The International Traffic in Arms Regulations (ITAR) is a set of U.S. government regulations that control the export and import of defense-related articles, services, and technical data on the United States Munitions List (USML). Administered by the Directorate of Defense Trade Controls (DDTC) within the U.S. Department of State, ITAR implements the Arms Export Control Act (AECA). The regulations restrict sharing defense articles and technical data with foreign persons, both overseas and within the United States, without prior authorization. ITAR applies to manufacturers, exporters, brokers, and any entity involved in the defense trade, including contractors and subcontractors in the defense industrial base.
Organizations dealing in ITAR-controlled items must register with DDTC and obtain licenses or other authorizations before exporting defense articles or sharing technical data with foreign persons. The USML categorizes defense articles into 21 categories ranging from firearms and ammunition to military electronics and spacecraft. 'Technical data' includes blueprints, design documents, software source code, and manufacturing know-how related to USML items. A 'deemed export' occurs when technical data is shared with a foreign person within the United States, also requiring authorization. Organizations must implement access controls to prevent unauthorized access, maintain records of all transfers, screen parties against denied persons lists, and establish Technology Control Plans for facilities where foreign nationals may be present. ITAR has no de minimis threshold unlike EAR.
ITAR violations carry severe penalties: civil fines up to $500,000 per violation and criminal penalties up to $1 million and 10 years imprisonment. Companies have been fined hundreds of millions of dollars for ITAR violations. For cybersecurity teams, ITAR means implementing strict access controls based on citizenship, encrypting ITAR-controlled data, ensuring cloud infrastructure is ITAR-compliant (U.S.-person-only access), and maintaining comprehensive audit trails. Non-compliance can result in debarment from government contracting.