Guidance

Exporting military or dual-use technology: definitions and scope

Updated 22 March 2021

This advice sets out:

• how we define technology
• the scope of the regulations around transferring military or dual-use technology

In this guidance we refer to the tangible or intangible export or transfer of technology as a transfer.

The Export Control Act 2002 included the power to control the transfer of technology by any means. This came into force on 1 May 2004.

Who export controls apply to

UK export controls:

• apply to anyone or any entity in the UK and, in limited circumstances, to UK persons overseas
• are not based on nationality of an individual, except where they apply to UK persons overseas
• are based on a concept of exports or transfers to a person or destination overseas, including access to controlled technology by persons located overseas

See the export controls guidance for:

• dual-use items, software and technology, goods for torture and radioactive sources
• export controls: military goods, software and technology

Basis of export controls on technology

Export controls for technology aim to prevent transfers that can lead to developing or producing weapons or goods which:

• could be used against the UK and allied forces
• cause national security concerns

The controls aim to do this without inhibiting:

• legitimate trade
• knowledge acquisition

Any transfer, permanent or temporary, of controlled technology overseas requires an export licence. This applies to a variety of circumstances. It includes for the purposes of demonstration, bidding or tendering for an overseas contract through to contract fulfilment and training material for maintenance and servicing.

The location of the exporter is the country from which they are transferring controlled technology, or the location of a person who makes available controlled technology being accessed from overseas. The destination of transfers of technology is dependent upon the location of the intended recipient. For export control, the routing or storage of the controlled technology does not determine the destination.

All foreign or UK persons based in the UK need a licence if they wish to transfer controlled technology overseas which they have created or acquired in the UK, or brought in to the UK from overseas. This is irrespective of the origin of the technology, for example US origin.

Export licences are not required to transfer controlled technology in the following instances, regardless of nationality of the recipient:

• transfers within the UK unless the technology is for weapons of mass destruction (WMD) end-use outside the UK.
• transfers of dual-use technology from Northern Ireland to the EU unless the technology is listed in Annex IV of Council Regulation (EC) No. 428/2009 or is for WMD end-use outside the EU
• transfers taking place from outside the UK by a UK person located outside the UK unless the technology is for WMD end-use

Additionally, export licences are required for provision of technical assistance for WMD end-use in the following instances:

• by a person in Great Britain to a person/place outside the UK
• by a person in Northern Ireland to a person/place outside the EU

UK persons located overseas will also be governed by the export controls within the country they are located.

See guidance on transfer of technology for a WMD purpose.

Technology: definition and scope

Within export control legislation ‘technology’ is a defined term. Quotation marks denote this and other defined terms in the export control lists. You can find complete list of defined terms in the UK strategic export control lists.

See the most common definitions in relation to technology.

Most technology controls apply to information that is necessary for the development, production or use of controlled goods. Some technology controls apply to specific information as described in the lists. This information may take many forms, including:

• blueprints
• plans
• diagrams
• models
• formulae
• tables
• engineering designs and specifications
• manuals and instructions

Certain technology may also be subject to end-use controls if it is in relation to:

• WMD
• certain arms embargoes
• unauthorised military exports

In the case of technology related to WMD, here the definition of technology is very broad.

In certain cases a transfer of technology is exempt from licensing. For example where it relates to the use of goods for a which a licence was previously granted. The scope of control is further limited by a general technology note and nuclear technology note in the (retained) EU Dual-Use Regulation.

Technology controls related to nuclear goods have a broader scope as the term ‘required’ does not apply. The minimum necessary information for patent applications remains controlled.

Technology transfer: scope

The tangible transfer of technology can be in many forms. This includes information either written on physical documents or recorded on other media, such as:

• USB flash drives
• portable hard drives
• laptops
• tablets

Technology can also be transferred in an intangible form by using electronic media, such as email.

Export licences are required irrespective whether or not the controlled technology is transferred in an encrypted form.

Transfer by phone or video-conferencing

Export controls apply where the technology is contained in a document and transmitted by audio or video-conferencing means.

