Non-Disclosure Obligations and Receipt of Export Controlled Proprietary Data: Impact and

Solutions

Non-Disclosure Obligations and Receipt of Export Controlled Proprietary Data: Impact and Solutions

June 15, 200910 a.m. – 11:30 a.m.

Office of Ethics, Compliance & Audit Services

Presenters Moderator: Luanna Putney, Director of Research

Compliance, Office of Ethics, Compliance & Audit Services, UCOP

Barbara Yoder, Private Consultant Lourdes DeMattos, Contract and Grant Officer,

Research Administration Office, UCOP Dianne Archer, Coordinator, Private Contracts

and Grants, Research Administration Office, UCOP

Patrick Schlesinger, AVC of Research Administration and Compliance, UC Berkeley

Housekeeping Items

Muted—save questions until the end

Recorded—will send link after session

Materials—will send slide deck with case study materials after session

Course Outline Overview of Issues & General Approaches Common Clause and Standard Fix (Lockheed

Martin) Case Example of Problem even with Standard

Fix (Parker-Hannifin) Case Example of How Far Industry will go to

Accommodate UC, Sample Management Plan & Guidance to Faculty (Ball)

Problems that Can’t Be Fixed & Walk-Aways (Qualcomm)

Conclusions and Questions

Why Receiving Export Controlled Proprietary Data is a Problem

Company is transferring to UC the liability of export violation for disclosure to foreign persons (“deemed export”)

Requires discrimination within the research team (the haves and have-nots), which is contrary to policy

Places individual and institution at risk Such Information cannot be used to support

UC’s mission of education & research

When should you worry?

Non-disclosure obligations appear in various kinds of agreements: research, NDA’s, MTA’s, purchase of software, license-in of ‘things’

When the agreement has both a proprietary data/non-disclosure clause and an export clause, you should really worry

If the agreement simply requires non-disclosure, but no mention of export, simply add statement that no export regulated material will be sent

Simplest Approach to Non-Disclosure Obligations

Agree to receive proprietary data, but not any export-controlled proprietary data because of the substantial numbers of foreign students and visitors

Foreign participation is an essential element of what makes UC on science’s cutting edge

Restrictions on foreign persons are contrary to policy and impractical and compromise the science

Simplest ‘Fix’ Clause: Because UC is an institution of higher education

and has many foreign persons who are students, employees, and visitors, UC intends to conduct the project as fundamental research under the export regulations. (in legalese: “such that the technical information generated by UC qualifies as public domain under ITAR 120.10(5) and 120.11 or publicly available under EAR 15CFR 734(b)(3) and 734.7 through 734.11”)

Accordingly, no export-controlled proprietary data of Sponsor may be transferred to UC.

Alternate “Fix” Clause: Defer

Same first part, re: fundamental research In the event Sponsor’s Confidential Information

is determined by Sponsor to be export controlled, UC reserves the right to elect to not receive such export controlled information

A plan for receipt, use, and dissemination must be developed and agreed to by a UC institutional official prior to disclosure or transfer

What to do When Sponsor’s Export Controlled Proprietary Data is Needed

Explain Why this creates a problem for UC Ask Sponsor to divide into three groups:

Category #1: Proprietary, but NOT technical data as defined in export regulations (necessary for design, manufacture or use of controlled commodity)

Category #2: Export regulated technical data that isn’t essential to company to be held as proprietary

Category #3: Export regulated that must be held as confidential because essential to company’s competitive edge

Consult with Investigator

Can project proceed where all research team members receive only material in categories #1 & # 2

Only one (or at most 2) team members receive the information in category #3

The team member receiving category #3 material agrees to not re-disclose it to any team member or any other person

The team member(s) to receive category #3 are willing to accept risk of export violation (as well as the burden of clogging their brain with useless info)

When Will the Work-Around Work for Category #3 Data

When the export controlled proprietary information is truly ‘background’ or such that the project can proceed with just one team member accessing the information

When the sponsor understands that UC must and will publish the results of UC’s work (and to the extent any proprietary data influences UC’s work, it will be reflected when our drawings and designs are released)

When Will it NOT Work?

