ITAR & Export Controls: A Plain-Language Guide

Why this page exists

A lot of us leave military service with skills, gear, and contacts — and a strong urge to keep helping: Ukrainian units, partner forces, foreign friends building drones or comms kits. That help is exactly what U.S. export-control law regulates, and it does not care that you’re a volunteer, that the cause is good, or that the “export” was just advice in a Signal chat.

This came up in the Tech channel when someone shopping for a wideband spectrum analyzer noted it couldn’t be ITAR-controlled — and the thread turned into a crash course on why. The short version stands:

ITAR is not something you ever want to mess with. Legal problems can start with an arrest at the airport.

The two rulebooks in 60 seconds

The U.S. has two main export-control regimes. Both can apply to hardware, software, and information.

	ITAR	EAR
Who runs it	State Department (DDTC)	Commerce Department (BIS)
What it covers	Inherently military items and services on the U.S. Munitions List (USML)	Dual-use and commercial items on the Commerce Control List, including many former ITAR items
Examples	Fire-control systems, military radar, Gen 3 night vision, thermal weapon sights, military drones, military training and advice	Body armor and ballistic helmets, day-optic rifle scopes, commercial drones, most commercial electronics
Regulation	22 CFR 120–130	15 CFR 730–774

The single most important myth-buster: “it’s not ITAR” does not mean “no license needed.” Body armor, rifle scopes, semi-auto firearms, and many drones moved from ITAR to EAR years ago — they moved to Commerce, not to freedom. Most still require a BIS license to leave the country.

Two more rules of thumb that surprise people:

The “see-through” rule. A commercial product can become a defense article because of a single ITAR-controlled component inside it. Boeing was fined $15M for exporting commercial jets to China because they contained the QRS-11 gyro chip — a USML item. The end product’s civilian character doesn’t launder the part.
Intended end use doesn’t matter for classification. What controls an item is what it is (its specs and what it was designed for), not what you plan to do with it. “It’s for a civilian volunteer group” changes nothing about whether the item is controlled.

Five concepts in plain terms

Defense article — hardware (or technical data) on the USML. Night vision, thermal weapon sights, military electronics, suppressors, military UAS.
Technical data — the information needed to design, build, repair, modify, or operate a defense article: drawings, specs, source code, maintenance instructions. (22 CFR 120.33)
Defense service — helping a foreign person with a defense article, or training/advising foreign military forces at all. More on this below, because it’s the one that catches veterans. (22 CFR 120.32)
Export — not just shipping. Hand-carrying gear in your luggage is an export. So is a “deemed export”: letting a foreign person see or receive controlled technical data — even inside the U.S., even over an encrypted chat. The moment a foreign person can access it, it’s exported. (22 CFR 120.50)
Foreign person — anyone who isn’t a U.S. citizen, green-card holder, or protected refugee/asylee. A Ukrainian soldier, a foreign engineer on a video call, most members of an international group chat.

Case study: is this spectrum analyzer export-controlled?

This is the real question that started this page (covered in more device-specific detail at Wideband Spectrum Analyzer and Export-Control Considerations). Someone needed a real-time wideband spectrum analyzer (~150 MHz–10 GHz) that couldn’t be ITAR-controlled, a Signal Hound SP145 was suggested, and the group spent an afternoon working out its actual status. The process generalizes to almost any piece of dual-use gear — SDRs, drones, optics, comms kit.

Step 1 — Understand why the category exists. Test equipment sounds harmless, but USML Category XI (military electronics) covers electronic systems “specially designed” for collection, surveillance, monitoring, or exploitation of the electromagnetic spectrum for intelligence or security purposes — including TSCM (technical surveillance countermeasures) and electronic-surveillance gear. When DDTC revised Category XI, it spelled out what makes a spectrum analyzer look like surveillance equipment rather than a bench instrument:

sweep/scan speed exceeding 250 MHz per second
instantaneous bandwidth exceeding 110 MHz
built-in signal analysis capability
volume under 1 cubic foot (i.e., portable/concealable)
records digital signals beyond single-trace snapshots
time-vs-frequency display (waterfall / rising raster)

Notice that a modern portable real-time analyzer ticks most of these boxes on specs alone. What keeps commercial units out of Category XI is the “specially designed” test: a general-purpose commercial instrument sold openly for lab and field RF work is not specially designed for intelligence or security purposes. Pair the same hardware with intelligence-oriented software, though, and the resulting system can be a different animal — classification can hinge on a single chip (e.g., an extreme-temperature-rated oscillator) or a software load. Two products with near-identical specs can land on opposite sides of the line.

