The Deemed Export Trap: How a Single Lab Conversation Can Trigger a Federal National Security Investigation

A whiteboard sketch shown to a postdoc from the wrong country can carry the same legal weight as loading controlled hardware onto a plane. No cargo moves. No border is crossed. And yet, under U.S. export law, the release of controlled technology to a foreign national inside a U.S. lab counts as an export to that person’s home country.

That’s the deemed export rule. One unguarded conversation in a research group, a shared drive folder, or a job interview can seed a federal national security investigation months later. The rule itself is decades old. What’s changed is the appetite to enforce it, and the number of ordinary academic and industry moments that now fall inside its reach.

Deciding Whether Your Work Is Even Covered

Honest classification comes first. Most researchers assume export controls apply to weapons systems and obvious hardware. The reach is wider. Semiconductor design tools, certain encryption, advanced materials, biotech, aerospace software, and specific manufacturing know-how all sit on control lists, and the technology behind them travels with the conversation, not just the product.

Two anchors help you make the call:

• Fundamental research exclusion. Basic and applied research at accredited institutions, intended for publication without restriction, generally sits outside the EAR’s deemed export reach. The National Academies overview walks through how NSDD-189 and the exclusion interact with the regulations. The exclusion is real, but narrower than most PIs think.
• Publication restrictions. The moment a sponsor asks for pre-publication review, bars foreign nationals from a task, or embeds proprietary specs the university cannot publish, the exclusion starts to leak. Work that looked open can become controlled technology by contract.

If you can’t cleanly say which side of the line your project sits on, you have a compliance question, not a settled answer.

Choosing Between a License and a Workaround

Once you accept that a project touches controlled technology, the decision is structural. Apply for a deemed export license from BIS, restructure the work so the foreign national never accesses the controlled piece, or decline the collaboration. Each path has real costs.

Licenses take months, require detailed technology control plans, and put the government inside the room on scope changes. Restructuring is faster, but it creates a two-tier lab, which is awkward at best and, done poorly, invites discrimination claims. Declining the work is clean, but it sacrifices talent and grants.

The wrong move is the fourth option nobody admits to picking: proceeding as if the rule doesn’t apply and hoping the collaboration stays quiet. That’s the choice that shows up later as a subpoena.

Deciding What Counts as a “Release”

The statute doesn’t require a file transfer. Release covers demonstration, oral briefing, visual inspection, shared drive access, code review, and yes, a whiteboard walkthrough. If a foreign national can see, hear, or read the controlled technology, the release has occurred, whether or not anything was saved or copied.

A few implications most labs underestimate:

• Casual conversations. Hallway explanations of a controlled process to a visiting scholar count. So does an answer at a poster session that goes beyond what’s already published.
• Shared infrastructure. Group drives, GitHub repos, and lab wikis with mixed access are the single most common failure point. Access is release, even if nothing is opened.
• Recruiting and interviews. Technical interviews with foreign candidates can release controlled know-how before a hire is ever made. Compliance has to sit inside HR, not next to it.

Deciding When to Bring in Counsel

Compliance offices are useful, but they’re not your lawyer. Their duty runs to the institution. Once an investigator calls, an internal review turns adversarial, or a grant disclosure question surfaces that touches a foreign affiliation, retaining independent counsel stops being optional.

Timing matters more than most researchers expect. Waiting until charges are filed forfeits the two most valuable windows: the voluntary self-disclosure period, which can reduce penalties meaningfully, and the pre-indictment stretch when a national security defense team can shape the government’s understanding of intent before it hardens. Prosecutors build a story from the documents they see first. If your account isn’t in that stack, someone else’s version becomes the default.

One more point on scope. Deemed export cases rarely arrive labeled as export cases. They come dressed as grant fraud, false statements on disclosure forms, wire fraud on federal funding, or visa questions. If any of those knock, assume export exposure is on the table and staff the defense accordingly.

Deciding How Much Paper to Keep

The instinct after a scare is to purge. That instinct is wrong, and in a federal investigation it’s dangerous. What you want, well before any letter arrives, is a defensible record of who had access to what, when the technology control plan was written, which conversations were flagged, and which were cleared. Contemporaneous notes beat reconstructed memory every time.

Keep the training logs. Keep the classification determinations, including the ones that concluded a project was outside the rule. Keep the emails where you asked the question. A file that shows you took the rule seriously is the single strongest asset a lawyer has when the government’s theory is that you didn’t.