Newsletter - May 2023
Stony Brook University’s Research Security Program
The program was created to assist faculty with compliance requirements (i.e., export control, disclosure, international travel, international activities and cybersecurity) by providing information, guidance and resources. This inter-disciplinary program is a collaboration between many university-wide offices in response to campus policies, sponsor requirements and federal regulations.
This newsletter series will highlight different areas of the program with targeted discussions and case studies to assist the campus community with compliance.
International Travel Considerations
The SBU campus community travels internationally on university-related business (e.g., conferences, sabbaticals, research, surveys, collaborations, delegations, student recruitment) to many locations and may bring university-owned items (e.g., laptops, cellphones, materials, data, equipment).
When planning your trip the following things should be considered:
- Where are you going?
- Who will you be meeting with?
- What will you be doing?
- What are you bringing with you?
- What additional items are you bringing back with you?
Where are you going?
Travel to international destinations for university-related business requires prior campus approval. The campus review includes areas such as: security risks, government regulations, and allowability for source of funds.
- International travelers should always review information available on the U.S. State Department International Travel Website before traveling. These travel advisories take into consideration traveler safety by examining areas like political climate, crime, risk of detention, terrorism, health.
- Travel to a destination where the U.S. Department of State has issued a Level 3 or 4 Advisory may not be approved therefore travelers are cautioned to submit these requests in
Concur prior to purchasing airline tickets or making any other financial obligations.
- Travel to a destination where the U.S. Department of Treasury, Office of Foreign Asset Controls (OFAC), has issued a
comprehensive sanction may require a specific license or documentation of a general license. In particular,
the SBU community should be aware that conducting activities in Iran and Cuba require prior review and approval by the Director of Research Security.
Resources:
- FBI: Safety and Security for Business Professionals Traveling Abroad Brochure
- FBI: Safety and Security for U.S. Students Traveling Abroad Brochure
Who will you be meeting with?
- U.S. government agencies, as well as other country’s government agencies, maintain list of entities and individuals that are prohibited from participating in certain types of exchanges and/or activities. These entities and individuals are usually called a restricted party or denied party.
- In some cases, you may be prohibited from sending any items or technology to a restricted party without a U.S. government authorization (license). In other cases, you may need to document why a U.S. government authorization (license) was not required to send items or technology to a restricted party.
- If you want to engage with an entity or individual that appears on one of these lists contact the Director of Research Security beforehand.
Resources:
- The University has software (Descartes Visual Compliance) to assist in screening for restricted parties. How to conduct a Restricted Party Screening (RPS) which includes instructions on how to register for Descartes Visual Compliance.
- U.S. International Trade Administration Consolidated Screening List offers additional information about these government lists and a free access screening tool.
Reminder About Export Controls
As a reminder from the last issue, U.S. export control laws, primarily the Export Administration Regulations (EAR) and International Traffic In Arms Regulations (ITAR), control the export (e.g., shipment, transmission, or hand-carry) of physical items and technology/technical data.
What will you be doing?
International travel can be for many different purposes. Whether you are attending/presenting at a conference, conducting field research, meeting with collaborators, going on sabbatical, or attending training, it is important to understand what information can be freely shared.
- The export regulations define publicly available information that is not subject to the regulations. Information not captured under these exemptions may require an U.S. government authorization
(license).
- Sharing export-controlled information in a foreign location requires knowledge of the citizenship of the person that is receiving the information. A U.S. government authorization (license) may not be required for the country that you are visiting but if the recipient is from a different country a license may be required.
- Best practice is to share information that is already, or is intended to be, published or otherwise made freely available.
What are you bringing with you?
Laptops, cell phones, storage device and research equipment/supplies:
- In general, standard business laptops, cell phone or storage device either don’t require a U.S. government export authorization (license) for the destination (e.g., Germany, England) or can be taken under the Tools of the Trade license exception to the Export Administration Regulations. This does not apply to Country Group E:1 (Cuba, Iran, North Korea, Syria) of the Export Administration Regulations.
- SBU: IT Security Considerations While Traveling
- The National Counterintelligence and Security Center: Traveling Overseas with Mobile Phones, Laptops, PDAs, and Other Electronic Devices
- SBU: Cybersecurity (Department of Information Technology)
Field Equipment:
- In general, most commercial off-the-shelf field equipment will not require a U.S. government export authorization (license) or can be taken under the Tools of the Trade license exception to the Export Administration Regulations (TMP- Temporary Export).
- However, items that are considered best-in-class, military grade, non-mass market
encryption software, biologics, viruses, or pathogens or items that required an end-user
statement or may require a U.S. government export authorization (license).
Tools of the Trade Requirements (TMP - Temporary Export)
Eligible items are usual and reasonable kinds and quantities of tools of trade for use in a lawful enterprise or undertaking of the exporter.
You must:
- Be a U.S. person or employee of U.S. person.
- Bring the item back with or within 12 months.
- Always keep the item under your effective control.
- Take precautions against the unauthorized release of software or technology.
Does not apply to:
- Countries listed in Country Group E:1
- Items or technical data subject to the International Traffic in Arms Regulations (ITAR) or the Assistance to Foreign Atomic Energy Activities (AFAEA).
- Satellite or space-related equipment, components, software controlled under the Export Administration Regulations.
- Encryption items controlled under ECCN 5E002 of the Export Administration Regulations.
Always contact the Director for Research Security before traveling if:
- The laptop, cellphone, or storage device contains export-controlled software/technical data.
- The item is military grade field equipment/supplies.
- The field equipment/supplies are destined for an embargoed country.