This applies when the relevant part of that document is:

• read out
• described in such a way as to achieve substantially the same result as if it had been read out

A licence is also required where presentations display controlled technology and are viewed by overseas audiences. This may include screensharing to individuals or a wider audience.

Prior to any call, conference or presentation you should establish whether or not controlled technology will be divulged by any participant. If so, the location of each intended recipient (at the time of the call) will need to be known to ensure the appropriate licence can be used and records maintained of the transfer.

Licences will also be required where recordings of presentations containing controlled technology are viewed by overseas audiences.

Other overseas based colleagues will also need to determine if the call or conference material would be subject to their local export or re-export control requirements.

Transfer by email

Emails containing controlled technology, either in the body of the message or as an attachment, require an export licence based on the transfer to the known location of the overseas intended recipient. This means you have a responsibility to find out where someone is in the world before sending an email containing controlled information.

Sending overseas any images of controlled technology contained in documents or papers would require a licence.

Companies using automatic forwarding to addresses overseas should consider mechanisms to prevent inadvertent transfers of controlled technology.

Examples include where an email:

• is diverted to a colleague overseas in the absence of the intended recipient
• containing an attachment of controlled technology is diverted for manual malware checking as a result of virus scanning

You must take appropriate actions to ensure the information in an email is suitably protected. This guards against unintended access to technology should it be redirected overseas.

Transfer using laptops, phones and memory devices

If a laptop, phone or a memory device with stored controlled technology is taken overseas by any individuals this is a transfer and a licence will be required.

This also applies to visitors from overseas importing or downloading export controlled material in to the UK and subsequently travelling overseas with devices containing the controlled technology. Visitors may need someone else to apply for a licence on their behalf.

Transfers within multinational companies

Multinational companies that share common IT systems must obtain an export licence to transfer technology to the intended recipients in their overseas offices or subsidiaries.

Employees travelling between UK and overseas offices with controlled technology stored on company or personal devices will require an export licence.

Cloud storage and routing

Technology can be stored on servers and downloaded or accessed remotely. This is often referred to as cloud storage. This infrastructure may:

• be private, public or hybrid
• include common and shared data environments
• be located in the UK or abroad
• be supplied by companies as a service

For the purposes of UK export controls the location of the exporter and the intended recipient determines the routing of the transfer of technology, not the location of the servers containing the controlled technology.

Accessing or downloading controlled technology overseas

Uploading controlled technology to cloud-based storage is not considered a licensable transfer if it is subsequently downloaded or accessed only by persons located in the UK. In the case of controlled dual-use technology being uploaded in Northern Ireland no export licence is required if it is subsequently downloaded or accessed only by persons located in Northern Ireland or the EU^{[footnote 1]}. This applies irrespective of the location of the IT hardware where the controlled technology is stored or countries it may be routed through in the course of its transfer.

Controlled technology uploaded by persons in the UK to a server in the UK, or sent electronically to overseas file storage, and consequently downloaded or accessed overseas by an intended recipient (including UK persons), is a transfer and a licence will be required. The destination of the transfer will be the location of the intended recipients.

If controlled technology is uploaded to a UK or overseas server and any subsequent access to it is controlled by a person outside the UK, then an export licence will be required as a transfer of technology to the location of that person.

When uploading controlled technology to or through the cloud, appropriate actions should be taken to ensure the information is suitably protected. This guards against unintended access to technology. For example by third parties or administrators maintaining cloud services.

Safeguards include using:

• industry standard methods of end-to-end encryption
• identity and access management

See the National Cyber Security Centre’s cloud security guidance for information on the secure use of cloud services.

When downloading controlled technology overseas local export controls may require you to obtain an authorisation for transfers back to the UK or to another country. If this is not possible best practice would dictate that the controlled technology is removed from any devices, to ensure that you do not transfer it illegally.

The storage and subsequent transfer of controlled technology that has been uploaded from overseas to a UK-based server is not a licensable transfer from the UK.

