1. ITAR Civil Enforcement A Pound of Cure and Then Some…. John Pisa-Relli Legal Director - Trade Compliance Thales USA, Inc. November 2011

3. Quis Custodiet Ipsos Custodes Who Watches the Watchers? Despite arguable availability of administrative hearings, for all intents and purposes no due process exists DDTC’s willingness to use its denial and suspension powers as leverage is an almost irresistible force DDTC enforcement staff enjoys considerable autonomy and wide latitude to pursue cases And its decisions are largely immune from judicial review because of national security implications

4. A Target Rich Environment How Are Violations Uncovered? Customs seizures Intelligence reports Referrals from other agencies DDTC watchlist Criminal cases Coordinated USG investigations Disclosures (voluntary/directed) “ Blue Lantern” end use checks License/registration discrepancies Whistleblowers Disgruntled employees DDTC Company Visit Program Competitors M&A due diligence SEC filings Media investigations

5. Enforcement Priorities How Are Cases Selected? Significant violations that impact U.S. national security and foreign policy interests, especially involving “crown jewel” technologies and proscribed countries Companies that challenge DDTC ’s regulatory authority Recurring themes include tech data transfers and defense services , but DDTC often uses individual cases to single out specific or novel issues And each case seems to embody one or more “morals” apparently calculated to send a message to industry

6. Spare the Rod and Spoil the Child Hallmarks of DDTC Enforcement Aggressive penalty calculation Directed remediation almost always imposed Successor and predecessor liability Stern, uncompromising posture toward industry Little latitude to negotiate more than “terms of surrender”

7. Directed Remediation A Bitter Pill to Swallow Appointment of external or internal compliance monitor Establishment of electronic tech data tracking system Strengthen policies and procedures and conduct training Conduct internal and external audits Establish or reaffirm legal department and senior management oversight Establish or reaffirm compliance “hotline” or other reporting channels

8. 2 2 5 2 2 5 1 4 2 3 01 02 03 04 05 06 07 08 09 10 ITAR Civil Cases over the Last Ten Years

9. Odds of being targeted for enforcement arguably low The Numbers Game Is It Worth the Gamble? But the stakes are high Is it worth gambling with a company’s reputation and ability to do business?

10. To Disclose or Not to Disclose Weighing Risks and Benefits

11. DDTC expects disclosures to demonstrate compliance Companies without track record for disclosure arouse suspicion Few cases actually trigger penalties Can lead to “snowball effect” Proven mitigating effect Protects national security interests by keeping DDTC alert Risk of discovery greater than you might think Gives DDTC a “ready-made” case Often impairs relationships with implicated business partners No guarantees you’ll just get a “slap on the wrist” Aggravating factor if violations independently discovered