Step 2 — Check what the manufacturer says. Serious vendors publish their export status. Signal Hound’s terms state their units are controlled under the EAR, ECCN 3A992.a (except one GPS-disciplined oscillator product under 3A001.b.10) — not ITAR. Their SDK license still carries ITAR/EAR boilerplate, which caused confusion in the chat; the operative statement is the export-classification paragraph, not the CYA language. When it’s ambiguous, email the manufacturer’s export-compliance contact — they answered.

Step 3 — Know what the ECCN means. An ECCN (Export Control Classification Number) is the EAR’s equivalent of a USML category. 3A992.a is a low control level covering commercial electronics: many exports qualify as NLR (“No License Required”). But NLR is not carte blanche — sanctioned countries, denied parties, and military/WMD end uses still require authorization or are prohibited outright. And the moment gear rides along to a conflict zone, those end-use questions are live.

Step 4 — When in doubt, get a ruling. If the manufacturer can’t tell you or the answer matters (you’re about to ship it, fly with it, or build it into something), that’s what a Commodity Jurisdiction request to DDTC or a classification request to BIS is for — free, and binding.

Also worth knowing: ITAR recordkeeping requires exporters to retain licenses, export logs, and related documentation for five years. If you ever do operate under a license or exemption, the paperwork obligation outlives the shipment.

The trap most relevant to veterans: defense services

Hardware gets the headlines, but the part of ITAR aimed squarely at former service members controls what’s in your head. 22 CFR 120.32 defines a defense service to include:

“Military training of foreign units and forces, regular and irregular, including formal or informal instruction … and military advice.”

Read that carefully:

No hardware needs to change hands. Teaching a foreign unit small-unit tactics, mission planning, weapons employment, or equipment maintenance is a controlled defense service.
No classified information is required. Your unclassified experience and training count.
Payment doesn’t matter. The rule has no “for compensation” element — volunteering is not a defense.
“Irregular forces” are explicitly named. Training a territorial defense unit or volunteer battalion is covered just like training a national army.

Furnishing a defense service to foreign forces requires DDTC authorization before you do it. People have been prosecuted for exactly this — see the real cases below.

Separate but related: military retirees and reservists need advance approval from their service secretary and the State Department before accepting employment or compensation from any foreign government (37 U.S.C. § 908). Penalty is an offset against your retired pay — on top of any ITAR exposure.

”But I’m helping Ukraine”

Ukraine is a U.S. ally receiving billions in official military aid — and none of that changes what an individual is allowed to do. Ukraine is not an embargoed destination, but the licensing rules are the same as before the invasion. DDTC expedites Ukraine-related applications; it does not waive them. Sympathy for the destination is not an element of the offense — a Ukrainian national was convicted of conspiring to export night vision equipment to Ukraine without a license.

What that means in practice:

You want to…	Reality check
Mail night vision or thermal optics	Assume any NV/thermal device needs a license. High-end units are ITAR (USML Category XII); even commercial-grade units are EAR-controlled. Individuals essentially cannot get these licenses.
Mail body armor or ballistic helmets	EAR-controlled (ECCN 1A613). You generally cannot ship them abroad yourself. There’s a narrow exception to wear your own one set when you travel — it does not cover donations.
Mail rifle scopes or red dots	Day optics are ECCN 0A987 under the EAR — still license-controlled to Ukraine.
Send drones or drone parts	Commercial drones are EAR-controlled to Ukraine/Russia/Belarus; military UAS are ITAR (USML Category VIII).
Fly there and train a unit	That’s a defense service under 22 CFR 120.32 — DDTC authorization required, volunteer or not.
Advise a unit remotely from your couch	Same answer. “Whether in the United States or abroad” is in the rule’s text, and chat/video counts.
Post controlled technical data in a group chat with foreign members	That’s a deemed export the moment they can read it. Encryption doesn’t change the analysis.
Donate money to an established, licensed relief/support organization	✅ The clean path. Organizations like the Ukrainian American Coordinating Council hold the BIS/State authorizations to move regulated gear legally.
Donate gear to a U.S.-based licensed organization	✅ Also viable — they export under their license, not your kitchen-table one.
Send genuinely uncontrolled humanitarian items (tourniquets, most medical supplies)	Generally fine — but verify each item; don’t assume.

Going to fight is a separate legal question (the Neutrality Act, 18 U.S.C. § 959, criminalizes enlisting in a foreign force while in the U.S., and State’s travel advisory for Ukraine is Level 4: Do Not Travel). But note the distinction: joining a foreign force yourself is legally murky; training or advising that force without a license is a straightforward ITAR violation. They are different statutes with different risk profiles.

