Many people are unaware that there are numerous laws applying to drones. Yes, we all know there are regulations on how you fly drones, but regulations apply to who can access certain drones, drone technology, software, and drone manufacturing. These are typically called drone export control laws. And before you say, “I’m not shipping these things outside the country. I don’t have to pay attention to these laws.”, it does NOT work that way. You can have export violations inside the United States. Here are some scenarios:

• Selling an export-controlled drone to a person here on a student/work visa.
• Allowing the cleaning crew here in the country on a work visa to have access to the controlled drone.
• Migrant workers (on work visas) have access to the farmer’s warehouse where the large spray drones are stored.
• Emailing controlled technical data to potential or current customers over the email unencrypted.
• A drone manufacturer hires an employee (here on a work visa) or a student intern (on a student visa) and allows them to have access to controlled technology or items.

Drone pilots, owners, operators, manufacturers, sellers, and their employees must pay attention to these export laws.

Who has to comply with the export laws?

Pretty much everyone in the United States.  People, companies, governmental entities, etc.  The Federal Aviation Administration even has an order on how they comply with export controls since they deal with all sorts of controlled things like radar, GPS technology, maintenance and hardware technical data, and commercial space technology.

What are export control restrictions?

Basically, it controls who can have access to what in and outside of the United States. There is a huge list of things controlled, so you will have to spend some time trying to figure out what you presently have that is export-controlled and the specific controls on that item.

Because of these restrictions, people in other countries try to purchase things in the United States and secretly funnel them out to restricted countries or people.  Consider  the prosecution of Kristina Puzyreva for an example:

“[T]he defendant was a key part of the plan, laundering proceeds from the scheme to evade sanctions and ship UAV and missile components to Russia that were later found on the battlefield in Ukraine[.] . . . [T]he defendant’s co-conspirators unlawfully sourced, purchased and shipped millions of dollars in dual-use electronics from U.S. manufacturers to end users, including sanctioned entities, in Russia. The electronic components and integrated circuits shipped were later found in seized Russian weapons platforms and signals intelligence equipment in Ukraine, including in UAVs and guided missiles.”

The two most common sets of regulations the drone industry deals with are the (1) Export Administration Regulations (EAR), which are administered and enforced by the Bureau of Industry and Security under the Department of Commerce, and (2) the International Trafficking in Arms Regulations (ITAR) which is regulated by the Directorate of Defense Trade Controls under the State Department.

What are the penalties for not complying?

Failure to comply can range from thousands of dollars in fines to 20 years in prison per single violation.  It’s obviously going to depend on whether it was accidental versus intentional and what type of controls were on the item.

Here is a guy who was busted selling a military drone.

From a State Department notice in 2023:

“In addition, DOJ is leading two interagency law enforcement initiatives that will help undermine Iran’s ability to acquire UAV technology. DOJ leads Task Force KleptoCapture, which was stood up in March 2022 to enforce the sanctions, export controls, and other economic countermeasures imposed on Russia for its unprovoked military invasion of Ukraine. One of the central goals of the Task Force is to cut off support to Russia’s war effort, including the transfer of UAVs from Iran that are being used against the Ukrainian people.20 In February 2023, DOJ and BIS created the Disruptive Technology Strike Force, an interagency effort focused on investigating and prosecuting the illicit transfer of sensitive technologies to foreign state adversaries, including Iran.21

In March 2023, DOJ’s National Security Division (NSD) issued an updated voluntary self-disclosure policy that underscores the imperative that companies voluntarily disclose potential criminal violations of U.S. national security laws, including sanctions and export control laws, or face criminal exposure.22 As set forth in NSD’s Enforcement Policy for Business Organizations, where a company voluntarily discloses potentially criminal violations, fully cooperates, and takes timely and appropriate remedial steps, and where there are no aggravating factors, there will be a presumption that the company will receive a non-prosecution agreement and will not pay a fine. By contrast, where a company’s conduct causes an elevated threat to national security, a stricter penalty may be warranted. In furtherance of these efforts to crack down on corporate non-compliance with national security laws, DOJ also announced the hiring of 25 new prosecutors to investigate and prosecute sanctions evasion, export control violations, and similar economic crimes.”

Why were drone export control regulations created?