Employee access to a company intranet when overseas

If an employee of a UK based company accesses controlled technology belonging to their company while overseas, while on business or otherwise, then this is an electronic transfer of that technology to the country in which the individual is located. A licence would be required for any such transfer, even if the UK employee abroad had no intention of passing the technology on to another person abroad.

This corresponds to the position for physical transfers, where taking controlled technology overseas, even if only for personal use and not for onward transmission while abroad, requires an export licence.

Third party access overseas to intranets or cloud services

Established suppliers, customers or collaborators may access controlled technology on a company or organisation’s intranet or cloud services. The company or organisation’s intranet or type of cloud service makes no difference in terms of licensing arrangements. What matters is the geographical location of the entities who access the stored controlled technology.

A licence must be obtained before controlled technology is accessed. If it is going to be fully accessible to members of a company, group, or dedicated collaborative user-group situated overseas as soon as it is saved to the site, then a licence is needed before this occurs.

If individual permissions are required for employees or other approved users overseas before they can access controlled technology on the site, then it would be advisable to obtain a licence before that permission was given.

Third party help desk and administration services

A third-party supplier may manage customer and supplier access to your technology which is stored within a cloud environment. In this case you must understand how the third party manages your controlled technology in all circumstances, including:

• supplier and customer access
• where the third-party staff are located
• what services the help desk or administrators offer, such as remote access to desktops and laptops

Your contract with a third party should include terms that define the export control responsibilities and accountabilities of all parties.

Responsibility for compliance with export controls lies exclusively with the owner of the technology, not with the service provider. If the owner delegates to the service provider the power to grant access to controlled technology to a person located overseas, the owner still has responsibility for how this is exercised. If staff of the service provider located overseas will intentionally have access to controlled technology, an export licence will be required.

You will need to know the details of the overseas customers, suppliers and any subcontractors who need to review your controlled technology in order to register or apply for appropriate licence coverage before access is granted.

An overseas helpdesk or other overseas third parties may remotely access your laptop, for example to assist with IT issues. In this case you should ensure no controlled technology is being displayed, unless there is an export licence in place.

IT system testing and maintenance

If it is likely that controlled technology will be accessed and reviewed by an overseas entity in the course of penetration testing, then an export licence will be required prior to penetration testing.

Overseas access to controlled technology during maintenance activities, in a manner that permits the recipient of the technology to review it, would constitute a transfer to the country where the access occurs and therefore a licence would be required.

Export controls exemptions

Controls on technology aim to prevent essential information becoming available to proliferators and procurers of either WMD or conventional weapons or goods that may cause national security concerns. The controls are not intended to interfere unduly with normal commercial or academic practices.

Technology exceptions in the Export Control Order 2008

The intention of technology exceptions in the Export Control Order 2008 is to remove any controls on technology that is:

• already in the public domain
• basic scientific research
• the minimum required for the installation, operation, maintenance or repair of non-military controlled items, whose export has been previously authorised
• the minimum required for patent applications

Information in the public domain and for basic scientific research

The controls on technology do not apply to:

• information that is in the public domain
• basic scientific research

For technology to be in the public domain it has to be freely available with no restriction other than copyright placed on its further dissemination, such as in a book, on a website, at an exhibition.

Information in the public domain may come in many forms including:

• general product information
• brochures
• photographs
• diagrams
• company presentations

Technology is not in the public domain:

• if it needs to be obtained from a supplier who controls the supply
• where access is restricted to certain persons, like membership of an institute or requiring passwords
• where it is subject to the Official Secrets Act, or MOD or government security classifications such as commercially confidential information
• if it has been placed in the public domain in contravention of a statutory prohibition, for example classified material, as it is unlikely to be available without further restriction upon its dissemination

The same relaxations apply to published technical papers if the content is in the public domain. However the intention to publish a paper containing controlled technology does not in itself place that information in the public domain. Any collaboration or sharing of controlled technology overseas, such as through a peer review before publication of a technical paper or the results of research and development, would require a licence.

An example might be a product brochure taken from a publicly available website that outlines the capabilities of a piece of military equipment and this could include technology for the use of military equipment. However since the brochure is clearly in the public domain, it is not controlled.