When the company’s export controlled proprietary data cannot be separated from the UC work

When all the research team require access to the export controlled proprietary data

When the real issue is that the sponsor wants UC to perform R&D on the company’s products and really does not want to allow UC to publish and disseminate UC’s work

Case #1: Standard Commercial Clause,Lockheed Martin

Lockheed Martin : Standard

Commercial Clause

NDA for Research Project: Microwave Packaging Lockheed wanted to protect themselves against any

responsibility for the University’s inadvertent disclosure of export controlled information.

Included provision to comply with all export regulations.

Included a provision prohibiting the transfer of: PROPRIETARY INFORMATION, including the transfer to foreign persons employed by or associated with, or under contract to the receiving Party, without the authority of any export license or applicable license exemption.

Highlights

We all want to protect ourselves from inadvertent disclosure….However, it is important that the company understand the nature of our Fundamental Research Exclusion (FRE).

A general statement requiring our compliance with export regulations is, in and of itself, ok.

Proprietary Information ≠ Export Controlled Information

We need parameters around what constitutes Export Controlled Information

Solutions

Limit the definition of what’s restricted on re-transfer to foreign persons to: “Export Controlled Proprietary Information”

“Without limiting the foregoing, the receiving Party agrees that it will not transfer any export controlled PROPRIETARY INFORMATION, to include transfer to foreign persons employed by or associated with, or under contract to the receiving Party, without the authority of any export license or applicable license exemption.”

Set out expectations for fundamental research, with little or no export controlled information being provided to us by Sponsor.

“Whereas, it is recognized that THE REGENTS conducts fundamental and open research and intends to publish and share the results of such research;Whereas LOCKHEED MARTIN, in recognition of The Regents mission, will limit the amount of any export controlled Proprietary Information that it discloses to THE REGENTS’ employee, Dr. X;”

Limit the amount of EC Proprietary Information to be received Sponsor must first notify UC of its intent to disclose EC

Proprietary Information & transfer to named UC employee only Sponsor must provide the ECCN number and keep inventory

“Prior to the transfer of any export controlled PROPRIETARY INFORMATION to the receiving party, the disclosing Party will notify the receiving Party of the specific export control classification number of such export controlled PROPRIETARY INFORMATION. LOCKHEED MARTIN will disclose export controlled PROPRIETARY INFORMATION only to The Regents’ employee, Dr. X; will mark all such information conspicuously with a legend identifying such information as “Export Controlled” and indicating the specific export control classification number; and will maintain an inventory or library of all export controlled PROPRIETARY INFORMATION disclosed to Dr. X.

Solutions (Con’t)

Additional Improvements:Could have added: Sponsor must await UC’s acceptance by a UC

authorized official before transferring to contact (e.g. have everything go through a campus institutional official before going to PI/named employee—probably resulting in further limiting the amount of material transferred), or require cc. be sent to institutional official, so can at least monitor volume

UC must retain the right to reject such information, and this shall not be deemed a breach of the agreement.

Why it Worked:

FRE understood by Lockheed PI intended to publish research results PI would be the only person receiving the

controlled and proprietary information PI agreed not to re-disclose One other student/UC employee would receive

proprietary, but not export controlled information

Summary Principles for Standard Response: Sponsor shall first notify a UC institutional official of its

intent to disclose confidential information subject to export controls, and tell UC the nature of the information to be provided and why they believe it is necessary for the project

Sponsor must provide the ECCN number Sponsor must await UC’s authorized official’s agreement

to receive the disclosure before disclosing. UC must retain the right to reject receipt of sponsor

confidential information subject to export controls, and this shall not be deemed a breach of the agreement.

