ITAR and Export Control Software Problems: The 7 That Create Violations, and How to Avoid Them

Why does the enforce everywhere first release collapse?

Export control projects attract total scope for an understandable reason: partial control feels like no control. So release one is scoped to enforce across the engineering vault, the file shares, email, source repositories, the enterprise resource planning (ERP) system and the shop floor viewer at once. Each of those has a different permission model, a different owner in information technology, and a different appetite for being changed. Eighteen months later, two are integrated and the programme has lost its budget.

What makes this specific to a defence manufacturer is that the enforcement points are owned by people whose objectives are not compliance. The engineering systems team measures itself on engineer productivity. Restricting access by nationality is friction they did not ask for. Every integration is therefore a negotiation as much as a build, and negotiations do not parallelise.

The sequence that works starts with the two things everything else depends on: a classification workspace tied to your part master, and a person register fed from human resources carrying nationality, status and the authorisations each individual is named on. Those two deliver value on their own, because for the first time you can produce a list of what is controlled and who may see it. Enforcement then follows one system at a time, highest exposure first, with each integration scoped and negotiated on its own terms.

What goes wrong when you load classifications and the part master?

Classification history lives in email. The same part has been classified twice by two people two years apart, sometimes differently, usually without the reasoning recorded. The instinct is to harvest those decisions into the new system so the backlog starts smaller. That is precisely the mistake, because a determination without its reasoning, its citation and its approver is not a determination, it is an assertion. Loading it makes the system authoritative about something it cannot defend.

The specific failure surfaces in an audit or during acquisition due diligence. Someone asks on what basis a part was classified as United States Munitions List Category VIII and the record shows a category with a migration timestamp and no approver. That reads worse than an unclassified backlog, because it implies a control that was never exercised.

The part master brings its own problems. Revisions that should inherit a classification are recorded as separate parts. Assemblies reference obsolete children. Supplier parts sit in a different numbering scheme entirely. Loading that untouched means bill of materials rollups, which are the feature people ask for constantly, return answers nobody trusts.

Handle both by loading structure and not conclusions. Bring in the part master, the revision relationships and the bill of materials, and bring historic classifications in as unapproved proposals requiring review rather than as determinations. Where a model proposes a category from part descriptions, drawing notes and specification references, it produces a review item with the relevant regulation text alongside, never a record. The Empowered Official or a trained analyst approves, or nothing is classified.

Why do the PLM and HR integrations break after launch?

Product lifecycle management is the harder of the two and it breaks structurally rather than intermittently. Windchill, Teamcenter and 3DEXPERIENCE each have their own permission model, and none was designed for nationality based access. Driving group membership from classification and nationality works until an engineer creates a new context, a workspace or a folder that inherits permissions from somewhere your rules do not reach. Nothing errors. A controlled document simply sits somewhere the enforcement logic does not see.

The fix is to audit rather than assume. Reconcile, on a schedule, the set of locations holding controlled technical data against the set of locations your enforcement covers, and raise any difference as an exception with a named owner. That report is more valuable than any dashboard, because it measures the gap rather than the coverage.

Human resources breaks on timing and on data quality. A contractor's status changes and the feed carries it days later, which is days of access that should have ended. Nationality and immigration status are often held in free text or in a field maintained for a different purpose, and dual nationality is frequently not modelled at all. Both need to be specified explicitly during discovery, because a person register built on a field that means something slightly different from what you assumed is the quietest possible failure in this entire category.

What happens when deemed exports and drawdown are not properly covered?

Two gaps produce actual violations rather than inefficiency. The first is the deemed export. Under the International Traffic in Arms Regulations, releasing controlled technical data to a foreign person is treated as an export to that person's country even inside your own facility in the United States. There is no shipment and no border. Preventing it requires three facts joined at the moment of access: what the data is classified as, who the person is in terms of citizenship and status, and whether an authorisation covers that release. Trade compliance owns the first, human resources the second, information technology the third, and almost nowhere are they joined.

The second is licence and agreement drawdown. A DSP-5 authorises specific articles or technical data, to specific parties, up to a value, until an expiry. A Technical Assistance Agreement names parties and sublicensees and scopes what may be discussed. Tracking consumption in a spreadsheet updated after the fact from shipping records works until you hold thirty active authorisations and a sales engineer promises a customer a design review next week. Exceeding the value or releasing to a party outside the agreement is a violation even though you hold the authorisation.

Fix both structurally. Authorisations become records with articles, parties, value, provisos and expiry, and every controlled transaction consumes against them at the moment it occurs, with provisos as checklists that must be satisfied rather than paragraphs somebody skimmed. Where genuine enforcement is impossible, say so explicitly and implement detection with alerting inside minutes. A partner who tells you which cases are detection rather than prevention is more useful than one who promises prevention everywhere.

Should you build custom or configure what you already own?

Buy if your exports are occasional and mostly EAR99, you employ no foreign persons in engineering, and your real need is restricted party screening. Descartes Visual Compliance is genuinely strong at screening and will do that for a fraction of a build. Buy SAP Global Trade Services if you are a large SAP shop whose primary volume is customs and export declarations rather than engineering data access, because reproducing customs content is not a sensible use of a development budget. OCR Services EASE handles licence management competently and may be enough on its own if drawdown is your only real gap.

None of them sits inside Windchill, Teamcenter, your file shares or your source repositories deciding whether a specific person may open a specific file, because that is not what they were designed to be. If your exposure is engineering data access rather than shipment paperwork, that is the gap you are buying a build to close, and it is the only good reason to build here.

Build when two or more of these are true: you hold controlled technical data and employ foreign persons anywhere in the organisation; you cannot produce today a report of who accessed a given controlled drawing in the last year; your classification decisions live in email; you track drawdown in a spreadsheet after the fact; or you have filed a voluntary disclosure and committed to remediation.

How do hidden costs get into the quote?

Compliant hosting is a real line item rather than a rounding error, and it is regularly missing from first numbers. If your contracts bring Cybersecurity Maturity Model Certification obligations and NIST SP 800-171 controls for controlled unclassified information, the hosting environment, access model and logging must be designed for that from the first sprint. Retrofitting an environment boundary is close to rebuilding the system.

Second, the number of enforcement points, which is the multiplier people underestimate most. Engineering vault, file shares, email, source control, the enterprise system and the shop floor viewer are six integrations, not one, and each carries its own negotiation with a system owner.

Third, false positive management in screening. A rescreening engine that produces hundreds of hits a day gets ignored, and an ignored control is worse than none. The engineering that matters is the hit disposition queue and the tuning, not the matching. Ask specifically what is included per enforcement point and what the hosting assumption is, in writing, before contract.

What separates a build that works from one that fails here?

Ask in the first meeting how they will keep controlled technical data away from their own team. If there is no immediate answer involving synthetic development data, a production boundary restricted to United States persons and brokered, logged support access, end the conversation. A development team that can see production technical data is itself a source of deemed exports, and it is a common way for this to go wrong because everyone is focused on the engineers and nobody thinks about the contractors building the tool.

Ask them to model the objects. Classification determination, authorisation, party, person with nationality and status, controlled transaction and access event should be distinct, and the audit log should be append only by design. A proposal built around a permissions matrix and a document library is a file sharing product.

The builds that work are honest about the boundary between prevention and detection, they put classification and the person register first because everything else depends on them, and they treat every enforcement point as its own negotiated piece of work. The builds that fail promise complete coverage, integrate the two easiest systems, and produce a compliance dashboard that is green while the drawings sit unprotected in a folder nobody mapped.