Is the ITAR Enforceable?

By Jon W. van Horne, Greenberg Traurig, Washington DC

[Published in slightly different form, Legal Times of Washington, June 22, 1998.]

By allowing the entire International Traffic in Arms Regulation ("ITAR") to become a paperwork "bootleg," the Office of Defense Trade Controls of the Department of State has been in violation of the Paperwork Reduction Act ("PRA"), 44 U.S.C. §§ 3501-3520, since December 1995. Because of the PRA's "public protection" provision, 44 U.S.C. § 3512, the ITAR's status as an unapproved collection of information, or "bootleg," will make its enforcement difficult or impossible.

The Paperwork Reduction Act

The PRA explicitly prohibits an agency from conducting or sponsoring a "collection of information" unless it has in advance obtained OMB approval of the collection and an OMB control number "to be displayed upon the collection of information." 44 U.S.C. § 3507(a). The OMB approval cannot extend beyond three years. 44 U.S.C. § 3507(g). Prior to getting from OIRA an extension of any approval, the agency must seek public comment on the continued need for, and burden imposed by the collection of information. 44 U.S.C. § 3507(h). A "collection of information" is defined by the PRA to include a "causing of facts to by obtained for the agency" which calls for identical recordkeeping or reporting requirements on ten or more non-governmental persons. 44 U.S.C. § 3502(3). All forms, and reporting and recordkeeping requirements fall within this definition.

In order to obtain OMB approval, the agency must certify and provide a record supporting the certification, including public comments received by the agency, that each collection of information submitted to the Director for review:

1. is really necessary for the proper performance of the functions of the agency,
2. has "practical utility;"
2. is not unnecessarily duplicative;
3. reduces as much as possible the burden on those providing the information, with special consideration for small businesses;
4. is written using "plain, coherent, and unambiguous terminology" and is understandable to those who are to respond;
5. meshes, "to the maximum extent practicable," with existing industry reporting and recordkeeping practices;
6. specifies record retention requirements;
7. contains certain information about the collection required by the statute;
8. has been developed by an office with enough resources to actually make use of the information;
9. to the maximum extent practicable, uses information technology to reduce burden on the public. 44 U.S.C. § 3506(c)(3).

OMB review of the information collection is based on similar objectives of minimizing burden and maximizing practical utility. 44 U.S.C. § 3504(c). These are also defined terms. "Burden" includes all the time, effort and financial resources needed to understand and respond. 44 U.S.C. § 3502(2). "Practical utility" is the ability of the agency to actually use the information "in a timely and useful fashion." 44 U.S.C. § 3502(11). If OIRA determines that the information collection is unnecessary for the proper performance of the functions of the agency "for any reason," the agency may not engage in the collection of information. 44 U.S.C. § 3508.

The International Traffic in Arms Regulations

The ITAR, 22 C.F.R. Parts 120-130, is a set of regulations establishing and implementing controls on the export and import of items on the United States Munitions List (USML), 22 C.F.R. Part 121. Promulgated by the United States Department of State pursuant to Section 38 of the Arms Export Control Act, 22 U.S.C. § 2778, ITAR regulates not only defense articles in the traditional sense of guns and tanks, but also (1) dual use items of strategic significance such as remote sensing satellites like LANDSAT and encryption software, (2) defense services, defined to include the furnishing of various kinds of assistance such as training, relating to the design, manufacturing, maintenance and use of a defense article; and (3) "technical data," defined to encompass all information related to the design, development, production , maintenance assembly or operation of defense articles. ITAR is further broadened by the definition of "export" which includes the disclosure of technical data to a foreign person (even within the territorial United States), 22 C.F.R. § 120.17(4), and the performance of defense services (even within the territorial United States), id. at 120.17(5).

ITAR implements its regulatory scheme through registration, licensing and record keeping requirements. First, ITAR requires registration by "any person who engages in the United States in the business of either manufacturing or exporting defense articles or furnishing defense services." 22 C.F.R § 122.1(a). Second, except as expressly exempted, every person must apply for and obtain from the State Department a license to export a defense article or defense service in advance of exporting (whether the exporter is registered or not). 22 C.F.R. § 123.1. And third, every person must maintain records of every export (even if claiming an exemption from the licensing requirement) and periodically submit reports of these exports to the State Department. 22 C.F.R. §§ 123.26, 126.13.

