What Is ITAR?

ITAR Explained

ITAR is administered by the Directorate of Defense Trade Controls within the State Department under authority of the Arms Export Control Act. Its jurisdiction is defined by the United States Munitions List, twenty-one categories covering everything from firearms and launch vehicles to military electronics, spacecraft, and the specific technical data required to design, produce, or maintain those items. If an item or its technical data is on the USML, ITAR governs it, and the default rule is that any export requires either a license or a documented exemption.

The word export is broader than shipping. Under ITAR, disclosing technical data to a foreign person is an export even when nobody crosses a border. This deemed export rule means a green-card-less foreign national engineer viewing a controlled drawing in your PLM system, a contractor in Bangalore querying your ERP for controlled part specifications, or a cloud administrator in another country with root access to a server holding technical data can each constitute an unlicensed export. Nationality of the person, not location of the data, drives the analysis.

Technical data is the category that surprises manufacturers. It includes blueprints, drawings, photographs, plans, instructions, and documentation required for the design, development, production, manufacture, assembly, operation, repair, testing, maintenance, or modification of defense articles. In an ERP context that reaches routings, work instructions, tooling specifications, inspection methods, and engineering change documentation - not just the CAD model. Marketing brochures and information already published and in the public domain generally fall outside the definition.

ITAR includes an encryption provision that has reshaped cloud and AI strategy in the defense base. Technical data that is secured end to end with sufficiently strong cryptography, where the keys are not provided to a foreign person or a foreign cloud provider, and which is not stored in Russia, China, or an arms-embargoed country, is generally not treated as an export merely because it transits or rests on foreign infrastructure. This carve-out enables compliant cloud use but does not cover plaintext processing - the moment data must be decrypted for an application or a model to read it, the exposure question returns.

Enforcement is real and expensive. Anyone in the United States who manufactures, exports, or brokers defense articles must register with DDTC and pay an annual fee even if they never export. Civil penalties run to over a million dollars per violation, criminal penalties reach twenty years imprisonment, and debarment removes a company from the defense market entirely. Voluntary self-disclosure of violations is a strong mitigating factor and is the standard playbook when a compliance failure is discovered internally.