National security.  You don’t want a potential adversary to obtain access to the technology or end items. An example is where this one Russian was attempting to obtain parts to include into unmanned aircraft.

Anti-Terrorism.  You don’t want the terrorists to cause death, destruction, chaos, etc., with the technology.  The State Department recently put out this notice.

“Iran relies on foreign procurement to obtain items it cannot produce domestically, often preferring U.S.-origin technologies. Recovered Iranian-origin UAVs used by Russian forces in Ukraine reveal that Iran’s UAV program has used many components produced by third-country suppliers. Industry should be aware of its compliance obligations due to the threat posed by the extensive overseas network of procurement agents, front companies, suppliers, and intermediaries Iran uses to obtain UAV components, all of which employ a variety of methods to evade export controls and sanctions. Industry should exercise extra vigilance due to the ubiquitous nature of many of the items, as Iran utilizes commercial-grade components in its weapons.”

Foreign Policy.  You want to have a bargaining chip in negotiations with another nation. Perhaps that country is doing something we don’t like. Looks like no cool drone tech for your citizens and businesses.

Economically Influencing People and Businesses.  DJI has been blacklisted by the Department of Commerce. This creates certain types of restrictions on how US companies interact with DJI.

List of Drone Companies With Additional Export Controls

DJI   DJI has been blacklisted by the Department of Commerce.

Autel Robotics – See Federal Register posting.

But my drone is not used by the military. Why is it controlled?

Yes, you can probably figure out that military drones are controlled. Some commercial drones are export-controlled items because they are “dual use” in that they have civilian uses and military uses.  Think of long-range drones. You can use them for mapping or scouting enemy positions to then call in artillery.

“I’m Never Going to Hire Any Foreigners. Does This Fix Things?”

This is a big civil rights issue. I’ll just quote directly from the DOJ’s article:

“The Justice Department today announced that it reached a settlement agreement with Clifford Chance US LLP, a large, international law firm with its U.S. headquarters located in New York. This agreement resolves the Department’s investigation into whether the law firm engaged in hiring discrimination by refusing to consider work-authorized non-U.S. citizens and dual citizens to staff a client project, in violation of the Immigration and Nationality Act (INA). 

The Department determined that there was reasonable cause to believe that from March 30, 2017, until at least July 7, 2017, Clifford Chance unlawfully restricted its staffing for 36 positions on a document review project based on citizenship status. The Department’s investigation determined that Clifford Chance’s unlawful practice of excluding otherwise qualified non-U.S. citizens and dual U.S. citizens from the document reviewer positions was based on the law firm’s misunderstanding of the requirements of the International Traffic in Arms Regulations (ITAR). The Department found that the law firm improperly terminated or removed three individuals from their positions based on their citizenship status.

The ITAR regulates specific exports of defense articles and services, and – absent State Department authorization – limits access to certain sensitive information to U.S. citizens, U.S. nationals, lawful permanent residents, asylees, and refugees.  The ITAR thus does not authorize or require employers to hire only U.S. citizens. Employers that limit their hiring to U.S. citizens without a proper legal basis may violate the INA’s anti-discrimination provision, which prohibits hiring discrimination based on citizenship and national origin.

‘Employers subject to the ITAR must be careful not to engage in unlawful discrimination against U.S. workers,’ said Acting Assistant Attorney General John Gore of the Civil Rights Division.”

Here is the settlement agreement between DOJ and that law firm where the law firm agreed to pay $132,000.

The DOJ also sued Space X for discrimination against asylees and refugees in hiring. See here.

What Types of Drones and Drone Tech Are Export Controlled?

Keep in mind that I am only putting here SOME of the things controlled. There are hundreds of controls. You should due your own diligence.  This stuff is here to just get you to thinking.