Copyright restrictions such that no copyrighted work may be copied, published, disseminated, displayed, performed, or played without permission of the copyright holder, except in accordance with fair use or licensed agreement, does not necessarily mean that technology is not in the public domain.

For commercial reasons, exporters are unlikely to place controlled technology onto freely available sites, for access by suppliers, customers or indeed competitors,.

As for information in the public domain, technology which is basic scientific research is not controlled. The exchange of research material between an academic based in the UK, for example, and another overseas would not be controlled if it were basic scientific research.

Examples of basic scientific research might include studies of the low temperature electrical resistance of metals to determine the properties of the underlying electronic structure of these materials or the electromagnetic properties of composite surfaces.

Technology required for the installation, operation, maintenance or repair of non-military controlled items

Article 18(1)(b)(i) of the Export Control Order 2008 decontrols technology that is the minimum required for activities in relation to goods or software that are not military goods or software or UK controlled dual-use goods or software. For example, an information notice describing the repair of the airframe of an Airbus A350 XWB could also be required to repair a military aircraft airframe, but as it is the minimum technology necessary for the repair of a non-military item it is not controlled.

Technology required for the installation, operation, maintenance or repair of controlled items

Unless the licence says otherwise, a UK licence to export goods or software also authorises the transfer of the minimum technology required for installation, operation, maintenance or repair of the goods or software to the same destination and end-use as the goods or software (Article 26(2) of the Export Control Order 2008).

There is no time limit between the authorisation to export the goods or software and the subsequent transfer of the minimum technology for the same goods or software at a later date.

General technology note (GTN) in the dual-use regulations

The intent of the GTN is to control only that portion of technology that is specific to the development, production or use of controlled items. Technology is not controlled if it is common to both controlled and non-controlled dual-use items.

Using an analogue to digital convertor having an extended temperature range of -55 to 125 degree celsius, as an example:

• if the technology used to produce the convertor with an extended temperature range is the same as that used to produce one with a reduced operating range then the technology would not be controlled.
• if the technology was unique to the convertor with an extended temperature range, it would be controlled
• if the controlled portion of this technology was subsequently applied to a non-controlled item, it would remain controlled.

The GTN also contains similar exemptions as cited in the Export Control Order 2008.

Nuclear technology note (NTN) in the dual-use regulations

This is similar to the GTN and brings into control all technology directly associated with nuclear goods controlled in Category 0 of Annex I to the EU Dual-Use Regulation. Unlike the GTN it does not release information for patent applications.

Crown immunity for controlled military technology

The Crown is not bound by the provisions of the Export Control Act 2002 for goods specified by Schedule 2 or 3 to the Export Control Order 2008 save in respect of goods specified in Schedule 3 for destinations specified as prohibited destinations in that Schedule.

Where the Crown owns the military technology to be transferred, or has similar rights over its disposal, then the exporter may, subject to the appropriate letter of Crown immunity from the government department that owns the technology, carry out the transfer without a licence.

See guidance on Crown exemption for controlled military list equipment and technology owned by the UK MOD.

Export licences

Some OGELs cover transfers of technology. Of particular relevance are:

• open general export licences for overseas access to software and technology for military goods (individual use only)
• open general export licences for technology for military goods
• open general export licences for technology for dual-use items

You can use the OGEL checker tool to identify if an appropriate OGEL exists to cover transfers of controlled technology. If your technology is controlled and you cannot identify a suitable OGEL then you must apply for one of the following:

• a standard individual export licence (SIEL)
• an open individual export licence (OIEL)

You must comply with the terms and conditions set out in each type of licence. If you use an open licence or a SIEL for technology transfer, you will be audited by the Export Control Joint Unit’s (ECJU) Compliance Team.

