Technology Control Plan

Size: px

Start display at page:

Download "Technology Control Plan"

Lesley Chase
5 years ago
Views:

Part I: Project Supervisor and Project Information Project Supervisor: Technology Control Plan Office Phone: Location Facility(Building): Title of project: Projected start date: Email: Room:

1 Part I: Project Supervisor and Project Information Project Supervisor: Technology Control Plan Office Phone: Location Facility(Building): Title of project: Projected start date: Room: Projected finish date: Please attach the research proposal to this form Is this research to be conducted under an agreement or contract? - If so please state name of contractor or contract/agreement number. TRADE CONTROL ACTIVITY TANGIBLE EXPORTS : Tangible items are physical exports sent overseas by ship, aircraft, post, courier or as checked in or hand held luggage. It includes software and technology, such as diagrams and notes, that are sent overseas in a medium such as CD,DVD,USB, computer hard drive or on paper. Will any goods or technology be exported? Yes If yes please complete consignee section SUPPLY ACTIVITY INTANGIBLE "Supply" : Intangible is supplying controlled information via electronic means or otherwise providing access to stored or online controlled information. Methods of Supplying technology can include, but is not limited to: /Fax Electronic Message (SMS, MMS) uploading technology to a server document sharing or online collaboration tools cloud Computing It can also include providing access through the forwarding of a password of a login ID and password, or a link to a server or cloud facility that contains technology and at the time of providing the access, the recipient is not in Australia. Even if you believe the recipient already has knowledge of the technology being supplied - this is still a "supply" under the DTCA Will any technology be supplied by intangible Yes If yes please complete consignee section. means? Page 1 of 10

2 CONSIGNEE DETAILS A "consignee" is usually a third party, or an intermediary, who is either involved in the supply chain for the export of the goods or they can be the end user of the goods. They are also the person/entity to which you will "supply" intangible technology to. End User/recipients will be the persons, companies or research/tertiary institutions that will receive and/or use the goods or technology located overseas. Please identify the department or section within the larger entity, eg "School of Engineering, XXXXX University" PO Boxes are NOT acceptable International numbers must be prefixed with " +" followed by the Direct Dialling prefix (eg 0011), country code then the phone number/mobile number Each consignee to receive the technology must be identified to ensure they are captured on the permit. If more than one consignee please copy and paste the below section and attach for submission on a separate sheet. Name Number & street Name Suburb/town Post code Contact -Name Contact - State Country Contact - Phone Contact - Position or Company - Website: Questionnaire for trade activities: To enable DECO to conduct assessments on the risk of the export/supply activity, they need to understand more about the entities receiving the goods and technology and how they intend to use them. Your answers below will assist DECO, though more information may be requested during the assessment. Is the End-user/recipient in an Yes if yes - provide further details associated/related industry to you? Have you previously conducted business Yes if yes - further details -over what period of time with this End-user/recipient? Do you believe that the technology or any services Yes if yes - how? to be exported may be used in a weapons of mass destruction program? Is the technology to be exported, or supplied to a country Yes if yes - whom? or entity subject to United Nations or Australian Autonomous Sanctions? Is the technology specially designed for military use? Yes if yes - details? Is the item/technology in the public domain? Yes Software/Technology is in the public domain if it can be downloaded, purchased or accessed without any restrictions. Is the technology basic scientific research?* Yes *Research is defined into 4 types - please refer to help sheet page 9 for a definition on all 4 types to assist you. Third party/foreign Government approvals Some countries have strict requirements on the re-export of goods and technologies they supply. One example is the United States of America. You need to have ascertained from the supplier or source that your goods or technology is not subjected to any requirements to obtain approval from that country prior to re-export permission from DECO. Page 2 of 10