Drones that can fly 30+ minutes in wind gusts 25 knots or more. (CCL ECCN 9A012.a.1)

Some of the commercial off-the-shelf drones can fall into this category. Some of the drone in a box type drones might fall into this classification also.

a. “UAVs” or unmanned “airships”, designed to have controlled flight out of the direct ‘natural vision’ of the ‘operator’ and having any of the following:
a.1. Having all of the following:
a.1.a. A maximum ‘endurance’ greater than or equal to 30 minutes but less than 1 hour; and
a.1.b. Designed to take-off and have stable controlled flight in wind gusts equal to or exceeding 46.3 km/h (25 knots);

Drones that can fly 60+ minutes (CCL ECCN 9A012.a.2)

If you are using a beyond line of sight type of drone, it’s most likely controlled under this.

a. “UAVs” or unmanned “airships”, designed to have controlled flight out of the direct ‘natural vision’ of the ‘operator’ and having any of the following: . . . a.2. A maximum ‘endurance’ of 1 hour or
greater;

Large SprayDrones (CCL ECCN 9A120)

Most of the large spray drones are controlled under this.

Complete unmanned aerial vehicles, not specified in 9A012, having all of the following characteristics (see List of Items Controlled.)

“a. Having any of the following:

a.1. An autonomous flight control and navigation capability; or

a.2. Capability of controlled-flight out of the direct vision range involving a human operator; and

b. Having any of the following:

b.1. Incorporating an aerosol dispensing system/mechanism with a capacity greater than 20 liters; or

b.2. Designed or modified to incorporate an aerosol dispensing system/mechanism with a capacity of greater than 20 liters.”

Spray Drone Equipment (ECCN 2B352.i)

Not only is the entire spray drone controlled under 9A120 above, but the spray equipment is individually as well. It makes sense. You don’t want this equipment to be used to retrofit an unmanned aircraft.

i.1. Complete spraying or fogging systems, “specially designed” or modified for fitting to aircraft, “lighter than air vehicles,” or “UAVs,” capable of delivering, from a liquid suspension, an initial droplet “VMD” of less than 50 microns at a flow rate of greater than 2 liters per minute;

i.2. Spray booms or arrays of ‘aerosol generating units’, “specially designed” or modified for fitting to “aircraft,” “lighter than air vehicles,” or “UAVs,” capable of delivering, from a liquid suspension, an initial droplet “VMD” of less than 50 microns at a flow rate of greater than 2 liters per minute;

i.3. ‘Aerosol generating units’ “specially designed” for fitting to the systems as specified in paragraphs i.1 and i.2 of this ECCN.

Swarming Technology

Pay attention to this if you are doing a drone light show.

22 CFR 121.1, Category VIII, (h)(12) says,

“(12) Unmanned aerial vehicle (UAV) flight control systems and vehicle management systems with swarming capability (i.e. UAVs that operate autonomously (without human input) to interact with each other to avoid collisions, fly in formations, and are capable of adapting in real-time to changes in operational/threat environment, or, if weaponized, coordinate targeting) (MT if for an aircraft, excluding manned aircraft, or missile that has a “range” equal to or greater than 300 km);”

The big problem is that you need to figure out the dumb uncontrolled swarm versus the smart controlled swarm.

Counter Drone Training

Drone Operator Issues

Warranty Issues.

It can get problematic. Here is a real-world example. Let say you have an export controlled manufactured in China and you need to send it back for repairs under warranty.

Sending Technical Data to FAA, Your Attorney, Customers, etc.

Sending controlled technical data is more complicated than just hitting attach to an email. There are very specific regulations on how controlled technical data is encrypted and transmitted. Mixed in with this is email service providers will sometimes flag as spam encrypted email attachments. Even if you solve that, the FAA and some companies can only open certain types of encrypted files with certain software. Not everyone can use or install Winzip due to IT restrictions or company licensing. Tracking down documentation that shows the encryption software used to encrypt the drone technical data is compliant or verified to the level needed by the regulations can be a daunting experience. Assuming all of that is figured out, some encryption programs also require you to reconfigure your Windows operating system to be compliant. Like I said……it’s complicated.

If that wasn’t enough, if you are trying to obtain an exemption or waiver and have to submit drone technical data to the Federal Aviation Administration, this can be a pain. It can be done. It’s not a deal breaker. It might increase project times and budget costs. Consider this: if the drone is export-controlled in the U.S., there is a very good chance it’s export-controlled in another country, which means the manufacturer might need an export license to export to you! 

Before purchasing a drone, it’s important to jump on a short consultation with Chris to see if anything would be triggered.

Relying on Manufacturer’s Determinations That It Isn’t Controlled…When It Is.

