In general, the majority of exchanges among researchers can go forward without the requirement of an export license, where the sole purpose of the meeting is to present research findings that have been or are intended to be published, provided they do not concern detailed information regarding controlled items or technologies (information and items subject to Export Controls). As you plan your trip, verify with Research Integrity and Compliance (RIC) that your technology or information falls into one or more of the following categories prior to traveling:
- Research that is categorized as “fundamental”
- Published information
- Publicly available software
- Educational information
- Patent applications
In addition, RIC is available to perform a restricted party screening for entities and individuals with whom you will be doing business. Contact the Director of RIC, Sean Rubino, at (512) 245-2314 or the Travel Office for additional information.
When planning a trip abroad, travelers should familiarize themselves with export controls and embargoes. You must ensure that any information that you will discuss or any items that you will take with you are either not controlled, or if controlled, proper licenses are in place. Because you and the University can be held liable for improperly transferring controlled items or technology, it is important that you review the federal requirements. Most travel for conferences will fall under an exclusion or exemption to the export control regulations: Information that is published and is generally accessible to the interested public through publication in books or periodicals available in a public library or in bookstores, or information that is presented at a conference, meeting, seminar, trade show or other open gathering is considered to be in the public domain. An open gathering is one in which members of the general public are eligible to attend and attendees are permitted to take notes.
The Department of the Treasury, through its Office of Foreign Assets Control, administers economic and trade sanctions that at times can restrict transactions and travel, or require licensing in order to travel to a foreign country, or to conduct business with a foreign entity or individual. Before considering travel to embargoed countries to conduct research or educational activities, check first with RIC. A determination will be made by RIC as to whether a license and/or permission is required. Some countries can require a specific license that may take several weeks to obtain. For the most current list of restricted countries please consult the OFAC's Sanctions Program and Country Summaries website.
Laptops, tablets, cell phones, data storage devices, and encrypted software
When you travel outside of the United States, your university provided laptop computer, cell phone, data storage devices and encrypted software may require an export license or other government approval to be taken with you to many countries outside of the United States. The University is required to document the export (even a temporary export) of these items to certain countries if they are owned by the University. The personal computer you take abroad may contain strong encrypted software that requires a government license or other government approval for export to many countries. For example, the newest versions of several Microsoft programs possess strong encrypted software and is subject to export restrictions. Devices that have downloaded these Microsoft programs can be temporarily taken overseas, but to a large number of destinations they can only be taken under an export license exception.
Because encryption products may be used for illegal purposes, the United States and many other countries may ban or severely regulate the import, export, and use of encryption products. By taking your encrypted laptop to certain countries without prior authorization, you could be violating U.S. export law or the import regulations of the country to which you are traveling, which may result in confiscation of your laptop, in fines, or in other penalties.
Over the past fifteen years, a group of nations negotiated a set of rules attempting to facilitate traveling with encryption software known as the "Wassenaar Arrangement." One of its provisions allows a traveler to freely enter a participating country with an encrypted device under a "personal use exemption" as long as the traveler does not create, enhance, share, sell or otherwise distribute the encryption technology while visiting.
The countries that support the personal use exemption include
Argentina, Australia, Austria, Belgium, Bulgaria, Canada, Croatia, Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Ireland, Italy, Japan, Latvia, Lithuania, Luxembourg, Malta, Netherlands, New Zealand, Norway, Poland, Portugal, Republic of Korea, Romania, Russia*, Slovakia, Slovenia, South Africa, Spain, Sweden, Switzerland, Turkey, Ukraine*, United Kingdom and the United States.
*Although the Russian Federation and the Ukraine agreed to many of the Wassenaar Arrangement's provisions, they currently do not permit personal use exemptions.