3 Evidence of the approval may be required before DECO can issue a permit to re-export. This may include the following documents: US technology Agreement (TAA,MLA or DSP5) Foreign Government Approval letter Foreign Export licence Foreign Import licence (allowing the goods or technology passage into the foreign country) Are the goods or technology, including any embedded technology,data or equipment, subject to re-export controls by a foreign Government, such as the United States International Traffic in Arms Regulations (ITAR) or the United States Export Administration Regulations (EAR) (Dual Use Part 2 technologies)? Yes Part II: Project Description Give a brief overview of the project. Part III: Physical Security All export controlled goods or technologies must be adequately segregated and protected from disclosure to unauthorised recipients from outside of the Australian borders. s of controlled information under a supply permit should be secured and stored within a secure section on the server for 5 years post completion of the project and IAW other storage policy at QUT. Control Measures: Describe what controlled measures will be implemented and how they will be delivered. Page 3 of 10

4 Goods or technology under foreign trade controls may require special storage and security measures preventing unauthorised access. This relates to physical goods, user manuals of equipment or technical data. Location: Describe the physical location of where the research will be conducted using the goods or technology (building, room). For goods please list the storage location of items and who has access to the location. Item Marking: Export controlled technology and goods must be marked. For supply via intangible means, the following must be noted on the means ( i.e. ) of transmission: "This contains information that is protected under the Defence Trade Control Act 2012 and is intended for the recipient only. If you have received this in error, please notify the sender identified in this immediately." Permit #. applies to this export. For physical shipment the export permit number must be noted on the packaging and all shipping documentation. For US owned or controlled goods and technologies please contact the Trade Control Compliance Officer for assistance. Part IV: Information Security Appropriate measures must be taken to secure all manner of exchanged of controlled information/technology - particularly electronic communications and databases. Such measure may include: User ID, password control, firewall protection or approved encryption technology. Certain controls may require access via Virtual Private network (VPN). All s of controlled technology under permit should be transmitted only through Secure file Transfer Systems. All technology other than those documents for publication must be treated as protected as per the Guidelines for data and Information Security classification document - Appendix B within the Information Security Plan. Information Security: Complete the attached Information Security Plan with the assistance of the Manager, Information security and include this plan with the submission of the Technology control Plan. Part V: Training and Awareness All Personnel with access to the controlled items or information on this project must undertake relevant QUT training prior to beginning work on an export controlled research project. This will entail sufficent training so that all personnel are familiar with: The Awareness training outlining export control regulations in Australia and any international regulations applicable to the project. A briefing by the project supervisor on any conditions of the permit and the potential penalties for violating the Acts associated with the project. Project Supervisor's will be responsible for ensuring that project members receive the training before commencing or participating in the project. Part VI: Assessment As a critical component of the Export Control Management System (ECMS) ongoing compliance and monitoring, selfassessment should be performed periodically and any relevant findings reported to the Trade Control Compliance Officer. Trade Controls could change based on the direction of research, changes in the status of controlled information and technology and/or changes in the law and regulations. The Trade Control Compliance Officer may conduct periodic evalutions and/or training to monitor compliance of the TCP procedures. Any changes necessary will be relayed and cleared in advance by the Director OREI. Page 4 of 10

5 Part VII: International Travel Will there be a requirement for International travel for this project? Please provide as much information on the trip, duration and proposed dates. What electronic devices or controlled information will be required for the trip? Part VIII: Disposal - Destruction Procedures at project completion Disposal of controlled goods and technology: Describe how you intend to dispose of the controlled goods and technology. Please detail a plan for the proper disposal/return of the controlled goods and technology. This includes all USB, flashdrives ( clearance) printed documentation and records. Page 5 of 10

6 Part IX: Personnel Certification Project Supervisor: As the project Supervisor, I have developed this Technology Control Plan, I further acknowledge that I understand this is a requirement under the University Policy and procedures to ensure that technology listed within the DSGL and protected under the DTCA 2012 is not inadvertently disclosed to authorised recipients. Should it come to my attention of such disclosure, I will report it immediately to the Trade Control Compliance Officer. I further acknowledge that I am responsible for ensuring that the research project is carried out in accordance with this plan. Researchers: I hereby certify that I have read this Technology Control Plan and have received a copy. I understand and agree to follow the procedures outlined in the plan. I understand that I can be held personally liable if I unlawfully disclose, regardless of format, trade controlled information to unauthorised persons. I further understand that offences or violations of the Defence Trade Control Act may carry significant financial or criminal penalties. I acknowledge that I have undertaken the QUT mandatory training on trade controls prior to commencing this project. I will report any unlawfully disclosure immediately to the project supervisor. Executive Dean,Head Of School or Assistant Deans (Research)/Faculty or I am aware that the project has Technology that is controlled under the Defence Trade Control Act The Technology Control Plan outlined and described within this document provides clear guidance to my research staff and project supervisors. Page 6 of 10