What happens if you get it wrong

Criminal: up to $1,000,000 in fines and 20 years in prison per violation (22 U.S.C. § 2778). “Per violation” means each shipment, each training session, each transfer can count separately.
Civil: over $1.2M per violation, no criminal conviction required.
Debarment: a conviction bars you from all ITAR-regulated work — a career-ender for anyone in or near the defense industry.

These are not theoretical. Real cases, real individuals — several of them veterans:

Igor Panchernikov, former U.S. Air Force Reserves — sentenced to 27 months in prison (2023) for exporting thermal riflescopes and night vision goggles without a license. A handful of devices was enough.
Daniel Duggan, former Marine Corps pilot — indicted for training Chinese military pilots through a foreign flight school; arrested in Australia in 2022 and fighting extradition ever since.
Gerald Eddie Brown Jr., former U.S. Air Force pilot — charged in 2026 with providing unlicensed flight training to Chinese military pilots (charges are allegations pending trial).
Three former U.S. intelligence and military personnel (UAE “Project Raven,” 2021) — paid $1.685M in penalties and were permanently barred from clearances for providing unlicensed cyber services to a foreign government.
Lance Brooks, former Army National Guard — pled guilty after training UAE personnel on grenade launchers without authorization.

The pattern: the government prosecutes individuals, including veterans, including for training and services where no crate of weapons ever moved.

Myths, debunked

“I’m out of the military, so my knowledge is mine now.” ITAR applies to every U.S. person. Your DD-214 doesn’t release the knowledge — Duggan, Brown, and the Project Raven defendants were all veterans or former USG.
“It’s for a good cause.” Not an element of the offense. Unlicensed exports to Ukraine have been prosecuted.
“I found it on the internet, so it’s public domain.” Publication covers lawfully published documents — not your tailored instruction, and not leaked material.
“I’m volunteering, not selling.” Neither the defense-services rule nor the brokering rule requires payment.
“It’s just one item / small quantities.” Penalties attach per violation. One pair of NV goggles in a mailed box is felony exposure.
“It moved off ITAR, so it’s fine.” Firearms, armor, scopes, and drones moved to the EAR — most still need Commerce licenses.
“It was an encrypted private chat.” A deemed export happens when a foreign person can access controlled technical data, full stop.
“I can’t sell it abroad, but I can travel with it.” Taking controlled items or data (including on your laptop or phone) out of the country is an export. This is the “arrest at the airport” scenario.

If you actually want to do this right

Figure out what controls your item. Manufacturers often publish an ECCN or ITAR status (check the product’s export-compliance page or ask them directly). For a binding answer, file a free Commodity Jurisdiction request (Form DS-4076) with DDTC, or a classification request with BIS.
Ask before acting. DDTC Response Team: 202-663-1282 / ddtccustomerservice@state.gov. They exist to answer exactly these questions.
Defense services need paperwork before day one. Registration with DDTC (22 CFR Part 122) plus an authorization — typically a Technical Assistance Agreement — before training or advising foreign forces.
Already stepped in it? Voluntary self-disclosure (22 CFR 127.12) significantly mitigates penalties. Talk to an export-control attorney first, then disclose — don’t wait to be found.
Get an attorney before any training/advisory arrangement with foreign forces or foreign defense companies, and before shipping anything with night-vision, thermal, ballistic, or military-comms capability.
When in doubt, send money, not gear or skills. Donations to established, licensed organizations are legal, effective, and migraine-free. As one of our members put it after researching all of this: “I’ll stick to helping my Ukrainian unit with funds — that way it’s all legal and reported.”

Primary sources

ITAR full text — 22 CFR Parts 120–130 (eCFR)
DDTC portal (pmddtc.state.gov) — registration, licensing, CJ requests, FAQs
EAR full text — 15 CFR Parts 730–774 (BIS)
U.S. Munitions List — 22 CFR Part 121
Defense service definition — 22 CFR 120.32
Export & deemed export — 22 CFR 120.50
Public domain — 22 CFR 120.34
Brokering — 22 CFR Part 129
Commerce Control List — 15 CFR Part 774 Supplement 1 (BIS)
BIS rifle-scope ECCN FAQ
GAO report on defense-services enforcement (GAO-23-106379)
DARPA SBIR/STTR ITAR one-page info sheet (PDF) — the best single-page overview we’ve found
SBIR ITAR tutorial — free self-paced walkthrough
USML Category XI revision (spectrum analyzer / TSCM parameters) — Federal Register