Daunted by the complexity of export control rules, some companies have weighed the immediate costs of compliance against the hypothetical risk of getting caught and decided to treat any liability they might incur as a cost of doing business. If ever such a cost-benefit calculus were ever plausible, however, those days are gone. Consider:
- General Motors and General Dynamics paid $10 million each to settle charges by the State Department that GM’s Canadian truck division, recently acquired by GD, had disclosed mili¬tarily sensitive information to persons of dual Canadian-Chinese citizenship.
- The Administration is asking Congress to raise the maximum criminal penalty chargeable by the Commerce Department from $50,000 to the greater of $5 million or 10 times the value of the exports involved – per violation.
- The government often suspends a company’s right to export merely upon suspicion of a violation.
Indeed, a company's failure to have systems in place to catch violations before they proliferate now exposes its leaders to stern penalties – under Sarbanes-Oxley as well as federal sentencing guidelines. The following scenarios, including real-life case histories, illustrate some of the essentials that any corporate leader should know about export controls.
ALPHA COMPANY: Ignorance Is Not Bliss
1. The likelihood of getting caught is rising.
Apha Company exports software to major steelmakers. There is no market for its software in countries – like Iran, Cuba and North Korea – that everyone knows are “embargoed.” So Alpha is mystified when an agent of the Commerce Department drops by “to chat.”
Nothing out of the order here, however. Even the FBI is now involved in enforcement, and “educational outreach” – a polite word for snooping – is increasingly common.
The first time the Commerce agent calls, Alpha has the right answers: an Algerian engineer had, as he claimed in his visa application, spent his time in the States consulting with Alpha; so the agent seems satisfied.
But why would an export control agent care about a foreigner inside the US?
2. You may be exporting without knowing it.
Any disclosure of US-origin technology to a “non-US person” is deemed to be an export, even if it occurs on A’s shop floor. So Alpha was exporting when it disclosed proprietary technology to the Algerian. If that technology had been “controlled’’ under US law for export to Algeria, Alpha’s disclosure without a license would have been illegal, and the penalties could have been severe.
3. What you can’t prove can nail you.
The Commerce agent, having searched the Department’s newly improved computer system, learns that Alpha’s CEO applied for – and got – a license to export Alpha’s software to Japan in 1996; but Alpha has con¬tinued to export without applying for further licenses. So Alpha’s CEO – appearing to know that his products required export licenses – is now staring at criminal liability for 10 years worth of unlicensed exports; and Commerce has ordered Alpha to stop exporting until its agent sorts the matter out.
How did this happen to an otherwise law-abiding company? After weeks of frantic digging in ancient files, Alpha concludes that it can’t really say – its record-keeping isn’t good enough even to suggest that it erred in good faith.
Fortunately, Commerce was soon convinced that Alpha’s products had never required licenses – the old “no foul, no foul” defense. So no one went to jail, the company avoided potentially crippling fines, and it resumed exporting. But the cost – in sleepless nights as well as attorneys’ fees – was high.
4. Records are required even if licenses are not.
The entire export control enterprise is an exercise in record-keeping. If the government worries enough about foreigners getting what you’ve got – or if it cares enough about the use to which your products will be put, even if your products are pencils – the gov¬ernment requires you to start the record-keeping in Washington, by applying for a license, which may well be denied.
But even if your products and technology are exportable without a license to all but the embargoed countries, and even if their end-use is benign, the government still forbids you to do export business with thousands of listed persons and entities of many nationalities, including some Americans. For that reason, among others, the government requires you to keep certain records regarding all of your exports, licensed or otherwise.
And that, as Alpha learned, is a good thing. If you don't keep basic records of your export activities, you're not only violating the law – you're depriving yourself of documentation of good-faith efforts to comply that could keep you out of jail.
5. Compliance programs – aimed at preventing violations before they happen and documenting your good faith efforts to comply – are virtually mandatory, but not necessarily onerous.
