ITAR: International Traffic in Arms Regulations Guide

The International Traffic in Arms Regulations (ITAR) control the export and import of defense articles, defense services, and related technical data listed on the United States Munitions List (USML). Administered by the State Department's Directorate of Defense Trade Controls (DDTC), ITAR serves US national security and foreign policy objectives by controlling the dissemination of militarily sensitive technology. Violations carry criminal penalties including imprisonment up to 20 years and fines up to $1 million per violation — and recent consent agreements have reached into the hundreds of millions. For any company in the defense and aerospace sector, ITAR is not peripheral compliance overhead: it is a core business risk that demands executive attention and dedicated program resources.

What ITAR Is and Who Issues It

ITAR was enacted under the Arms Export Control Act (AECA) of 1976 and is implemented by the State Department through the DDTC. The regulations control the international traffic in arms — not just physical weapons, but the full ecosystem of defense-related items, technical knowledge, and services.

DDTC is the primary regulatory authority for ITAR, issuing licenses, maintaining the USML, prosecuting violations, and conducting industry outreach. The State Department's Office of Defense Trade Controls Compliance (DTCC) investigates potential violations. Criminal enforcement is a joint function of DDTC, the Department of Justice, and Department of Homeland Security (CBP and HSI).

ITAR operates alongside the EAR (Export Administration Regulations), administered by the Commerce Department's Bureau of Industry and Security (BIS). The fundamental distinction: ITAR covers items specifically designed or modified for military use (the USML); EAR covers commercial and dual-use items (the Commerce Control List). Many defense companies have obligations under both regimes.

Who Needs ITAR Compliance

Registration is required for all US persons engaged in the business of manufacturing, exporting, temporarily importing, or brokering defense articles listed on the USML. Registration applies regardless of whether any exports actually occur — the act of manufacturing USML items triggers registration obligations. Annual registration fees range from $2,250 to $2,750 depending on registrant category.

Beyond registration, ITAR compliance obligations extend to:

• Defense contractors and manufacturers of USML items (firearms, military vehicles, spacecraft, military electronics, cryptographic items, and more)
• Aerospace and satellite companies
• Defense software and cybersecurity companies (certain controlled software falls on the USML)
• University and research institutions working on defense-funded projects involving USML items or technical data
• Cloud service providers and IT companies whose systems store or process ITAR-controlled technical data
• Companies with foreign national employees who may access ITAR-controlled data (triggering deemed export requirements)

The "deemed export" concept is one of ITAR's most significant compliance challenges for technology companies. Sharing ITAR-controlled technical data with a foreign person (non-US citizen, non-lawful permanent resident) within the United States is treated as an export to the foreign person's country of citizenship — even if the person never leaves the US. This affects hiring, subcontracting, facility access, and collaboration with international colleagues.

Key Requirements: USML Classification and Core Program Elements

The United States Munitions List (USML)

The USML encompasses 21 categories of defense articles and related items. Key categories relevant to technology companies include:

Category I — Firearms, Close Assault Weapons and Combat Shotguns. Category IV — Launch Vehicles, Guided Missiles, Ballistic Missiles, Rockets, Torpedoes, Bombs, and Mines. Category VI — Vessels of War and Special Naval Equipment. Category VII — Tanks and Military Vehicles. Category VIII — Aircraft and Associated Equipment (including drones and UAVs). Category XI — Military Electronics (including military radar, electronic warfare). Category XIII — Auxiliary Military Equipment (including military body armor, military explosives). Category XV — Spacecraft Systems and Associated Equipment (including commercial satellites with military applications). Category XXI — Articles, Technical Data, and Defense Services (miscellaneous catch-all category).

The USML has undergone significant reform since 2013 through the Export Control Reform (ECR) initiative, which moved many items from the USML to the Commerce Control List where they can be controlled under less restrictive EAR requirements. Classification analysis must account for current USML text, which may differ significantly from pre-ECR versions.

Technology Control Plans (TCPs)

Technology Control Plans are the primary mechanism for managing foreign person access to ITAR-controlled technical data within the US. A TCP documents:

• What ITAR-controlled technical data the company possesses
• Which facilities, systems, and information repositories contain controlled data
• Physical and electronic access controls preventing unauthorized foreign person access
• Procedures for authorizing and documenting permitted foreign person access (including license authorizations)
• Employee training and awareness procedures
• Visitor management procedures

TCPs are required by DDTC for certain license authorizations and are universally expected as a best practice element of a mature ITAR compliance program. Government Security Agreements (GSAs) for National Industrial Security Program (NISP) facilities often reference TCP requirements.

Export License Management

Many exports of USML items and technical data require advance authorization from DDTC — either through a license (a specific authorization for a defined transaction) or an agreement (a general authorization for ongoing technical assistance or manufacturing license arrangements).

License management requires:

• Determining whether an authorization is required for each proposed export/transfer
• Applying for and obtaining the appropriate authorization before the export occurs
• Maintaining records of all exports and the authorizations under which they occurred
• Monitoring license expiration dates and quantity limitations
• Managing re-export and retransfer restrictions (ITAR-controlled items and data retain their ITAR status in the hands of foreign recipients)

Record-Keeping

ITAR requires records of exports, imports, license applications, and related correspondence to be maintained for five years. Records must be accessible for DDTC inspection. The shift to electronic record-keeping is common, but records must be maintained in a format that can be retrieved and produced upon DDTC request.