Sponsor must disclose only to a designated UC point person; that person must agree to accept the responsibility to not re-disclose to any other person

Parker-Hannifin

Collaborative research between UC & P-H to reduce noise levels of P-H’s aircraft engine bleed valves

UC published work likely to include how to improve valves

Project in its 8th month when P-H needed to disclose information it claimed is export controlled & proprietary

Research agreement EC, confidentiality and publication provisions generally acceptable

Called for the parties to execute a data mgmt plan (NDA) before such information was to be exchanged

P-H Original Data Mgmt Plan

Acknowledged that the parties intend to be FR, but FR then becomes non-FR if:Prepublication review reveals patentable tech.P-H provides tech data that is in furtherance

of project that is confidential/proprietaryP-H provides technical assistance to UCP-H provides “unpublished technology” info

that becomes part of the research

Issues/Problems:

Iranian UC student working on project Cannot utilize 125.4(b)(10) exception (Iran an

embargoed country) P-H (and PI) thought we could pull Iranian student off

project = then, no EC problem! P-H wanted to treat all EC’d information as “proprietary”

No distinction between truly proprietary information versus other info associated with valves or other P-H technology that might simply be EC’d.

Misconception that technology that might be EC’d and proprietary (patentable) may not be published, thus, UC’s results become non-FR

How to fix data plan

Clear up misconceptions with P-H: UC cannot discriminate against Iranian student P-H must make distinction between “crown jewels” and info that is

EC’d but not proprietary. UC must retain publication ability, including results that might show

others how to improve valve Reasonable delay of publication for patent protection does not take

this out of the FR exemption P-H should disclose only minimum EC/proprietary information

necessary to accomplish goals of project Clarify with PI:

Can project continue if only he receives EC/proprietary info? Can he still publish?

Revised data plan

1. All controlled info must be clearly ID’d by P-H as EC/proprietary @ time of disclosure

2. Controlled info disclosed only to two individuals (co-PI’s)

3. P-H to transfer only minimum controlled info required

4. P-H to identify any proprietary info that is not EC’d

5. UC remains responsible for its handling of controlled info under the plan

(Original Res Agmt EC clause): EXPORT COMPLIANCE. The Parties intend to conduct the Research Project as fundamental research in compliance with the applicable United States export regulations (i.e., the International Traffic in Arms Regulations and the Export Administration Regulations, as may be applicable (each an “Applicable Export Regulation”)). In the event that either Party (the “Disclosing Party”) needs to provide material that is both classified as technical data under an Applicable Export Regulation and is to be treated as Confidential Information (“Export Controlled Proprietary Information”) to the other Party (the “Receiving Party”), the Disclosing Party (1) shall not send the Export Controlled Proprietary Information to the Receiving Party until Disclosing Party’s Authorized Representative and the Receiving Party’s Authorized Representative develop a plan for the receipt of Export Controlled Proprietary Information which complies with all requirements of the Applicable Export Regulation(s), including the requirement for obtaining any export license, if applicable, and (2) each Party agrees to make reasonable efforts to minimize the amount of Export Controlled Proprietary Information transferred. For purposes of this provision the Authorized Representatives are as follows:

For University: [Principal Investigator]

For Sponsor: [________]”

(Suggested revision of res agmt EC clause): EXPORT COMPLIANCE. The Parties intend to conduct the Research Project as fundamental research in compliance with the applicable United States export regulations (i.e., the International Traffic in Arms Regulations and the Export Administration Regulations, as may be applicable (each an “Applicable Export Regulation”)). In the event that either Party (the “Disclosing Party”) needs to provide material that is both classified as technical data under an Applicable Export Regulation and is to be treated as Confidential Information (“Export Controlled Proprietary Information”) to the other Party (the “Receiving Party”), the Disclosing Party (1) shall first notify the Receiving Party of its intent to disclose Export Controlled Proprietary Information and shall not send the Export Controlled Proprietary Information to the Receiving Party until the Receiving Party agrees to accept. Receiving Party’s rejection to accept Export Controlled Propriety Information shall not be deemed a breach of this Agreement. Disclosing Party’s Authorized Representative and the Receiving Party’s Authorized Representative shall develop a mutually agreeable plan for the receipt of Export Controlled Proprietary Information which complies with all requirements of the Applicable Export Regulation(s), including the requirement for obtaining any export license, if applicable, and (2). eEach Party agrees to make reasonable efforts to minimize the amount of Export Controlled Proprietary Information transferred as necessary to satisfy the objectives of this Agreement. For purposes of this provision the Authorized Representatives are as follows: For University: [Principal Investigator Contract and Grant Officer] For Sponsor: [________]”