University supported travel to destinations not covered by the Wassenaar Arrangement, may fall under the "Tools of Trade" (TMP) license exception when the laptop, tablet, cell phone, data storage devices are:
- Hand carried with you while you travel,
- Carried in your luggage or baggage that travels with you, or
- Shipped no more than 30 days prior to your departure, or may be shipped to you at any time while you are outside the country
Generally, so long as you (1) retain your laptop computer, PDA, cell phone, data storage devices and encrypted software under your personal custody and effective control for the duration of your travel; (2) do not intend to keep these items in these countries for longer than 1 year; and (3) you are not traveling to Iran, North Korea, Sudan or Syria, no government export license is required. Note that this license exception is not available for equipment, components, or software designed for use in/by/with most satellites or spacecraft. "Effective control" means retaining physical possession of an item or maintaining it in a secure environment.
When leaving or entering the United States electronic devices may be subject to search without reasonable suspicion, and although there is some current case law to suggest that the Department of Homeland Security must demonstrate reasonable suspicion in some cases before ordering travelers to disclose their passwords or encryption keys, it remains a risk. Likewise, some other countries have laws allowing seizure and search of electronic devices, including coerced disclosure of passwords or encryption keys. Even where electronics are not seized and searched pursuant to law there remains a substantial risk that the contents of those devices may still be compromised. For example, see this article about cyber-espionage in China.
University employees should take appropriate measures to safeguard sensitive data, including but not limited to:
- Not taking any sensitive data that is not absolutely necessary. This may mean taking an alternate “clean” computer that has never held sensitive information.
- Backing up all sensitive data before traveling and encrypting files and requiring a password for access.
When taking an international trip, it is important to consider (1) the materials and information you are taking with you; (2) your destination country; (3) those you may be collaborating with; and (4) the purpose of any collaboration.
Other University Equipment
Some equipment (e.g., global positioning systems [GPS], thermal imaging cameras, inertial measurement units and specialty software), are highly restricted and may require an export license to take with you, even if you hand carry it. If you are taking university equipment other than your laptop computer, PDA, cell phone, data storage devices contact RIC to determine if an export license or other government approval is required prior to your taking the equipment out of the country.
Export License Exception for Temporary Exports (TMP)
Texas State employees commonly carry Texas State-owned, commercially available electronic devices such as laptops, PDAs, iPads, cell phones, thumb drives, and other digital storage devices with them on international travel. These items often come with pre-loaded encryption software which is subject to the Department of Commerce, Export Control Regulations (EAR). Many of these items can be temporarily exported under the EAR license exception “Temporary Exports-Tools of the Trade” (TMP).
The TMP License Exception provides that when Texas State-owned laptops, PDAs and other digital storage devices (and related technology and software) are being used for professional purposes, returned within 12 months, kept under effective control of the exporter while abroad and other security precautions are taken against unauthorized release of technology, then the TMP License Exception generally applies as long as the criteria to which you are certifying below are met.
NOTE: The exception does not apply to any EAR-satellite or space-related equipment, components, or software, or to any technology associated with high-level encryption products. In addition, this exception does not apply to items, technology, data or software regulated by the Department of State’s International Traffic in Arms Regulations.
This form needs to be signed by Sean Rubino, the Director of Research Integrity and Compliance prior to shipping or hand-carrying the item(s) or software overseas. If you have any questions about this, please email him at: firstname.lastname@example.org.
Airline Electronics Ban: What Texas State Travelers Need to Know
The U.S. government has recently required several airlines to stop passengers from bringing most types of electronic devices (not including smartphones) into the cabin for U.S.-bound flights. Instead, those devices must now be carried in the hold.
Which countries are involved?
The ban covers U.S. bound flights from the following countries:
- United Arab Emirates
- Saudi Arabia
Which airlines are affected?
The following airlines fly directly to the U.S. from the affected countries:
- Emirates Airline
- Etihad Airways
- Kuwait Airways
- Qatar Airways
- Royal Air Maroc
- Royal Jordanian
- Turkish Airlines
Which devices are banned?
Smartphones will still be allowed in the cabin. But any electronic devices bigger than that will have to be checked in, either with your luggage or at the gate. That includes laptops, cameras, gaming devices and tablets such as iPads.
Medical devices (and cameras on U.K.-bound flights) will still be allowed in the cabin after security screening.
What happens at the airport?
If you’re flying from the regions to the U.S., the best advice is to arrive earlier than normal. Expect to be asked to check in tablets, laptops, and other banned devices with your luggage.
