Export-controlled teams

Under US export rules, showing controlled technical data or source code to a foreign person inside the United States counts as exporting it to their country. Two texts say so:

ITAR, 22 CFR 120.50(b): “Any release in the United States of technical data to a foreign person is deemed to be an export to all countries in which the foreign person has held or holds citizenship or holds permanent residency.”

EAR, 15 CFR 734.13(a)(2): a deemed export is “Releasing or otherwise transferring ‘technology’ or source code (but not object code) to a foreign person in the United States.”

The rule carves out object code, so the usual answer is to compile controlled source in an enclave and hand binaries to everyone else. The build breaks at the line between source and binary, and the folder permissions that hold the line drift.

An engineer's profile is Visible on everything except named compartments, such as a guidance module. They notice nothing until they open one. The compiler still builds the whole product, and every attempt on a compartment is on the record for the export-control officer.

Occlude shows an Occluded module's signatures so the code around it compiles and autocompletes. Whether a generated declaration is itself “source code” or “technology” under these rules is a legal question, and it is open.

Until an export-control lawyer answers it, we recommend controlled code be Absent, with a hand-written interface in its place, not Occluded. The build still works; the interface is yours to write and review.