  },
  {
   "type": "code",
   "text": "delegation:\n  issuer:   [empowered official, credential]\n  subject:  [individual, credential]\n  basis:    licence = [number] | exemption = [citation] | exception = [citation]\n  scope:    data_classification = [USML category | ECCN]\n            projects = [list]\n  notAfter: [licence expiry or review date]\n  conditions: [licence provisos, as stated]\n\naccess_receipt:\n  artifact: [identifier, hash]\n  accessor: [credential assertion]\n  under:    [delegation reference]"
  },
  {
   "type": "p",
   "html": "An access to controlled technical data now references the authorisation that permits it. Drift becomes visible immediately — an access with no valid delegation fails rather than succeeding silently."
  },
  {
   "type": "h2",
   "text": "Revocation, which is where the operational value is"
  },
  {
   "type": "p",
   "html": "Status changes. A licence expires, a project ends, an exemption ceases to apply, an individual's circumstances change."
  },
  {
   "type": "p",
   "html": "Today each of those requires someone to remember to update an access list. With expiring delegations, the default is that authority ends and must be renewed — which inverts the failure mode from silent over-permission to visible under-permission, and the second is far easier to detect and fix."
  },
  {
   "type": "h2",
   "text": "What an empowered official gets"
  },
  {
   "type": "p",
   "html": "A record of their own determinations, signed by them, referencing the licence and its provisos. Empowered officials carry personal responsibility for these determinations, and currently their record is an entry in a compliance system maintained by someone else."
  },
  {
   "type": "p",
   "html": "That framing tends to be what gets this funded, because the person who has to sign the voluntary disclosure is also the person who signs the determinations."
  },
  {
   "type": "h2",
   "text": "What the record must connect"
  },
  {
   "type": "table",
   "caption": "Four elements, and where they usually live",
   "head": [
    "Element",
    "Usual home"
   ],
   "rows": [
    [
     "The individual and their nationality",
     "HR system"
    ],
    [
     "The technical data and its classification",
     "Engineering or PLM"
    ],
    [
     "The licence or exemption relied on",
     "Trade compliance spreadsheet"
    ],
    [
     "<strong style=\"font-weight:600\">The authorising official's decision</strong>",
     "<strong style=\"font-weight:600\">An IAM permission change</strong>"
    ]
   ]
  },
  {
   "type": "p",
   "html": "Four systems, four records, no binding. An investigation has to reconstruct the decision from a permission grant, which shows that access was configured rather than that a release was authorised."
  },
  {
   "type": "h2",
   "text": "Objections and honest limits"
  },
  {
   "type": "p",
   "html": "<strong style=\"font-weight:600\">“Our trade compliance team reviews every grant.”</strong> And records the review where? If the answer is an email or a spreadsheet row, the reconstruction problem remains."
  },
  {
   "type": "p",
   "html": "<strong style=\"font-weight:600\">“The licence covers the category, so individual records are unnecessary.”</strong> The licence establishes what is permissible. The obligation is to show what actually happened, which is per-person and per-dataset."
  }
 ],
 "faq": [
  {
   "q": "Is foreign person status a security concern?",
   "a": "No. It is a legal category defined by immigration and citizenship status, and the regulatory constraint applies to the employer. Treating it as a suspicion is both wrong and a source of discrimination exposure."
  },
  {
   "q": "Do agencies prescribe an evidence format?",
   "a": "No. ITAR and EAR establish the authorisation requirements. The evidentiary form is left to the company, which is why this is a proposal rather than a compliance requirement."
  },
  {
   "q": "How does this handle licence provisos?",
   "a": "The provisos are carried in the delegation, so an access that would breach a proviso has no valid authorisation rather than relying on someone remembering the condition."
  },
  {
   "q": "What about cloud-hosted engineering systems?",
   "a": "Those are where drift is worst, because access is provisioned quickly and reviewed slowly. They are the right place to start."
  },
  {
   "q": "Isn't a permission grant the record?",
   "a": "It shows access was configured. It does not show that a release decision was made, by whom, or on what basis."
  },
  {
   "q": "Who should sign?",
   "a": "The empowered official making the determination, not the administrator who executed the permission change."
  },
  {
   "q": "Why bind the grant to the decision?",
   "a": "So that widening the data scope requires a new determination rather than silently inheriting the original one."
  }
 ],
 "sources": [
  {
   "t": "Bureau of Industry and Security — Export Administration Regulations",
   "u": "https://www.bis.doc.gov/index.php/regulations/export-administration-regulations-ear"
  },
  {
   "t": "Published export enforcement actions and consent agreements."
  },
  {
   "t": "Industry practice guidance on technology control plans."
  },
  {
   "t": "22 CFR Parts 120-130 — ITAR",
   "u": "https://www.ecfr.gov/current/title-22/chapter-I/subchapter-M"
  }
 ],
 "related": [
  {
   "slug": "cross-boundary-cui-access",
   "title": "Who touched the CUI?",
   "category": "Compliance"
  },
  {
   "slug": "release-approval-receipt",
   "title": "Engineering release and configuration control",
   "category": "Compliance"
  },
  {
   "slug": "affirmation-evidence-standard",
   "title": "CMMC Phase II is suspended",
   "category": "Compliance"
  },
  {
   "slug": "escort-handover-receipt",
   "title": "Visitor escort assignment and insider threat",
   "category": "Compliance"
  }
 ],
 "image": "https://cdn.twc.sh/images/igcache/Deemed%20Export%20Authorization%20Chain/1200_630/blog.jpg",
 "wordcount": 944,
 "url": "/blog/deemed-export-authorization-chain.html",
 "reading_time": "4 min read",
 "seo_title": "Deemed export: authorizing foreign national access",
 "meta_description": "Releasing controlled technical data to a foreign person in the United States is an export requiring authorization.",
 "hub": {
  "slug": "topics/dib-identity",
  "title": "Defense industrial base identity"
 },
 "answer": "A release decision made by an empowered official, usually recorded as a permission grant in a system. Deemed export rules treat that access as an export, so the question is not whether a control existed but whether you can show which individual authorised which person's access to which data.",
 "answer_q": "Who authorised the foreign national's access to technical data?",
 "glossary": [
  {
   "term": "Deemed export",
   "def": "Release of controlled technical data to a foreign national within the country, treated as an export to their country of nationality."
  },
  {
   "term": "Empowered official",
   "def": "The individual authorised to make export control determinations on the organisation's behalf."
  },
  {
   "term": "Technical data",
   "def": "Information required for the design, development, production or use of a controlled item."
  }
 ],
 "checklist": {
  "title": "Binding a deemed export decision",
  "id": "bind",
  "desc": "Four steps.",
  "steps": [
   {
    "name": "Make the release decision an explicit event.",
    "text": "Not a side effect of a permission change."
   },
   {
    "name": "Render what is being released.",
    "text": "The data scope, the classification and the basis relied on."
   },
   {
    "name": "Sign it as the empowered official.",
    "text": "A named individual, not the IAM administrator who executed it."
   },
   {
    "name": "Bind the grant to the decision.",
    "text": "So a scope change requires a new decision rather than inheriting the old one."
   }
  ]
 },
 "cta": {
  "title": "Where this fits in Manav",
  "html": "Manav binds the authorising individual to the exact access or release being authorised, and produces a receipt a prime, a government customer or an investigator can verify without access to the contractor's systems.",
  "href": "../docs.html",
  "label": "See access receipts"
 }
}