This is a big pet peeve of mine. The sales guys and drone manufacturers want to push drones. They don’t want anything to hinder this. I have had sellers literally tell me stuff wasn’t controlled when I knew it was. I told my client it was controlled but who knows how many other customers were told by the manufacturer that the item was controlled.  When shopping for an item that you think might be controlled under the ITAR, ask the manufacturer if they have obtained a commodity jurisdiction request. Ask if the aircraft or item you are purchasing is the same configuration as what was submitted in the request.

I’m telling you, the sales guys are just horrible at this. If you communicate via email with the sales guy from one well-known drone seller in the industry, you’ll find this at the bottom of their emails, “CONFIDENTIALITY NOTICE:  This transmission may include information on International Traffic in Arms Regulation (ITAR) (22 CFR-120-130) controlled items. These controlled items may not be resold, diverted, transferred or transshipped outside of the United States or to any other country without U.S. State Department approval.” The big problem here is when I received that email from the sales guy in 2017, ITAR did not even allow for controlled technical data to even be emailed. It was like a giant admission that they had no idea what they were doing. Warning me something *may* be ITAR controlled in their email means they don’t know whether their stuff is ITAR controlled or not but are just sending stuff off blindly.

When purchasing a drone or equipment, it’s great to just ask a reseller or manufacturer the question, “What’s the export classification of this?”  If they come back with “it isn’t export controlled” or “I don’t know”, those are red flags that the person you are speaking with doesn’t know what they are doing. Everything is export controlled so they should say something like EAR99, ECCN 9A012, etc. Many things in the drone industry are just classified as EAR99 which is regulated, but much less than ECCN 9A01, which leads people to think the stuff is unregulated. If they don’t know the answer, they don’t have their act together. They might get violations in the future for export violations and be put out of business and can no longer provide you customer support for your drone.

Drone Manufacturer or Supplier Issues

There are multiple controls regarding the production and development of unmanned aircraft.  Some of the end items may not be heavily regulated, but the ability to manufacture, repair, and develop the items may be even more regulated. And this makes sense.  If you can build a small drone, you can build a big drone…one that can really cause a lot of damage.

The State Department recently put out this notice.

“Iran relies on foreign procurement to obtain items it cannot produce domestically, often preferring U.S.-origin technologies. Recovered Iranian-origin UAVs used by Russian forces in Ukraine reveal that Iran’s UAV program has used many components produced by third-country suppliers. Industry should be aware of its compliance obligations due to the threat posed by the extensive overseas network of procurement agents, front companies, suppliers, and intermediaries Iran uses to obtain UAV components, all of which employ a variety of methods to evade export controls and sanctions. Industry should exercise extra vigilance due to the ubiquitous nature of many of the items, as Iran utilizes commercial-grade components in its weapons.

….

Exporters, manufacturers, and distributors of items listed above should be aware of the importance of carrying out customer due diligence in a way consistent with BIS’s “Know Your Customer” Guidance and Red Flags², and should track to whom they are selling and/or shipping their items.  We urge manufacturers that supply UAV-relevant items to establish multiple methods to track such items due to the observed prevalence of methods used to obscure the sources of components found in Iranian UAVs, such as the lasering off of serial numbers and other identifying information.”

In that same State Department notice:

Select Red Flag Indicators of Export Control Evasion

The U.S. Government expects companies to have effective and comprehensive compliance programs that detect efforts by individuals or entities to evade or otherwise violate sanctions and export controls.

Effective compliance programs employ a risk-based approach to sanctions and export controls by developing, implementing, and routinely updating compliance measures.  Companies such as manufacturers, distributors, resellers, and freight forwarders are often best positioned to determine whether a particular transaction or inquiry is consistent with industry norms and practices, and otherwise indicates an elevated risk of sanctions or export control evasion.  Companies should exercise heightened caution and conduct additional due diligence if they detect warning signs of potential sanctions or export control violations.¹⁵

Compliance programs should reflect management commitment to compliance and include risk assessment, internal controls, testing, auditing, and training.¹⁶   Effective programs empower and equip staff to identify and report potential violations of U.S. sanctions and export controls to compliance personnel so that companies can prevent or cease violative conduct and determine whether to make timely voluntary disclosures to the U.S. Government.  Optimally, compliance programs should include controls tailored to the risks the business faces, such as diversion by third-party intermediaries.