What’s the reason for the ban?
U.S. officials say the move is a response to fears that terrorist groups may target passenger planes by smuggling explosive devices in electronic devices. One official said there's no specific plot authorities are aware of, but the U.S. has been considering such a ban for some time.
How can I protect my devices?
Electronic devices that are checked in can be damaged, lost, even hacked. Before your check anything in, consider the risks and take steps to protect your devices and data.
Many airlines specifically say they will not be held liable if these items break or are lost. They warn against packing valuable or breakable items like computers in checked baggage.
The best way to keep your data from falling into the wrong hands is not to check a computer at all.
If you have to bring a device, do a full back-up before leaving for the airport. Experts recommend shutting the computer down completely, not just putting it into a sleep mode.
A more secure option is to wipe a laptop or tablet clean before traveling. That can be difficult so you may want to consider switching to a "burner" laptop — an inexpensive device that doesn't have sensitive information on it.
Warning About Travel to China and Russia
Recently, there has been an increased concern about cyber security of American higher education travelers to China and Russia. U.S. travelers are believed to be priority targets for cyber-attack and monitoring/surveillance, particularly if they are known to be engaged in proprietary or controlled research in a STEM (science, technology, engineering and mathematics) discipline. Institutional leaders, those who are politically or religiously active, fluent speakers of the local language and individual tourists may also be actively targeted, however all Texas State travelers should assume that they are potentially at risk if traveling to China or Russia. Electronic devices may also be at risk of physical tampering or theft, particularly if those devices are left unattended (including devices left locked in a hotel room or even left locked in a hotel safe while dining, shopping or touring). On the other hand, carrying one’s laptop or other electronic devices continually may increase their risk of being accidentally lost or forgotten, or stolen by a thief/pick pocket. On balance, however, we recommend you keep your devices with you at all times.
Devices taken to China and Russia (as well as many other international destinations) may be subject to involuntary official governmental review and even complete duplication (e.g., in some countries, Customs officers may temporarily seize your device, and potentially keep a copy of one’s entire system on entry or exit).
Access to some web sites, including access to some mainstream popular western social media web sites, may be technically blocked. Secure (“https”) web sites and use of institutional virtual private networks (“VPNs”) may also be blocked by some countries, because it is more difficult for national authorities to monitor that encrypted traffic. Attempts to circumvent national censorship (e.g., with Tor, Ultrasurf or similar products) may be blocked and/or punished if noticed.
Warning About Bringing/Using Encryption Products in China
All University travelers should be cautious and aware of China’s “Encryption Regulations. These laws were adopted by China’s State Council, the highest level of China’s government, and they bar the manufacture, use, sale, import, or export of any item containing encryption without prior government approval. Although thousands of individuals carry laptops and smartphones with encryption in and out of China daily, it is not risk free. These laws are phrased very broadly, and although there have been statements by subordinate agencies suggesting that they were not intended to be applied to mass-market products with incidental encryption, the agencies issuing these statements are not at the level of China’s State Council.
As such it is strongly recommended that no sensitive or personal data be brought into China on electronic devices. Rather than employing encryption bring clean devices if you must bring electronics with you.
If you must travel to China or the Russian Federation, if possible, leave all electronic devices in the U.S. and inform colleagues that you will be "off the air" for the duration of your travel. Minimize the length of your stay in those countries. If you are travelling without your own laptop, you may be tempted to use a computer in a cyber cafe of hotel business center, however those systems have a very high probability of being infected with malware (which may capture anything you type, including your username, password, credit card information, etc.), or of being routinely and actively monitored by national authorities. Therefore, never use shared computers in cyber cafes or hotel business centers, or systems belonging to other travelers, colleagues, or friends.
If you must take your University owned computer, The Information Security Office is required to conduct a pre- and post-trip virus scan and review. They will sure the operating system is fully patched, and has all institutionally recommended security software installed.
While abroad, you should minimize your use of the system and use a long/complex password for access, and keep it completely off (not just sleeping or hibernating) when you’re not actively using it, and keep it in your physical possession at all times. Assume anything you do on that system, particularly over the Internet, will be intercepted (in some cases, encrypted network traffic may be decrypted).