Compliance inspectors can also provide advice and information to companies. This helps companies comply with the conditions of OIELs and OGELs. It includes a spreadsheet containing all information asked for during compliance visits such as:

• a description of the technology being transferred, including the relevant control list classification
• the destination overseas and to what company or who the intended recipient was
• who within the company is conducting the transfers of technology
• dates these transfers are taking place or range of dates if applicable

When applying for an export licence you must consider how long the licence is valid for and requirements on quantity and value. SIELs and OIELs are usually valid for 2 years and 5 years respectively. If the licence is for a specific program or the combined total number of tangible and intangible transfers is likely to be very significant you must ensure:

• quantities will not run out
• values are not exceeded

UK companies must ensure that controlled technology is no longer accessed from overseas:

• beyond the date when a licence expires or is exhausted
• until the issue of a new licence

Case studies

Company A would like to have outer cases for a military radio manufactured in another country by Company B. To find out if the latter is able to produce the cases, Company A must send some drawings of the parts to be made. As the cases are specifically for the military radio, the production drawings constitute technology for the production of a military item. Therefore a licence is required.

Company C manufactures night vision sights for small arms. The products are sold worldwide and a request has been made for 200 user manuals to be sent to a foreign army. Company C has made and sold so many of the sights that the user manual can be obtained from their publicly-available web site. The foreign army is aware of this but want the manuals posted as hard copies. As a user manual for a military list item, the technology within the manual would constitute technology for the use of a controlled item, so normally an export licence would be required. However, as the user manual is available in the public domain it is released from control by Article 18 of the Export Control Order 2008. That the foreign army has asked for hard copy manuals makes no difference to the freedom to transfer without an export licence, as the public domain exception still applies.

Company D makes various controlled mass spectrometers and wants to send some marketing material to a trade fair in another country. The material highlights the typical products supplied and includes testimonials from satisfied customers. Although the company produces controlled items, the publicity material does not include specific information necessary for the development, production or use of the items. The marketing material is therefore not technology as defined and does not require an export licence.

An employee of Company E sends an email with attachments containing controlled technology to produce military aero-engine components to an overseas partner. The email is automatically routed via a third country. An export licence is only required for transfer to the country of final destination of the email where the intended recipient is located, even where a copy of it is cached (stored temporarily) on a server in the third country.

Company F stores cryptographic activation tokens on its servers in the UK that enables cryptographic functions in a variety of information security equipment. Company employees travelling overseas may access these tokens remotely via laptop or other mobile device. A licence would be required for every country from which such access will take place.

Company G decides for reasons of cost to locate its data servers in another country. Naval gun designs are uploaded from the UK to those servers. However, access to the designs are restricted so that only employees located in the UK are able to access or download the information. In this case no licence is required because all the intended recipients of the data will be in the UK.

Company H makes export controlled CAD software for development of active flight control systems available on its intranet as a service. Access to use the controlled software would not be subject to licensing. However, accessing or downloading the resultant data overseas may be subject to export licences if the data contains controlled technology.

A US employee of Company I is working temporarily in the UK and remotely downloads UK export-controlled technology, access to which is controlled by the US company. No UK export licence is required as in this case the transfer is from the US into the UK. The same US employee then returns to the US with the UK export-controlled technology that he has remotely downloaded and saved on his laptop hard drive. A UK export licence is required for the transfer of controlled technology from the UK to the US. In this example US export controls may also apply as the US employee has accessed US data from the UK.

A UK employee of Company J transfers controlled technology residing on a server in Iceland to the intended recipient in South Africa. The recipient’s server is located in Thailand. An export licence will be required to transfer the controlled technology from the UK to South Africa. The same licensing requirement applies if the exporter or the recipient is unaware of the location of either server.

Company J is a cloud service provider. Company K stores controlled technology on Company J servers located in the UK or elsewhere. Company K has protected the controlled technology stored in the cloud from unintended access, for example by using industry standard encryption, identity and access management or other safeguards.  To provide, support and maintain the cloud services, some Company J technical, administrative and maintenance personnel are located outside the UK. Company K may require Company J personnel to manage technical issues in Company K’s cloud environment. No export licence is required because Company J personnel are not the intended recipients of the controlled technology. 

