ITAR

What is ITAR?

The International Traffic in Arms Regulations (ITAR) control the export of defence items from the United States. They implement the Arms Export Control Act and are administered by the State Department’s Directorate of Defense Trade Controls (DDTC). The regulations sit in 22 CFR Parts 120 to 130.

ITAR is an export control law, not a cybersecurity framework. It appears on security teams’ desks because “export” includes giving a foreign person access to controlled data, which makes access control, data location and encryption compliance questions.

What does it control?

ITAR covers three things listed on, or tied to, the US Munitions List (USML) in Part 121:

• defence articles: the items themselves, from firearms and ammunition to aircraft, spacecraft, military electronics and directed energy weapons, across 21 categories;
• technical data: information needed to design, build, operate, repair or modify those articles, such as drawings, specifications and software;
• defence services: help given to foreign persons with those articles, including training.

What counts as an export?

Under §120.50, an export includes not only shipping something abroad but also:

• releasing technical data to a foreign person inside the United States, known as a deemed export;
• performing a defence service for a foreign person, wherever they are;
• releasing previously encrypted technical data, for example by handing over the decryption key.

So a foreign national employee, a contractor abroad or an overseas support team who can read controlled files may need a licence before they get access.

What about cloud and encryption?

§120.54 sets out activities that are not exports. One covers sending, taking or storing technical data that is unclassified and secured with end-to-end encryption using modules compliant with FIPS 140-2 or its successors (or cryptography at least as strong as AES-128). The data must not be intentionally sent to or stored in, or sent from, a country listed in §126.1. Data simply passing over the internet through a country isn’t treated as stored there.

Outside that carve-out, many companies keep ITAR data in US-only, US-person-supported cloud environments, often the same ones used for FedRAMP High or CMMC work.

Who must register?

§122.1 requires anyone in the United States who is in the business of manufacturing, exporting or temporarily importing defence articles, or furnishing defence services, to register with DDTC. One occasion is enough to count as being in the business, and a manufacturer must register even if it never exports. Brokers register separately under Part 129.

What are the penalties?

Civil penalties under §127.10 can reach the greater of US$1,271,078 or twice the value of the transaction for each violation of the Arms Export Control Act’s main provision, and the amounts are adjusted for inflation. Criminal penalties also apply to wilful violations. DDTC can make paying a penalty a condition for future licences.

Where does it fit?

Defence contractors often meet ITAR alongside CMMC and NIST SP 800-171, which protect Controlled Unclassified Information. The two overlap but are not the same: CMMC is about how well data is protected, and ITAR is about who may receive it. If your products or data might be on the USML, get specialist export-control advice; this page is an introduction only.