While not exhaustive, the “red flags” listed below demonstrate that a party to the transaction may be engaged in efforts to evade or otherwise violate sanctions or export controls:

• Use of corporate vehicles (i.e., legal entities, such as shell companies, and legal arrangements) to obscure (i) ownership, (ii) source of funds, or (iii) countries/entities involved, particularly sanctioned jurisdictions or restricted entities;
• Reluctance to share information about the end use of a product, including reluctance to complete an end-user form;
• Declining customary installation, training, or maintenance of the purchased item(s);
• “Cyber spoofing” of email or web addresses to give the appearance that an illegitimate inquiry is coming from a legitimate business. Often these attempts will leverage known business relationships to lend credibility to the spoofing attempt.
• Internet or corporate website traffic originating from IP addresses that do not correspond to a customer’s reported location data;
• Transactions involving entities with little or no web presence;
• Use of personal rather than corporate email addresses;
• Last-minute changes to shipping instructions that appear contrary to customer history or business practices;
• Payment coming from a third-party country or business not listed on the End-User Statement or another applicable end-user form;
• Use of shell companies to conduct international wire transfers, often involving financial institutions in jurisdictions distinct from company registration;
• Changes to standard business documents that obscure the ultimate customer;
• Operation of businesses using residential addresses or addresses found to be common to multiple corporate entities;
• Transactions involving the use of freight-forwarding firms¹⁷ or other mail forwarding addresses listed as the product’s ultimate customer address;
• Transactions associated with atypical shipping routes for a product and destination; or,
• Routing purchases through certain transshipment points commonly used to illegally
  redirect restricted items to embargoed destinations.

Further, companies should be aware that customers that use complex sales and distribution models may hinder visibility into the ultimate end-users of their technology, services, or products.

Best practices in the face of such risks may include screening current and new customers, intermediaries, and counterparties through the Consolidated Screening List  maintained by the Department of Commerce and the SDN List maintained by the Department of the Treasury, as well as conducting risk-based due diligence on customers, intermediaries, and counterparties. Companies should also regularly consult guidance and advisories from the Department of State, Department of the Treasury, and the Department of Commerce to inform and strengthen their compliance programs.

Also, if your company is large and/or important enough, you could also have issues with foreign investors and companies acquiring your company. That might trigger export-related issues.

How can drone sellers get into trouble?

Resellers should know the export classifications of all the drones and equipment they sell. Some groups purchase through intermediaries and shell companies. You don’t want your stuff ending up on the battlefield or at a terrorist scene. 

Syrian terrorists using Pixhawk 2 autopilot from @ProfiCNC for airbase drone attackshttps://t.co/QMr4FNfDUN pic.twitter.com/AI5l68brRb

— Chris Anderson (@chr1sa) January 15, 2018

https://twitter.com/chr1sa/status/952774891882790912?lang=en

You can also read this paper on Islamic State Drones and see the lengths the terrorist went to in purchasing online commercial drones.

Prohibited End Uses

While export restrictions sometimes speak specifically to certain items/technology, they also have certain regulations that address certain types of end uses.

15 CFR 744.3 says,

“In addition to the license requirements for items specified on the CCL, you may not export, reexport, or transfer (in-country) an item subject to the EAR without a license if, at the time of export, reexport or transfer (in-country) you know that the item:

(1) Will be used in the design, “development,” “production,” operation, installation (including on-site installation), maintenance (checking), repair, overhaul, or refurbishing of rocket systems or unmanned aerial vehicles capable of a range of at least 300 kilometers in or by a country listed in Country Group D:4 of supplement no. 1 to part 740 of the EAR.

(2) Will be used anywhere in the world except by governmental programs for nuclear weapons delivery of NPT Nuclear Weapons States that are also members of NATO, in the design, “development,” “production,” operation, installation (including on-site installation), maintenance (checking), repair, overhaul, or refurbishing of rocket systems or unmanned aerial vehicles, regardless of range capabilities, for the delivery of chemical, biological, or nuclear weapons; or

(3) Will be used in the design, “development,” “production,” operation, installation (including on-site installation), maintenance (checking), repair, overhaul, or refurbishing of any rocket systems or unmanned aerial vehicles in or by a country listed in Country Group D:4, but you are unable to determine:

(i) The characteristics (i.e., range capabilities) of the rocket systems or unmanned aerial vehicles, or

(ii) Whether the rocket systems or unmanned aerial vehicles, regardless of range capabilities, will be used in a manner prohibited under paragraph (a)(2) of this section.”