A person in Great Britain uploads dual-use controlled technology to an Icelandic server and responsibility for the controlled technology falls on someone in Northern Ireland. The transfer of technology will be from Great Britain to Northern Ireland. The person in Northern Ireland who is responsible for the controlled technology then grants access to someone in Singapore. Here the export is Northern Ireland to Singapore even though the technology was originally uploaded by a person in Great Britain.

Definitions

This section lists the definitions most relevant to technology, as set out in:

• the Export Control Order 2008 (UK definitions)
• Retained Council Regulation (EC) No. 428/2009 (EU defintiions)
• Council Regulation (EC) No 428/2009 (EU definitions)

Technology (UK)

Technology means specific ‘information’ necessary for the development, production or use of goods or software.

where:

‘Information’ may take forms including, not limited to: blueprints, plans, diagrams, models, formulae, tables, ‘source code’, engineering designs and specifications, manuals and instructions written or recorded on other media or devices (for example disk, tape, read-only memories).

‘Source code’ (or source language) is a convenient expression of one or more processes which may be turned by a programming system into equipment executable form.

Technology (EU)

Technology means specific information necessary for the development, production or use of goods. This information takes the form of ‘technical data’ or ‘technical assistance’.

where:

‘Technical assistance’ may take forms such as instructions, skills, training, working knowledge and consulting services and may involve the transfer of ‘technical data’.

‘Technical data’ may take forms such as blueprints, plans, diagrams, models, formulae, tables, engineering designs and specifications, manuals and instructions written or recorded on other media or devices such as disk, tape, read-only memories.

Transfer (UK)

Transfer, in relation to software or technology, means transfer by electronic or non-electronic means (or any combination of electronic and non-electronic means) from a person or place within the United Kingdom to a person or place outside the United Kingdom, except in articles 10 and 11 where the limitations as to the origin and destination of the transfer do not apply, and cognate expressions shall be construed accordingly.

Transfer by electronic means (UK)

Transfer by electronic means, in relation to software or technology, means transmission by facsimile, telephone or other electronic media (except that oral transmission of technology by telephone is included only where the technology is contained in a document the relevant part of which is read out over the telephone, or is described over the telephone in such a way as to achieve substantially the same result as if it had been so read).

Transfer by non-electronic means (UK)

Transfer by non-electronic means, in relation to software or technology, means disclosure of technology by any means (or combination of means), including oral communication, other than as the exportation of goods or the transfer by electronic means.

Basic scientific research (EU) (UK)

Basic scientific research means experimental or theoretical work undertaken principally to acquire new knowledge of the fundamental principles of phenomena or observable facts and not primarily directed towards a specific practical aim or objective.

Development (UK)

Development means all stages prior to production (for example. design, design research, design analyses, design concepts, assembly and testing of prototypes, pilot production schemes, design data, process of transforming design data into goods or software, configuration design, integration design, layouts).

Development (EU)

Development is related to all phases prior to serial production, such as design, design research, design analyses, design concepts, assembly and testing of prototypes, pilot production schemes, design data, the process of transforming design data into a product, configuration design, integration design, and layouts.

In the public domain (UK)

In the public domain means available without restriction upon further dissemination (no account being taken of restrictions arising solely from copyright).

In the public domain (EU)

In the public domain, as it applies herein, means technology or software which has been made available without restrictions upon its further dissemination (copyright restrictions do not remove technology or software from being in the public domain).

Production (UK)

Production means all production stages (for example as product engineering, manufacture, integration, assembly (mounting), inspection, testing, quality assurance);

Production (EU)

Production means all production phases, such as construction, production engineering, manufacture, integration, assembly (mounting), inspection, testing and quality assurance.

Required (EU) (UK)

Required as applied to technology, it refers only to that portion of technology which is peculiarly responsible for achieving or extending the controlled performance levels, characteristics or functions. Such required technology may be shared by different goods.

Use (UK)

Use means operation, installation (for example on-site installation), maintenance, checking, repair, overhaul and refurbishing.

Use (EU)

Use means operation, installation (including on-site installation), maintenance (checking), repair, overhaul and refurbishing.

1. This does not apply to technology described in Annex IV of the EU Regulation. ↩