Upon return to the U.S., immediately discontinue its use, and immediately have it reviewed by Information Security Office for indications that it may have been compromised abroad. Finally, you should change any/all passwords you may have used abroad.
Some Additional Things to Consider If Traveling to China or Russia:
- Tape-over any integrated laptop cameras.
- Have a computer technician physically disconnect any integrated laptop microphones.
- Install a privacy screen (such as those from 3M) on your laptop to discourage so-called "shoulder surfing."
- Disable all file sharing.
- Disable all unnecessary network protocols (such as WiFi, Bluetooth or infrared).
- In case your system is lost, stolen, seized or destroyed, take a full backup.
- Leave all unneeded door keys, smart cards or USB format PKI hard tokens, one-time password crypto fobs, and similar access control devices in the United States.
- Be sure to clean out your purse or wallet, particularly if you normally carry notes about various accounts or passwords. Any RFID cards (including U.S. Government Nexus "trusted traveler" cards) should be carried inside an RF-shielded cover.
- If you need to send or receive email while traveling, create a temporary "throw away" account on Gmail or a similar service before you travel.
- Do not use your regular email account. Do not send any sensitive messages via email
- Avoid making or receiving voice calls, using voice mail, using IM or SMS, or sending or receiving faxes.
- Even powered-off cell phones may be able to be turned into surreptitious monitoring and geolocation devices. If you don’t want to be geographically tracked, or you’re attempting to have a confidential conversation, cell phone batteries must be removed.
- Any/all CDs, DVDs, thumb drives, attachments, links and “QR” cell phone bar codes must be considered to be potentially hostile and malware infected.
- Do not use USB-based public battery charging stations; the USB interface to your device they may allow the charging station to do more than just provide power.
- Do not purchase new hardware while traveling.
- Do not purchase or download any new software while traveling.
- Do not have any of your electronic devices "repaired" or "worked-on" while abroad.
- Any discarded items (such as notes, documents, diskettes/CDs/DVDs) may be retrieved, analyzed and potentially exploited.
- Tor (and other so-called censorship circumvention tools) may be blocked, or may provide imperfect anonymity; use of such tools may attract official attention, and may result in you being investigated and punished or expelled.
- Guides, drivers, and interpreters may report on your activities.
- Beware of attempts to put you in embarrassing or compromising positions. You may be getting targeted for eventual extortion.
- While abroad, register with the nearest U.S. Embassy or Consulate and please report any suspicious incidents you experience to them.
- If arrested, taken into custody, or interrogated, do not make any statements or sign any documents, particularly if they are written in a language you don’t know. Ask to have the U.S. Embassy or Consulate notified of your detention at once.
Many restrictions on travel to Cuba have been lifted since the reestablishment of diplomatic relations with the United States. Travel for a wide array of academic purposes—including research, conference participation, professional meetings and study abroad—is now authorized under a “General License” which requires no prior approval. Since the removal of Cuba from the US government’s list of “State sponsors of terrorism,” funds normally acceptable for travel to other countries may be used for travel to Cuba. Texas State University official travel to Cuba may thus be authorized by the standard travel approval process.
Under a “general license”, OFAC allows certain educational travel to, and types of transactions in Cuba. Texas State University sponsored travel to Cuba requires a review by Research Integrity and Compliance (RIC) to determine that the travel is permitted and falls under the parameters of the “general license.”
