International Travel

In general, the majority of exchanges among researchers can go forward without the requirement of an export license, where the sole purpose of the meeting is to present research findings that have been or are intended to be published, provided they do not concern detailed information regarding controlled items or technologies (information and items subject to Export Controls). As you plan your trip, verify with Research Integrity and Compliance (RIC) that your technology or information falls into one or more of the following categories prior to traveling:

• Research that is categorized as “fundamental”
• Published information
• Publicly available software
• Educational information
• Patent applications

In addition, RIC is available to perform a restricted party screening for entities and individuals with whom you will be doing business. Contact the Director of RIC, Sean Rubino, at (512) 245-2314 or the Travel Office for additional information.

Conferences

When planning a trip abroad, travelers should familiarize themselves with export controls and embargoes. You must ensure that any information that you will discuss or any items that you will take with you are either not controlled, or if controlled, proper licenses are in place. Because you and the University can be held liable for improperly transferring controlled items or technology, it is important that you review the federal requirements. Most travel for conferences will fall under an exclusion or exemption to the export control regulations: Information that is published and is generally accessible to the interested public through publication in books or periodicals available in a public library or in bookstores, or information that is presented at a conference, meeting, seminar, trade show or other open gathering is considered to be in the public domain. An open gathering is one in which members of the general public are eligible to attend and attendees are permitted to take notes.

Sanctioned Countries

The Department of the Treasury, through its Office of Foreign Assets Control, administers economic and trade sanctions that at times can restrict transactions and travel, or require licensing in order to travel to a foreign country, or to conduct business with a foreign entity or individual. Before considering travel to embargoed countries to conduct research or educational activities, check first with RIC. A determination will be made by RIC as to whether a license and/or permission is required. Some countries can require a specific license that may take several weeks to obtain. For the most current list of restricted countries please consult the OFAC's Sanctions Program and Country Summaries website.

Laptops, tablets, cell phones, data storage devices, and encrypted software

When you travel outside of the United States, your university provided laptop computer, cell phone, data storage devices and encrypted software may require an export license or other government approval to be taken with you to many countries outside of the United States. The University is required to document the export (even a temporary export) of these items to certain countries if they are owned by the University. The personal computer you take abroad may contain strong encrypted software that requires a government license or other government approval for export to many countries. For example, the newest versions of several Microsoft programs possess strong encrypted software and is subject to export restrictions. Devices that have downloaded these Microsoft programs can be temporarily taken overseas, but to a large number of destinations they can only be taken under an export license exception.

Because encryption products may be used for illegal purposes, the United States and many other countries may ban or severely regulate the import, export, and use of encryption products. By taking your encrypted laptop to certain countries without prior authorization, you could be violating U.S. export law or the import regulations of the country to which you are traveling, which may result in confiscation of your laptop, in fines, or in other penalties.

Over the past fifteen years, a group of nations negotiated a set of rules attempting to facilitate traveling with encryption software known as the "Wassenaar Arrangement." One of its provisions allows a traveler to freely enter a participating country with an encrypted device under a "personal use exemption" as long as the traveler does not create, enhance, share, sell or otherwise distribute the encryption technology while visiting.

The countries that support the personal use exemption include

Argentina, Australia, Austria, Belgium, Bulgaria, Canada, Croatia, Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Ireland, Italy, Japan, Latvia, Lithuania, Luxembourg, Malta, Netherlands, New Zealand, Norway, Poland, Portugal, Republic of Korea, Romania, Russia*, Slovakia, Slovenia, South Africa, Spain, Sweden, Switzerland, Turkey, Ukraine*, United Kingdom and the United States.

*Although the Russian Federation and the Ukraine agreed to many of the Wassenaar Arrangement's provisions, they currently do not permit personal use exemptions.

University supported travel to destinations not covered by the Wassenaar Arrangement, may fall under the "Tools of Trade" (TMP) license exception when the laptop, tablet, cell phone, data storage devices are:

• Hand carried with you while you travel,
• Carried in your luggage or baggage that travels with you, or
• Shipped no more than 30 days prior to your departure, or may be shipped to you at any time while you are outside the country

Generally, so long as you (1) retain your laptop computer, PDA, cell phone, data storage devices and encrypted software under your personal custody and effective control for the duration of your travel; (2) do not intend to keep these items in these countries for longer than 1 year; and (3) you are not traveling to Iran, North Korea, Sudan or Syria, no government export license is required. Note that this license exception is not available for equipment, components, or software designed for use in/by/with most satellites or spacecraft. "Effective control" means retaining physical possession of an item or maintaining it in a secure environment.

Data Protection

When leaving or entering the United States electronic devices may be subject to search without reasonable suspicion, and although there is some current case law to suggest that the Department of Homeland Security must demonstrate reasonable suspicion in some cases before ordering travelers to disclose their passwords or encryption keys, it remains a risk. Likewise, some other countries have laws allowing seizure and search of electronic devices, including coerced disclosure of passwords or encryption keys. Even where electronics are not seized and searched pursuant to law there remains a substantial risk that the contents of those devices may still be compromised. For example, see this article about cyber-espionage in China.

University employees should take appropriate measures to safeguard sensitive data, including but not limited to:

• Not taking any sensitive data that is not absolutely necessary. This may mean taking an alternate “clean” computer that has never held sensitive information.
• Backing up all sensitive data before traveling and encrypting files and requiring a password for access.