7 Manager, Information Security: As the Manager, Information Security, I have provided assistance in developing the Information Security Plan to accompany this Technology Control Plan. Safeguards are in place to adequately protect both the storage and transmission of Exported/Supplied Controlled Technology by electronic means. Deputy Vice Chancellor (Research and Commercialisation): I have been briefed on this project and implications under the Defence Trade Control Act and/or relevant laws. The Technology Control plan outlined for this project is approved. OREI use only Export Control Information: To be completed by the Trade Control Compliance Officer. OREI Registration #: DSGL code: DECO Permit #: Description of the controlled technology: Conditions of permit: TCP submission date: TCP Approval date: Page 7 of 10

8 TRAINING RECORDS FOR RESEARCH PROJECT - TCP # NAME FACULTY/DEPARTMENT DATE TRAINED Page 8 of 10

9 This Technology Control Plan is to help you assess, address and understand your obligations for protecting the information that is controlled for export/supply under this project. The following bullet points are key areas to consider and to utilise as a checklist to assist in the completion of the Technology Control Plan. Part II: Project Description Clear defined outline of project include: Equipment to be used, who is providing the equipment Scope of the research Potential end use of research Phones, PDAs, Tablets, computers and any other personal electronic devices to be used. All USBs should be new and specific to this project. 1 Pure basic research : is experimental and theoretical work undertaken to acquire new knowledge without looking for long term benefits other than the advancement of knowledge. 2 Strategic basic research : is experimental and theoretical work undertaken to acquire new knowledge directed into specified broad areas in the expectation of useful discoveries. It provides the broad base of knowledge necessary for the solution of recognised practical problems. 3 Applied research : is original work undertaken primarily to acquire new knowledge with a specific application in view. It is undertaken either to determine possible uses for the findings of basic research or to determine new ways of achieving some specific and predetermined objectives. 4 Experimental development : is systematic work, using existing knowledge gained from research or practical experience, that is directed to producing new materials, products or devices, to installing new processes, systems and services, or to improving substantially those already produced or installed. Part III: Physical security Clearly define the following: How you will protect the devices that have controlled technology on them How physical equipment and devices will be marked to identify control status How you will prevent unauthorised persons from gaining access to the equipment Part IV: Information Security Clearly define the following: Project data controlled must not be sent unencrypted over any networks. Server segregation for restricted access should be utilised Personal devices should not be used for controlled projects, identify plans to protect controlled technology on such devices if they are to be used. i.e. VPN - password codes and time out locking s should be sent through secure file transfer systems, identify the system to be used Part VII: International Travel Clearly identify the following: Where travel will happen location, city, business, contact person What devices will be taken (different permits may be required) Duration/frequency of travel Purpose of travel teaching, lecturing etc Part VIII: Disposal - Destruction Identify the following: Mandatory obligations (time) to retain documents Destruction procedure/method for documents, equipment technology, USBs etc Page 9 of 10

10 Project OREI Rgistration number: Project Supervisor: Technology Control Plan Variation Phone: Details of variation: List all required changes to the Technology Control Plan, giving brief details on each. New Researcher: I hereby certify that I have read the Technology Control Plan and have received a copy. I understand and agree to follow the procedures outlined in the plan. I understand that I can be held personally liable if I unlawfully disclose, regardless of format, trade controlled information to unauthorised persons. I further understand that offences or violations of the Defence Trade Control Act may carry significant financial or criminal penalties. I acknowledge that I have undertaken the mandatory training on trade controls prior to commencing this project. I will report any unlawfully disclosure immediately to the project supervisor. Page 10 of 10

Internal Compliance Plan Standard Operating Procedures Trade Controls

Internal Compliance Plan Standard Operating Procedures Trade Controls Version 3.0: March 2017 Review date: March 2018 Internal Compliance Plan Standard Operating Procedures Trade Controls Page 1 Revision