PRA Public Protection

Now what gives the PRA its spice is the "public protection" provision, which provides that "[n]ot withstanding any other provision of law, no person shall be subject to any penalty for failing to comply with a collection of information" that is subject to the PRA if the collection of information does not display a valid control number. 44 U.S.C. § 3512(a). The PRA goes on to say:

The protection provided by this section may be raised in the form of a complete defense, bar, or otherwise at any time agency administrative process or judicial action applicable thereto.

44 U.S.C. § 3512(b). The term "penalty" as used in the PRA includes "the imposition by an agency or court of a fine or other punishment; a judgment for monetary damages or equitable relief; or the revocation, suspension, reduction, or denial of a license, privilege, right, grant, or benefit." 44 U.S.C. § 3502(14).

The Big "Oops"

As a former chairman of the Business Council on the Reduction of Paperwork, I have had the pleasure of learning the ins and outs of this marvelous piece of regulatory arcana called the Paperwork Reduction Act. I still check agency compliance with the PRA while looking into other issues as I did recently when reviewing a matter involving the ITAR.

While doing my research, I decided to take a look at the package that should have been submitted by the State Department to justify to OMB and the public certain specific information collections under the ITAR. See 5 C.F.R. § 1320.5. After searching electronically and contacting the State Department Legal Advisor's Office, I came up with only four OMB clearance numbers relating to the ITAR, OMB Nos. 1405-0013, 1405-0025, 1405-0093 and 1405-0103.¹

_________________

¹ For collections of information in a regulation, the agency may "display" the control number by including it in the preface to the rule or in the CFR version, although OMB recommends doing both. 5 C.F.R. § 1320.3(f)(3). ODTC does have a valid OMB number (1405-0106) for a customer service survey that does not expire until Aug. 31, 1998. The State Department has submitted a timely renewal request to OIRA for this clearance. 63 Fed. Reg. 7491, Feb. 13, 1998.

The last number, 1405-0103, was assigned to a temporary information collection approval for the revised recordkeeping requirements relating to temporary export of cryptographic products for personal use. 61 Fed. Reg. 6283, Feb. 16, 1996. That approval expired in April 1996 and has not been renewed. OMB number 1405-0025 covers manufacturing license agreements, technical assistance agreements and other agreements. See 22 C.F.R. Part 124. OMB number 1405-0093 covers the Statement of Political Contributions, etc., required by 22 C.F.R. Part 130. These two clearances both expired in March 1996 and apparently have never been "displayed" as required by the PRA. The rest of the ITAR has had only one OMB control number assigned, 1405-0013. Cf. 58 Fed. Reg. 60115, Nov. 15, 1993.

According to several conversations I have had with personnel at the Office of Information and Regulatory Affairs ("OIRA"), the part of OMB that deals with PRA approvals, the approval associated with OMB No. 1405-0013 expired in December 1995 and has not been renewed by the State Department. My search of the Federal Register has located no notice for public comment on the renewal of the 1405-0013 control number as required by 44 U.S.C. § 3506(c)(3). The State Department published notices regarding a number of specific ITAR information collections on May 12, 1998. 63 Fed. Reg. 26242-45. These clearance requests have not yet been submitted to OIRA and no renewal of OMB No. 1405-0013 appears to be contemplated.

Either by omission or commission, the ITAR has no current approved OMB control number. The entire ITAR, therefor, must be considered an illegal information collection, i.e., a "bootleg", and all recordkeeping and reporting requirements under the ITAR presently runs afoul of the Public Protection Provision of the PRA.

I would have thought that, once aware of this situation, the Office of Defense Trade Controls would have asked OMB for, and undoubted would receive, emergency approval of this information collection. 5 C.F.R. § 1320.13. Indications are that the State Department has no great concern for the two year lapse in its statutory compliance and is proceeding with all deliberate speed to seek public comment prior to making the required application to OIRA In any event, the State Department has provided an opportunity for public comment on the issue of minimizing the burden of the collection of information and the "practical utility" of much of the information collected under the ITAR. This will not, however, solve the enforcement problems caused by the ITAR being a paperwork "bootleg" for two and a half years. This "bootleg" status will have significant implications for enforcement actions and congressional oversight in such areas as encryption software and missile technology.

