ITAR — International Traffic in Arms Regulations (22 CFR 120–130)
Issuing body / enforcer: U.S. Department of State, Directorate of Defense Trade Controls (DDTC), under the Arms Export Control Act (AECA), 22 U.S.C. 2778. Jurisdiction: United States, with extraterritorial reach — controls apply to U.S. persons and foreign persons handling ITAR-controlled items, including reexports and retransfers abroad.
1. What it is
ITAR is the U.S. export-control regime for defense articles, defense services, and related technical data listed on the United States Munitions List (USML), 22 CFR 121. Unlike the EAR (Commerce), which controls dual-use items, ITAR controls items specifically designed, developed, or configured for military use. Registration with DDTC is mandatory for any person who manufactures, exports, or temporarily imports defense articles or furnishes defense services — even a company that only designs controlled electronics but never ships hardware must register.
For electronics/embedded engineers, the touchpoints are concentrated in USML Category XI (military electronics) — e.g., certain electronic systems, assemblies, and specially designed components — plus Category XII (fire control, guidance, lasers), Category XV (spacecraft systems and associated equipment), and Category VIII (aircraft). Whether a board, FPGA design, or piece of firmware is ITAR-controlled is a jurisdiction and classification question answered by the Order of Review (ITAR 120.4), USML category language, and — when in doubt — a Commodity Jurisdiction (CJ) determination request to DDTC.
2. Scope, triggers, thresholds
- Defense articles: Any item on the USML. "Specially designed" has a precise ITAR definition (120.41) — most commercial electronics escape, but electronics developed for a military requirement or with no civilian application typically do not.
- Technical data: Information required for the design, development, production, manufacture, assembly, operation, repair, testing, maintenance, or modification of defense articles (120.33). Source code, schematics, and design files for USML items are controlled.
- Defense services: Furnishing assistance (including training) to foreign persons in connection with defense articles (120.32).
- Deemed exports: Releasing ITAR technical data to a foreign person in the United States is deemed an export to that person's most recent country of nationality — dual-national employees on an avionics project are a classic tripwire.
- Reexport/retransfer: ITAR follows the item. A foreign company that receives a USML component needs DDTC approval before reexporting or transferring it to another party (126.1/124-series approvals).
- No de minimis threshold and no license exceptions in the EAR sense: exports require a license or an available exemption (e.g., 126.16/126.17 for Australia/UK under AUKUS — see section 5).
3. Key compliance obligations
- DDTC registration (122.1–122.5): manufacturers, exporters, and brokers of defense articles/services must register annually and pay the registration fee. Brokers register separately (129).
- Licensing: DSP-5 (permanent export of unclassified defense articles), DSP-73 (temporary export), DSP-61 (temporary import); Technical Assistance Agreements (TAA) and Manufacturing License Agreements (MLA) for defense services and offshore production (124).
- Recordkeeping: five years from expiration of the license or completion of the transaction (122.5).
- End-use/end-user screening: prohibited destinations and proscribed countries (126.1 — e.g., China, Russia, Iran, Belarus, Cuba, North Korea, Syria, and others as updated by DDTC).
- Voluntary disclosure: companies discovering violations are expected to file voluntary disclosures with DDTC's Office of Defense Trade Controls Compliance; disclosures are a major mitigating factor in penalties.
- Technology control plans for facilities handling ITAR data, including foreign-national access controls and IT segregation.
4. Penalties and consequences
- Civil: DDTC may impose civil penalties up to approximately $1.25 million per violation under AECA §38(e), inflation-adjusted — [Flag: verify the current inflation-adjusted figure against DDTC's published penalty guidance; the statutory base is $500,000 per violation, adjusted annually.] Penalties compound per item/transaction, so a single program can generate dozens of violations.
- Criminal: willful violations carry up to $1,000,000 per violation and up to 20 years imprisonment (AECA §38(c)); conspiracy and false statements add exposure.
- Administrative: debarment from ITAR privileges, revocation of licenses, and consent agreements imposing external compliance monitors.
- Notable enforcement: RTX (Raytheon) entered a $200 million consent agreement in August 2024 covering 861 alleged ITAR violations, widely reported as the largest DDTC settlement at the time; Honeywell paid a $2.1 million penalty in 2025 over technical-data transfers to China — [Flag: figures as reported in trade press; confirm before citing formally.]
5. Live changes (verified against current sources, 2026-09-30)
- AUKUS exemption (August 2024): DDTC finalized rules creating license-free defense trade with Australia and the United Kingdom for most USML items (ITAR 126.7), a major carve-out for allied electronics programs. Excluded items remain (a defined excluded-technology list); confirm current scope before relying on it.
- USML Category XI/XII reviews: DDTC has been running rolling revisions of electronics-related USML categories to clarify the line between military and dual-use electronics. [Flag: check the current USML text and any 2025–2026 Federal Register notices before classifying — category language in electronics moves.]
- Space-related easing (October 2024): BIS and DDTC published coordinated rules easing controls on certain space technologies for allied partners. Relevant to satellite-electronics work.
- China/Russia posture: 126.1 proscribed-country policy continues to tighten around China, Russia, Iran, and Belarus; deemed-export scrutiny of Chinese nationals in U.S. electronics firms remains elevated.
- Practitioners should watch DDTC's Federal Register notices and the annual AECA §38 penalty inflation adjustment.
6. Related certifications
The catalogue holds no ITAR-specific professional certification — export-control competence is demonstrated through practice, not a flagship exam. Engineers working ITAR-adjacent electronics programs typically pair domain credentials (e.g., IPC CID / IPC-A-610 CIS for the hardware itself) with employer-run export-control training. Legal sign-off on jurisdiction/classification is normally counsel-led, not engineer-certified.
7. Practical notes for electronics/embedded engineers
- The single most common failure mode is engineers emailing schematics or firmware to a foreign colleague or contractor without checking classification. Treat every cross-border or foreign-national technical exchange as a deemed-export decision point.
- A CJ determination (120.4) is free and protective: when a component sits near the USML/CCL boundary (e.g., radiation-tolerant FPGAs, certain RF front ends), ask DDTC rather than guessing.
- ITAR registration is a company obligation, not an individual license — but individual engineers face criminal exposure for willful violations.
Original ETS reference writing, verified against public sources on 2026-09-30. Thin sourcing is flagged inline. Not legal advice — confirm current editions with the issuing body.