A wind tunnel dataset, a foreign university and a personal cloud link
You are the lead aerodynamicist on a company-funded, military-derived unmanned aircraft. The flight control laws and control-surface geometry derive from a programme that was subject to export controls, and the company trade-compliance register classifies the aerodynamic dataset as controlled technical data. A European university laboratory offers free wind tunnel time in exchange for the full dataset - surface geometry, pressure distributions and the gain schedule - for a joint paper. Separately, you learn that a foreign-national intern on your team has had read access to the same dataset on the shared drive for three weeks. The intern's visa lists a different country from the one recorded when access was granted, and the intern has already run CFD on the geometry. Your manager wants the university package sent by personal cloud link tonight to avoid the corporate file-transfer queue.
1. Is sending the dataset to the university an export? What must happen before any data leaves the company?
Read the worked answer
Yes, almost certainly. Sending controlled technical data to a foreign laboratory is a release to a foreign person and an export, even though nothing physical moves and the data is 'only' aerodynamic. The transfer mechanism is irrelevant; the recipient and the content govern.
Establish jurisdiction and classification first. Is the data on a munitions list (ITAR, administered by DDTC) because of its military derivation, or is it dual-use on the Commerce Control List (EAR, administered by BIS) with an assigned ECCN? The company register already says controlled, so the working assumption is controlled until trade compliance documents otherwise. The burden of correct classification sits with the exporter.
What is needed before transfer: trade-compliance review of the exact package; if controlled, an authorisation covering that specific university, the specific individuals whose nationality has been checked, and the specific technical content - a licence or an approved agreement such as a Technical Assistance Agreement, depending on jurisdiction. The co-authored paper is a public release and needs pre-publication review as well.
Do not use a personal cloud link. It is outside the approved environment, defeats the records needed to demonstrate compliance, and may breach data-handling or cyber clauses if the programme carries them. Give the university a scheduled, compliant answer rather than a refusal.
2. What is the problem with the intern's access, and what should you do about it in the next 24 hours?
Read the worked answer
The access is the problem. Under the deemed-export principle, releasing controlled technical data to a foreign national inside the country is treated as an export to that person's country of nationality or last permanent residence. The visa and the record disagree, so on its face the access was unlicensed and possibly to a different destination than anyone assessed. The CFD outputs may themselves be controlled technical data derived from the controlled input.
Next 24 hours:
- Report to trade compliance or the empowered official and to security the same day. Potential violations usually carry a short internal clock for reporting.
- Do not delete, move or tidy anything. Preserve access logs, the intern's files and the CFD outputs.
- Suspend further access pending review - move the dataset to a controlled repository and remove it from the general share. Document the suspension as a management action, not a sanction.
- Establish facts: nationality/ies and visa status, exactly what was accessed and when, whether anything left the network, whether any output was shared externally.
- Then, with trade compliance, decide whether an authorisation was required, whether a voluntary disclosure is appropriate, and what corrective action follows - access control, nationality screening at onboarding, training.
Do not accuse the intern or ask for a statement before compliance and HR are engaged, and do not amend the record to match the visa.
3. Your manager says the data is effectively public because a related paper was published, and repeats the request to send it tonight. How do you respond?
Read the worked answer
Refuse the mechanism, not the collaboration. The personal cloud link is refused on two independent grounds: the data is controlled and any transfer needs authorisation, and a personal account is outside the approved environment and creates a records problem even if the data were uncontrolled. Then offer the compliant route with a realistic date - trade-compliance review, the appropriate agreement or licence, an approved transfer method, and pre-publication review.
Test the publication argument rather than accepting it. The public-domain or publicly-available exclusion attaches to the specific information actually published, not to a category of information that resembles it. Verify: obtain the paper, compare the exact content - geometry, pressure distributions, gain schedule - item by item, and have trade compliance agree and record the comparison. In practice the published paper usually covers a generic or older configuration, or omits precisely the elements that make the current dataset controlled. The person asserting publication carries the burden of showing it.
If the pressure continues, confirm the position in writing to trade compliance and to the next level of management, keep dated records, and use the ethics or compliance hotline if needed. Keep the tone factual: the issue is the missing authorisation and the unapproved transfer path, not the manager's judgement or the value of the collaboration. The downside - civil penalties, individual criminal exposure, debarment from future programmes - is far larger than the delay.