- The field equipment/supplies will be left at the foreign offsite location.
- The item will be used for military, nuclear or non-proliferation purposes.
- The item is being shipped prior to the trip.
- An end-use agreement was required during the procurement process.
- You are not sure whether a license exception applies, or you think you may need a license.
Hazardous chemical, biological, radiological or other infectious materials.
Transportation (in any manner) of hazardous materials must comply with shipping regulations and may require special permits. Training requirements and shipping information is available on the SBU's Department of Environmental Health & Safety website.
Other agencies – both foreign and U.S. may have additional requirements.
- Check destination requirements for any import regulations that may affect entrance.
- Other U.S. agencies (e.g., USDA, CDC, or the FDA) may require permits when exporting items under their authority.
- Consider an ATA Carnet. More information about ATA Carnets can be found the U.S. Customs and Border Protection website. (ATA Carnets are not a replacement for other required import/export permits or licenses.)
What additional items are you bringing back with you?
Samples/Materials
Researchers conducting field research or collaborating with partners may return with samples/materials. Transfer of these samples/materials into the U.S. may:
- Require permits from the foreign government.
- Require permits from a U.S. agency. The U.S. Customs and Borders Protection website maintains links to U.S. government agencies import guides.
Researchers should consult with the appropriate campus offices to assure compliance with campus policies:
Targeted Discussion: Traveling Internationally – Case Studies
- Where are you going?
- Who will you be meeting with?
- What will you be doing?
- What are you bringing with you?
- What additional items are you bringing back with you?
These are all very important questions when you are travelling internationally. If you have any questions, contact the Director for Research Security. Below are a few case examples meant to highlight some common scenarios.
Case Study 1: Conference Attendance
A professor from the Sociology department is traveling to France to attend a conference. The conference is open to professionals in the field (anyone who wants to attend and pay the conference fees can attend). They will bring their cellphone and laptop. They don’t plan on bringing anything back with them other than conference materials/handouts.
- Where are you going? France. The U.S. Department of State currently lists France as a Level 2 travel destination and the U.S. Department of Treasury does not have any sanction programs on France. The professor should review the information provided on the U.S. Department of State website.
- Who will you be meeting with? Conference attendees.
- What will you be doing? Attend a conference. If the professor wanted to share information that is, or may be, export-controlled then they should conduct a restricted party screening and evaluation for whether a U.S. export authorization (license) is required for the person that they want to share the information with. Conference attendees should be careful to provide only publicly available information to other conference attendees.
- What are you bringing with you? Laptop and cellphone. Standard business laptops and cellphones do not require a U.S. export authorization (license) to go to France as long as no additional software has been installed and there is no export-controlled information stored on the device.
- What additional items are you bringing back with you? Conference materials/handouts. No additional import/export requirements.
Case Study 2: Sabbatical
A professor from the Engineering department will be traveling to Pontifical Catholic University of Peru for their sabbatical. They have a long history of collaboration with a colleague at this university and have written joint publications. They will bring their university owned laptop and cellphone and will use their laptop to conduct research at Pontifical Catholic University of Peru. The laptop has some standard business mass-market software installed (Duo and Bitlocker for Windows). They plan to bring some prototypes back to the U.S.
- Where are you going? Peru. The U.S. Department of State currently lists Peru as a Level 3 travel destination and the U.S. Department of Treasury does not have any sanction programs on Peru. The professor should review the information provided on the U.S. Department of State website. A campus review will be conducted at the time that travel is being, or anticipated to be, booked.
- Who will you be meeting with? Collaborator. Since this is a long-standing collaboration, a restricted party screening should have previously been completed for both the collaborator and the university. If not, then the professor should complete a restricted party screening.
- What will you be doing? Conduct research. The research should be fundamental research as defined by the federal government in NSDD-189. The results of Fundamental Research (the information) are intended to be published and are not subject to the Export Administration Regulations. If the proposed research is not intended to be published or is in an area controlled under the International Traffic in Arms Regulations, the Director for Research Security should be consulted.
- What are you bringing with you? Laptop and cellphone. The laptop has had standard off-the-shelf mass market software added. These items can be taken as Tools of the Trade.
- What additional items are you bringing back with you? Prototype. Importing items from overseas may require an authorization from the country of origin and/or a permit from a U.S. government agency.
Case Study 3: Presentation
A professor from the Chemistry department will be traveling to Iran to present their research at a seminar in Iran. They want to bring their cellphone and their presentation on a memory stick. They do not plan on bringing anything back with them.
- Where are you going? Iran. The U.S. Department of State currently lists Iran as a Level 4 travel destination and the U.S. Department of Treasury has a comprehensive sanction program against Iran. A campus review is required prior to engaging in any activity.
- Who will you be meeting with? Conference attendees.
- What will you be doing? Presentation based on a recently published manuscript. STOP and contact the Director for Research Security a U.S. government authorization (license) is required for this activity. A description about the seminar and attendees will need to be provided with a license application. Restricted party screenings will need to be completed.
- What are you bringing with you? Cellphone and memory stick with presentation. License exceptions are not available for Iran. Further review is required.
- What additional items are you bringing back with you? Nothing
Remember to Update your Disclosure Profile
If you travel for activities that are related to your institutional responsibilities (e.g., consulting, conference presentations, speakers’ bureau, research) and a third party pays for or reimburses you for travel – you are required to update your Disclosure Profile in myResearch Conflict of Interest module. Please note that any recent travel can be updated during the upcoming annual disclosure period (May 15 to June 14). See the campus Disclosure of External Interests & Commitments Policy to see if you are required to disclose.