Ball Aerospace

UC and Ball to develop joint proposal for NASA space-based research project

ITAR Exception 125.4(b)(10) allows UC to transfer ITAR technical data to it’s foreign employees as long as further re-disclosure is prohibited

Ball expects UC to sign their standard NDA

Ball Accepts UC Strategy

After conversations with Ball export and program officers, Ball agrees to carefully divide material into UC’s 3 categories

Ball agrees to restrict the amount of export controlled data that must be kept proprietary (category #3), to have high standards and not routinely put everything into that category, and to transmit it only to the PI

Ball Makes Further Changes to the Standard NDA Competition sensitive data is only confidential

until competition is over Proprietary data to be disclosed for 1 (not 3)

years Ball to keep track of any material they want

returned or destroyed & inform UC within 30 days of termination of agreement

Deleted reference to & control of UC documents that contain portions of their data

Deleted indemnification for violation of export regulations

Management Plan & Instructions

Ball takes responsibility to review final proposal and identify any Ball proprietary data to be marked (otherwise, not confidential)

Ball to make different markings: competition sensitive, proprietary, & proprietary/export (with latter category to PI only)

Ball to place ‘expiration date’ on proprietary marking so clear when expires

Qualcomm Case

Company claims broad range of information proprietary and will be exchanged under the NDASoftware, hardware, “research,” algorithms,

“business activities and outlooks”Would not specify which was export controlled

Can Export Controlled Information from Qualcomm be Managed?

UC – before transferring proprietary, export-controlled information, transferring party notifies the other in writing so that a management plan can be prepared

Management plan advantagesWho will receive it?How will it be used in the project?Do we agree that it is really export controlled?

Qualcomm Response

Notification and management plan rejected. Only agrees to “cooperate” from time to time

“upon reasonable request” to jointly determine the export classification of the information shared with the other party

Q does not agree to do the classification prior to transfer

Is this really manageable?

Is this a Walk-Away?

Yes The controlled information would be provided by

Qualcomm but they refused to identify it prior to transfer Qualcomm is in the best position to definitely classify the

information EAR presumes that the company sending the

information knows the ECCN and will manage required licensing (15 CFR 734, Supp. 1 Q&A D(2))

UC would not know how the information could be used in the project

UC would not be able to manage the risk of deemed export violation

Get a Deemed Export License?

Deemed export licenses don’t work in an open, academic environment

Fluid membership of research teams with foreign students and visiting scholars

Licenses restrict use of information Export control risk and University policy violation

Research teams are to be based on scientific merit, not citizenship or immigration status

Conclusions Understand Why Receiving Export Controlled

Technical Data that must be kept In-Confidence is a problem:Compromises UC’s education & research

missionForeign persons are excluded from research

team even though their contributions are essential

Alienates foreign partners and divides teamCreates personal and institutional liability for

violation of export regulations

Conclusions

Explain position to faculty and sponsors so that it is clear why it is in everyone’s interest to eliminate or drastically reduce the amount

Ask sponsors to transfer Category #1 or #2 material and/or to secure any prime contract required CO prior approval for release so becomes Category #2 when sent to UC

Clarify that only 1 (and no more than 2) members of team will receive Category #3

Set high standard for Category #3 Emphasize publication of UC’s results

Questions?

Campus export control contacts

Luanna Putney, Director of Research Compliance, Office of Ethics, Compliance & Audit Services510-987-0028, luanna.putney@ucop.edu