How Can An Export Attorney Help My Business?

Besides answering the big question of whether something is controlled or not, they can provide you guidance on setting up a technology control plan (TCP) as well as training for employees.  I highly suggest you work with Christopher Stagg in setting up a TCP so you and your employees don’t get in trouble.

How do we get a final answer on whether our drone stuff is export-controlled or not?

I would highly suggest you take some time and hire an attorney who specializes in this area. I would recommend Stagg Law. Christopher used to work at the State Department working on the ITAR regs. https://www.stagg.law/solutions/export-controls-itar-law-firm/

He can help you try and identify what is export-controlled and what the restrictions are.

If there is a close call on something, you can hire Christopher to request a commodity jurisdiction request from the State Department. The government responds and tells you whether the item is controlled by the ITAR or not. This is helpful.

Commodity Jurisdiction Requests for Drone-Related Tech

A commodity jurisdiction request (known in the industry as a CJ) asks DDTC to determine if the article is governed by ITAR or EAR. 

DDTC has more than 5,000 CJ determinations, some of which are regarding unmanned aircraft pieces of equipment, software, complete aircraft, detect and avoid equipment, training, and counter UAS equipment and training.

If you wonder why it says “Seek CCATS”, I asked Christopher Stagg and he said, “It means that the item is not subject to the ITAR. Specifically, the government did not provide its EAR classification (e.g., ECCN 9A012) while reviewing the commodity jurisdiction request. This comes up because sometimes Commerce will only advise during the CJ review process that the item is subject to the EAR but not specify the ECCN.  So DDTC’s CJ determination tells them to get a CCATS if they want an official EAR classification.”

If you want an item classified by BIS, you can request to find the export control classification number (ECCN).  In requesting a CJ from DDTC or a classification from BIS, it would be very helpful to work with an export control lawyer in requesting. Call Christopher Stagg who is an ITAR attorney that deals with export controls.

Here are some commodity jurisdiction requests from other companies. You can read over them and understand what types of drone-related items may be controlled.

Model Name          Manufacturer         Description                  Final Determination    Date

Can certain types of drone-related training be controlled?

Potentially. It’s tricky here. Are you providing specialized training on how to operate export-controlled drones as opposed to just general aviation training? Is there study material teaching things related to how to employ/utilize the specialized unique features of the export-controlled items or technology?  Mixed into this is that the regulations specifically exclude from the controls some information that is in the public domain. 22 CFR 120.34 says,

(a) Public domain means information which is published and which is generally accessible or available to the public:

(1) Through sales at newsstands and bookstores;

(2) Through subscriptions which are available without restriction to any individual who desires to obtain or purchase the published information;

(3) Through second class mailing privileges granted by the U.S. Government;

(4) At libraries open to the public or from which the public can obtain documents;

(5) Through patents available at any patent office;

(6) Through unlimited distribution at a conference, meeting, seminar, trade show, or exhibition, generally accessible to the public, in the United States;

(7) Through public release (i.e., unlimited distribution) in any form (e.g., not necessarily in published form) after approval by the cognizant U.S. Government department or agency (see also § 125.4(b)(13) of this subchapter); or

(8) Through fundamental research in science and engineering at accredited institutions of higher learning in the U.S. where the resulting information is ordinarily published and shared broadly in the scientific community. Fundamental research is defined to mean basic and applied research in science and engineering where the resulting information is ordinarily published and shared broadly within the scientific community, as distinguished from research the results of which are restricted for proprietary reasons or specific U.S. Government access and dissemination controls. University research will not be considered fundamental research if:

(i) The University or its researchers accept other restrictions on publication of scientific and technical information resulting from the project or activity; or

(ii) The research is funded by the U.S. Government and specific access and dissemination controls protecting information resulting from the research are applicable.

But this gets weird when you start taking public domain info, enhancing it, combining it, etc. to create something. Like I said…it’s tricky.