If Alpha Company had needed licenses, the government – in deciding what penalty to assess – would have viewed its lack of a formal compliance program as an aggravating factor. A compliance program need not be onerous, however. In Alpha’s case, it could have consisted of little more than:
- documentation of its reconsidered, good faith determination that no licenses were required (or better, a written determination by the Commerce Department that this was so);
- a file on each of its export transactions, including all of the records required to be kept, together with a contemporaneous memo to the effect that disallowed participants had been screened for;
- records showing that employees with compliance responsibilities had received necessary training; and
- provision for review of license requirements if its products were significantly upgraded or new products came on line.
BETA COMPANY: If it's not one thing, it's another.
6. Even good compliance programs need auditing, before problems arise.
Beta Company exports hundreds of mechanical and electronic com¬ponents. Its former export manager had developed a comprehensive “matrix” – a listing of the licensing requirements for each and every item in each of its dozens of markets around the world – that enabled Beta to get the licenses it needed in timely fashion and keep Beta in compliance. Or so Beta thought.
But when HR hired a recent Ph.D. from North Texas State who was born in China, Beta’s new manager wrote to Commerce, asking if it was okay for Beta to disclose its technology to this woman. After learning she had once trained at a Chinese weapons facility, Commerce virtually accused Beta of complicity in espionage.
Would that that were all.
On closer inspection, it turned out that several engineers in the US operation were working on H-1B visas, and Beta had not gotten licenses for them to receive con¬trolled company technology. Beta had also spent a lot of money on a new IT system sharing all of its technology with subsidiaries and affiliates in dozens of other countries. No one had any idea what licenses would be required, or if any would be granted, or what to do if licenses were denied.
Worst of all, however, Beta was about to complete a public offering of stock, which had to be pulled because Beta could no longer attest that it was in regulatory compliance. With the best will in the world, then, a second pair of eyes is often needed – especially when IT systems are expanding and corporate transactions are afoot.
TAKEAWAY: Compliance requires director and officer involvement.
Knowing what you know now, consider the following and ask yourself: Should export compliance have been left to Gordon in shipping?
- Gamma Company spends heavily on manufacturing capacity in China and then learns that the US will not license it to disclose its technology to Chinese nationals.
- Delta Company does not export at all, but it has been custom-tooling parts that General Electric uses in jet engines for fifteen years when it learns that it should have registered with the State Department as a munitions manufacture before its first sale.
- Epsilon Company acquires a German manufacturer of oil-drilling equipment, only to learn that no US person may lawfully be involved, even indirectly, in the subsidiary's dealings with its primary customer, the Government of Iran.
- Zeta Company invests millions in R&D to upgrade a product it has freely exported for years before learning that the upgraded product will require licenses and US policy is to deny applications for licenses to three of its primary markets.
- Theta Company's CFO has reason to suspect that her sales people are doing deals that violate the export control laws, but she looks the other way. Her "willful avoidance" could send her to jail.
By now, it should be clear that compliance with export controls requires foresight in numerous contexts, among them:
- preparing 10-Qs, 10-Ks and compliance with Sarbanes-Oxley (vide the experience of Beta Company);
- implementing foreign distribution chains, all the way from Stateside arrangements with VARs and freight forwarders to installing and servicing what you sell;
- licensing intellectual property to non-US persons;
- planning R & D;
- outsourcing of manufacturing or data-related services;
- disclosing listed technologies to non-US persons anywhere in the world, including company employees or academic colleagues working in the United States;
- investing in other companies – whether by merger, acquisitions, capitalization, lending or otherwise – to determine everything from:
- whether a foreign acquirer is entitled to access a US target’s technology, to
- whether the target (foreign or domestic) has export control liability for which the acquirer will be responsible (half of the $20 million amount paid to settle the dual-citizenship case was paid by the company that acquired the assets of the company that violated the law), to
- whether US persons working for a domestic acquirer may lawfully exercise control over the export business of a foreign target; and
- financing cross-border transactions.
Unfortunately, ignorance of the export control laws is no excuse. Timely planning to comply with them can save your company a big, wide world of hurt.