Texas State supported travel to Cuba is allowed if the activities and purpose of the trip fall under one of the following conditions:
- Participation in a structured educational program in Cuba as part of a course offered for credit by the sponsoring U.S. academic institution. An individual traveling to engage in such transactions must carry a letter on official letterhead, signed by a designated representative of the sponsoring U.S. academic institution, stating that the Cuba-related travel is part of a structured educational program of the sponsoring U.S. academic institution, and stating that the individual is a member of the faculty or staff of that institution or is a student currently enrolled in a graduate or undergraduate degree program at an accredited U.S. academic institution and that the study in Cuba will be accepted for credit toward that degree;
- Noncommercial academic research in Cuba specifically related to Cuba and for the purpose of obtaining a graduate degree. A student traveling to engage in such transactions must carry a letter on official letterhead, signed by a designated representative of the sponsoring U.S. academic institution, stating that the individual is a student currently enrolled in a graduate degree program at an accredited U.S. academic institution, and stating that the research in Cuba will be accepted for credit toward that degree;
- Participation in a formal course of study at a Cuban academic institution, provided the formal course of study in Cuba will be accepted for credit toward the student's graduate or undergraduate degree;
- Teaching at a Cuban academic institution by an individual regularly employed in a teaching capacity at the sponsoring U.S. academic institution, provided the teaching activities are related to an academic program at the Cuban institution and provided that the duration of the teaching will be no shorter than 10 weeks.;
- Sponsorship, including the payment of a stipend or salary, of a Cuban scholar to teach or engage in other scholarly activity at the sponsoring U.S. academic institution; or
- The organization of, and preparation for, activities described in paragraphs (1) through (5).
The comprehensive US embargo on trade with Cuba, however, remains in effect.
This embargo restricts the items that you are permitted to take when traveling to Cuba. All Texas State University travelers are responsible for ensuring that they are in compliance with relevant regulations. You may take the following approved items to Cuba without the need of a license from the US government:
- Personally owned laptops and mobile devices as long as the appropriate exemption is documented and they are standard-issue, commercially available devices that do not contain (a) any export controlled information, data, or software or (b) specialized encryption software;
- Personal effects for your use (including clothes, toiletries, medical supplies, food).
There are also many other items that you likely can take with you to Cuba under various license exceptions, or by securing a license. For example, if you are going to Cuba for professional meetings or research, you generally can take items that you will need to complete your professional work. Taking such items to Cuba, however, requires you to either qualify for a license exception or to get a license from the Department of Commerce. In no circumstance may you bring items to Cuba that qualify as defense articles controlled under the International Traffic in Arms Regulations (ITAR).
Any Texas State University traveler planning to take items beyond those normally allowed as enumerated above must thus consult and receive approval from Research Integrity and Compliance before traveling.
Please contact Sean Rubino at email@example.com or call 512.245.2314, with any questions you have concerning travel to Cuba.
Information Applicable to All Authorized Cuba Travel
- OFAC has established a General License authorizing U.S. airlines, ferry services, and private vessels (under certain conditions) to provide travel services to Cuba.
- There is no per diem limitation on authorized travelers’ spending in Cuba. All transactions ordinarily incident to travel within Cuba, including living expenses and acquisition of goods for personal consumption while in Cuba are authorized. Travelers may bring back no more than $400 worth of goods from Cuba for personal use (provided that no more than $100 of the goods consists of alcohol or tobacco products).
- The Department of Commerce issued an amendment to the Export Administration Regulations (EAR), creating a new license exception SCP (Support of the Cuban People), which authorizes the temporary export of certain items for use in professional research and educational activities. Texas State owned equipment, including laptop computers, digital cameras, or cell phones may now be taken to Cuba under this exception; however, the items should be accompanied by a Texas State letter of ownership, need to be kept under the control of the traveler while in Cuba, and must be brought back to the United States. If traveling with export-controlled software, technology or material, a specific license may be required. It may take up to 2 months to obtain a license. Please contact Sean Rubino at firstname.lastname@example.org, if you need additional information or to obtain a license to carry University owned equipment to Cuba.
In addition to meeting U.S. and University requirements, travelers to Cuba must meet all applicable visa requirements imposed by the Cuban Government. Generally, educational travel must be approved or arranged through an agency authorized by the Cuban Government or sponsored by a Cuban institution, such as the University of Havana. Professional research must similarly be sponsored by a Cuban institution. It is important to recognize that sponsoring organizations in Cuba will have their own processes for approval, and that it may take several weeks or months for a proposed activity to be approved by the sponsor.
Information on Cuba travel visas may be obtained through the Cuban Embassy in Washington, DC. Phone calls to the Academic Visa Section should be directed to 202.797.8518 ext 123 or via U.S. mail: 2630 16th NW, Washington, DC 20009.