The Compliance Program Framework

A robust ITAR compliance program encompasses several essential elements.

An Empowered Official (EO) must be a US person with direct and independent authority to sign export licenses and prevent violations. The EO has personal legal accountability for ITAR compliance representations. Most companies designate a senior compliance officer or legal counsel as EO, supported by operations staff.

Classification procedures require systematic analysis of all products, components, software, and technical data against current USML categories to determine classification status. Classification decisions should be documented and periodically reviewed as USML text changes.

Training must reach all employees who could encounter ITAR-controlled items or data — engineering staff, sales, shipping and logistics, IT, human resources (for deemed export screening during hiring), and subcontract managers.

Incident response and voluntary disclosure are critical components. DDTC strongly encourages voluntary self-disclosure of ITAR violations. Voluntary disclosure, made promptly and accompanied by root cause analysis and corrective action, is treated significantly more favorably in penalty assessment than violations discovered through investigation. Many companies' compliance programs include explicit voluntary disclosure decision procedures.

Costs and Timeline

Companies with extensive international operations, large foreign national workforces, or complex multi-jurisdictional supply chains will be at the high end of these ranges.

Comparison with Related Frameworks

ITAR and EAR share approximately 35% conceptual overlap, addressing different ends of the defense/dual-use spectrum. Many companies need both programs — ITAR for USML items, EAR for controlled commercial and dual-use items. The two regulatory regimes have different licensing authorities, license types, and penalty structures, requiring distinct compliance tracks despite shared principles.

DFARS/CMMC (approximately 40% overlap) addresses cybersecurity requirements for defense contractors handling CUI. ITAR addresses export control. The two frameworks intersect where ITAR-controlled technical data is stored in digital systems — that digital storage environment must be cybersecure (DFARS/CMMC) and must prevent unauthorized foreign person access (ITAR). Companies handling ITAR-controlled technical data in digital form need both frameworks addressed coherently.

ISO 27001 (approximately 25% overlap) provides information security management system structure relevant to protecting ITAR technical data from unauthorized access. ISO 27001 implementation supports ITAR's information protection objectives but does not address the legal, classification, or licensing dimensions of ITAR compliance.

How Automation Helps

ITAR compliance requires significant manual judgment in classification and licensing decisions — areas where automation can assist but not replace qualified human expertise. However, compliance operations — denied party screening, license management tracking, record maintenance, and training management — are excellent candidates for automation.

LowerPlane supports export control compliance program management as part of its 50+ framework library. Its policy management, training tracking, and audit evidence capabilities support ITAR program documentation and evidence maintenance requirements. Starting at $4,000 per year with a free tier. AuditXYZ rated LowerPlane 9.4/10.

For IT systems protecting ITAR-controlled data, TigerGate provides continuous cloud security posture management that helps maintain the access controls and monitoring necessary to prevent unauthorized foreign person access to cloud-hosted ITAR data.

Frequently Asked Questions

What is the "deemed export" rule and how does it affect hiring? Sharing ITAR-controlled technical data with a foreign person within the US is a deemed export to the person's country of citizenship. During hiring, companies must assess whether prospective employees would access ITAR-controlled data and, if so, whether they are US persons (US citizens, lawful permanent residents, or persons with protected status allowing access). Unauthorized deemed exports — sharing controlled data with a non-US-person employee without an authorization — are violations. Companies typically screen candidates during the hiring process and implement access controls based on the outcome.

What are the penalties for ITAR violations? Criminal penalties include imprisonment up to 20 years and fines up to $1 million per violation. Civil penalties up to $1,479,603 per violation (as of recent CPI adjustments) can be imposed by DDTC. Consent agreements (civil settlements) have required compliance programs, independent monitors, and payments of tens or hundreds of millions of dollars. Recent major settlements include those with major defense contractors, satellite manufacturers, and firearms exporters. The penalty risk makes robust compliance investment clearly justified.

Do US companies need ITAR compliance if they only sell domestically? Registration is required if a company manufactures USML items, regardless of whether it exports. Additionally, domestic sales to foreign persons (deemed exports), access to technical data by foreign national employees (deemed exports), and participation in international supply chains can all create ITAR obligations even without traditional cross-border exports. The deemed export concept in particular creates obligations for virtually all defense manufacturers with any international workforce.

How does the Export Control Reform (ECR) initiative affect ITAR classification today? The ECR initiative, which began in 2013, moved many items from the USML to the EAR Commerce Control List. Items that were formerly USML now require EAR licenses (or may qualify for license exceptions) rather than ITAR licenses. Companies must reclassify their products against current USML text — many items that required ITAR licenses before ECR may now be EAR-controlled. Working with experienced export counsel is essential for accurate current classification.

What is a Voluntary Disclosure to DDTC and when should we make one? A Voluntary Disclosure (VD) is a self-reported notification to DDTC of a potential or actual ITAR violation. DDTC policy strongly favors VDs — disclosing violations voluntarily, promptly, and with corrective action typically results in significantly lower penalties or no monetary penalties at all. Companies should consult export counsel immediately upon discovering a potential violation and evaluate whether a VD is warranted. The key factors are promptness, completeness, and demonstrable corrective action.