ABW has been the norm for many years in the tech industry, but it's growing in popularity outside of Silicon Valley as more companies adopt this office structure and work mentality. Of course the recent work-from-home trend caused by COVID-19 has slowed or halted ABW progress, but when employees begin coming back to work later this year or next, the ABW environment (or some version thereof) may be the new normal for some.
The export compliance officer should be aware of how to mitigate and protect against ABW risks. In this article I address such risks and measures that should be taken to sufficiently mitigate against export compliance violations in an ABW environment. Finally, since so many of us currently work from home, I’ll address how to prevent export compliance violations in the work-from-home environment.
First, a quick review for context: A deemed export encompasses the release of U.S.-controlled technology and information to a foreign national (a non-U.S. person). Depending on the classification of the technology and the nationality of the recipient, an export license or other authorization (e.g., license exception TSR) may be required. Companies dealing in U.S. export-controlled technologies may be required to restrict access to certain employees, contractors, interns, etc., in order to avoid an unauthorized deemed export. Deemed exports can occur via almost any means of communication or access, including but not limited to: telephone conversations, email and fax communications, sharing of computer data, briefings, meetings, training sessions and site tours.
Having an open and collaborative ABW environment is becoming increasingly important and common for many companies in the U.S. and abroad. However, in some cases, the deemed export rule demands that restrictions or conditions be placed on the ABW environment to comply with export control requirements that prevent unauthorized access to sensitive U.S. technology. This consideration is applicable within and outside U.S. borders, as the extraterritorial scope of U.S. export controls mean that deemed export rules apply anywhere in the world where U.S.-controlled technology is being openly developed or discussed.
To efficiently mitigate the risk of export compliance violations in an ABW environment, consider implementing specific guidance, such as the following:
In addition to the guidance above, authorized employees (U.S. persons or licensed foreign nationals) and unauthorized employees (unlicensed foreign nationals) should be trained and provided guidance such as the following:
The preceding represents just some of the potential guidance to consider implementing. A number of factors may create the opportunity for more lenient guidance or the need for stricter access controls. These include:
Finally, be prepared to receive pushback when attempting to implement physical access restrictions in an ABW environment. Work with management and internal stakeholders ahead of time to inform them of export compliance risks and to request their input and suggestions to develop guidance that adequately balances competing interests.
Due to COVID-19, many employees at your company may be working from home on a temporary or long-term basis. These employees are likely bound by non-disclosure agreements (NDAs) or related agreements and policies with respect to the protection of sensitive and/or proprietary information that they have access to with their jobs. As the export compliance officer for your company, you can use these established agreements and policies as a baseline: Many of the recommended or mandatory behaviors in such agreements and policies overlap with best practices in the protection of export-controlled information. If agreements and policies don’t already exist, join forces with relevant internal stakeholders (IT security, legal, etc.) to draft and implement them. A few best-practices might include the following: