Research Domain

Export Controls and Technology Security

Research on controlled technology, jurisdictional classification, and the transfer pathways that regulation is designed to interrupt.

ITAR · EAR · BIS Entity List · ECRA · FDPR
Domain Statement

What this domain covers

Export control turns on precise facts: the technical characteristics of an item, who can access it, and which jurisdictions data moves through. Research in this domain examines how classification decisions are constructed, where deemed-export exposure arises, and how restricted-party and ownership rules propagate through a supply base.

Analytic questions

  • Is an item, technology, or data flow controlled, and under which authority?
  • How is deemed-export risk assessed where foreign-national access exists?
  • How do restricted-party and ownership rules propagate through supply relationships?
  • Which technology-transfer pathways does the current control architecture fail to reach?

Methods Applied

  • Jurisdictional classification analysis
  • Ownership-rule tracing
  • Technology pathway mapping
  • Authority and precedent review

Related Advisory

Standards

Publications

Published work in this domain

Adversarial-Cost Screening

A validation framework for export control, sanctions, and supply-chain counterparty programs: three structural defects that process metrics cannot see, and the framework that corrects them.
SCREEN-01 · 13 Aug 2026

Denying Chinese Victory

Cost, resource, and military advantages available to the United States, 2026–2035: the measures with the most favorable cost-exchange ratios against an invasion of Taiwan are also the fastest to field. Published in the Statecraft & Policy domain.
WP-2026 · 19 Sep 2026

Insulate, Then Press

A sequencing framework for U.S. policy toward a structurally declining China: reduce exposure to Chinese critical-minerals processing before applying most forms of pressure. Published in the Statecraft & Policy domain.
WP-2026 · 26 Aug 2026

Your Subcontractor’s Engineer Does Not Exist

ITAR deemed-export analysis of a North Korean placement inside a defense contractor: 22 CFR § 120.50 release to a foreign person, the § 126.1 proscribed-country regime, and the § 126.18 diversion-prevention obligation in subcontracts. Published in the Cybersecurity & Attestation domain.
SB-2026-04 · 9 Aug 2026

The Export Rule Controls Your Data. It Never Tells You How to Protect It.

How a cybersecurity obligation attaches to export-controlled information — 10 CFR Part 810, the ITAR and EAR encryption safe harbors, the CUI framework, and why the same engineering file can carry an obligation at one firm and none at another. Published in the Cybersecurity & Attestation domain.
SB-2026-02 · 30 Jul 2026

Back to the research library