In United States v. Blair, 866 F.2d 1092 (9^th Cir. 1989), the court held that the PRA precluded criminal prosecution for working on mining claims without having applied for and obtained a permit. In doing so, the court quoted the 1980 legislative history of the Act: "Information collection requests which do not display a current control number or, if not, indicate why not, are to be considered 'bootleg' requests and [under PRA section 3512] may be ignored by the public." S.Rep. No. 96-930 at 52, reprinted in 1980 U.S. Code Cong. & Admin. News 6292. See also United States v. Hatch, 919 F.2d 1394 (9^th Cir. 1990).

No doubt, the immediate prosecutorial response will be that the public protection provision does not apply when the requested information is provided but is false. United States v. Weiss, 914 F.2d 1514 (2^nd Cir. 1990); United States v. Sasser, 974 F.2d 1544 (10^th Cir. 1992). And that it does not apply to collections of information expressly mandated by statute. United States v. Hicks, 947 F.2d 1356 (9^th Cir. 1991); United States v. Wunder, 919 F.2d 34 (6^th Cir. 1990). This latter argument could be relevant to the ITAR because it is promulgated pursuant to the Arms Export Control Act, 22 U.S.C. § 2778, which explicitly requires registration of exporters and brokers and licensing of the export of Munitions List items. However, the Hicks and Wunder decisions, to the extent they contain any analysis at all, appear to conclude that Congress could simply not have intended the obvious meaning of the plain language of the statute, especially where the Internal Revenue Code is concerned. The 1980 legislative history of sections 3508 and 3512 show that Congress clearly intended a distinction between not giving the administration the ability to ignore statutory information collections on the one hand and controlling agency discretion in the implementation of those statutory requirements on the other hand.

In 1995, in part because of the judicial decisions, the public protection provision was revised and strengthened when the PRA was amended and reenacted by Public Law 104-13, May 22, 1995, 109 Stat. 163. However, the OMB regulations implementing the PRA have claimed the judicially invented limitations on the public protection provision as an element of OIRA's discretion in enforcing the PRA. 5 C.F.R. § 1320.6(e). On the other hand, the Court of Appeals for the D.C. Circuit recently endorsed a distinction between statutes which directly impose an information collection burden on the public without agency action and those statutes which authorize an agency to take discretionary action to impose such a burden. In the latter case, it was held that the public protection provision applies. Saco River Cellular, Inc. v. Federal Communications Commission, 133 F.3d 25, 32 (D.C.Cir. 1998) (PRA public protection provision "simply trumps" sections of the Communications Act of 1934). Although the Arms Export Control Act explicitly requires registration and licensing, the authorization to the agency to promulgate regulations for various types of disclosure, reporting and record keeping to fulfill the requirements clearly comes within the scope of the public protection provision. Reading the PRA as a whole, the public protection provision covers more than collections of information that OIRA can disapprove under 44 U.S.C. § 3508. There is a clear legislative intent that all collections of information expressed in statute but conducted or sponsored by an agency are subject to public protection.

The public protection provision is the administrative equivalent of the exclusionary rule in criminal cases, a difficult remedy but one that is necessary if the government is to be held responsible when it violates the law. One can anticipate the argument that damage to national security could result from application of the public protection provision to the ITAR. In reality any damage is caused by the government's violation of the law. Public protection isn't an issue until an agency breaks the law. Although damage to national security interests could result from the State Department's failure to comply with the PRA, the alternative is wholesale violation of the law by the executive branch and imposition of the very evils the Paperwork Reduction Act was intended to prevent: unnecessary, unjustified and unrestrained reporting and recordkeeping requirements, which in the information age are potentially as destructive of our freedoms as the power to tax was to our ancestors.

Jon W. van Horne

202-331-3154

vanhornej@gtlaw.com