When taking an international trip, it is important to consider (1) the materials and information you are taking with you; (2) your destination country; (3) those you may be collaborating with; and (4) the purpose of any collaboration.

Other University Equipment

Some equipment (e.g., global positioning systems [GPS], thermal imaging cameras, inertial measurement units and specialty software), are highly restricted and may require an export license to take with you, even if you hand carry it. If you are taking university equipment other than your laptop computer, PDA, cell phone, data storage devices contact RIC to determine if an export license or other government approval is required prior to your taking the equipment out of the country.

Export License Exception for Temporary Exports (TMP)

Texas State employees commonly carry Texas State-owned, commercially available electronic devices such as laptops, PDAs, iPads, cell phones, thumb drives, and other digital storage devices with them on international travel. These items often come with pre-loaded encryption software which is subject to the Department of Commerce, Export Control Regulations (EAR). Many of these items can be temporarily exported under the EAR license exception “Temporary Exports-Tools of the Trade” (TMP).

The TMP License Exception provides that when Texas State-owned laptops, PDAs and other digital storage devices (and related technology and software) are being used for professional purposes, returned within 12 months, kept under effective control of the exporter while abroad and other security precautions are taken against unauthorized release of technology, then the TMP License Exception generally applies as long as the criteria to which you are certifying below are met.

NOTE: The exception does not apply to any EAR-satellite or space-related equipment, components, or software, or to any technology associated with high-level encryption products. In addition, this exception does not apply to items, technology, data or software regulated by the Department of State’s International Traffic in Arms Regulations.

This form needs to be signed by Sean Rubino, the Director of Research Integrity and Compliance prior to shipping or hand-carrying the item(s) or software overseas. If you have any questions about this, please email him at: srubino@txstate.edu.

Download TMP Form

Airline Electronics Ban: What Texas State Travelers Need to Know

The U.S. government has recently required several airlines to stop passengers from bringing most types of electronic devices (not including smartphones) into the cabin for U.S.-bound flights. Instead, those devices must now be carried in the hold.

Which countries are involved?

The ban covers U.S. bound flights from the following countries:

• Egypt
• United Arab Emirates
• Turkey
• Qatar
• Jordan
• Morocco
• Saudi Arabia

Which airlines are affected?

The following airlines fly directly to the U.S. from the affected countries:

• Egyptair
• Emirates Airline
• Etihad Airways
• Kuwait Airways
• Qatar Airways
• Royal Air Maroc
• Royal Jordanian
• Saudia
• Turkish Airlines

Which devices are banned?

Smartphones will still be allowed in the cabin. But any electronic devices bigger than that will have to be checked in, either with your luggage or at the gate. That includes laptops, cameras, gaming devices and tablets such as iPads.

Medical devices (and cameras on U.K.-bound flights) will still be allowed in the cabin after security screening.

What happens at the airport?

If you’re flying from the regions to the U.S., the best advice is to arrive earlier than normal. Expect to be asked to check in tablets, laptops, and other banned devices with your luggage.

What’s the reason for the ban?

U.S. officials say the move is a response to fears that terrorist groups may target passenger planes by smuggling explosive devices in electronic devices. One official said there's no specific plot authorities are aware of, but the U.S. has been considering such a ban for some time.

How can I protect my devices?

Electronic devices that are checked in can be damaged, lost, even hacked. Before your check anything in, consider the risks and take steps to protect your devices and data.

Many airlines specifically say they will not be held liable if these items break or are lost. They warn against packing valuable or breakable items like computers in checked baggage.

The best way to keep your data from falling into the wrong hands is not to check a computer at all.

If you have to bring a device, do a full back-up before leaving for the airport. Experts recommend shutting the computer down completely, not just putting it into a sleep mode.

A more secure option is to wipe a laptop or tablet clean before traveling. That can be difficult so you may want to consider switching to a "burner" laptop — an inexpensive device that doesn't have sensitive information on it.

Warning About Travel to China and Russia

Recently, there has been an increased concern about cyber security of American higher education travelers to China and Russia. U.S. travelers are believed to be priority targets for cyber-attack and monitoring/surveillance, particularly if they are known to be engaged in proprietary or controlled research in a STEM (science, technology, engineering and mathematics) discipline. Institutional leaders, those who are politically or religiously active, fluent speakers of the local language and individual tourists may also be actively targeted, however all Texas State travelers should assume that they are potentially at risk if traveling to China or Russia. Electronic devices may also be at risk of physical tampering or theft, particularly if those devices are left unattended (including devices left locked in a hotel room or even left locked in a hotel safe while dining, shopping or touring). On the other hand, carrying one’s laptop or other electronic devices continually may increase their risk of being accidentally lost or forgotten, or stolen by a thief/pick pocket. On balance, however, we recommend you keep your devices with you at all times.

Devices taken to China and Russia (as well as many other international destinations) may be subject to involuntary official governmental review and even complete duplication (e.g., in some countries, Customs officers may temporarily seize your device, and potentially keep a copy of one’s entire system on entry or exit).

Access to some web sites, including access to some mainstream popular western social media web sites, may be technically blocked. Secure (“https”) web sites and use of institutional virtual private networks (“VPNs”) may also be blocked by some countries, because it is more difficult for national authorities to monitor that encrypted traffic. Attempts to circumvent national censorship (e.g., with Tor, Ultrasurf or similar products) may be blocked and/or punished if noticed.