The executive role in culturing export control compliance.

• Author: Morris, Matthew G.

TABLE OF CONTENTS INTRODUCTION I. SELF-REGULATING REQUIREMENTS OF EXPORT CONTROLS II. JUSTIFICATIONS FOR ADMINISTRATIVE PENALTIES FOR EXPORT CONTROL VIOLATIONS A. On the Record: Stated Goals of BIS B. The Goal and Challenge of Deterrence C. Goals in Conflict: Rehabilitation and Incapacitation D. The Odd Case for Retribution III. COMPLIANCE CULTURE AS A FACTOR IN PRIMARY LIABILITY IV. THE ROLE OF CORPORATE CULTURE IN ACHIEVING THE GOALS OF PUNISHMENT V. THE EXECUTIVE ACCOUNTABILITY BRIDGE CONCLUSION INTRODUCTION

The control of exports in order to protect national interests is subject to a "frightful labyrinth" of laws and regulations. (1) The motive for enacting these laws varies: some are enacted to satisfy United States treaty obligations, (2) some for national security reasons, (3) and others for humanitarian considerations. (4) Further complicating matters, these laws issue from multiple sources. (5) At times, the enabling legislation has lapsed only to be cobbled back together by interim legislation or by Executive Order. (6) The result is a legal regime where "it can be difficult to find and piece together applicable law." (7)

The criteria for determining sanctions for violations of export controls have been similarly vague. Consider, for example, the determination of sanctions for violations of the export controls for dual-use technologies--technologies and products that "can be used both in military and other strategic uses ... and commercial applications"--set forth in the Export Administration Regulations (EAR). (8) Enforcement of those controls falls to the Bureau of Industry and Security (BIS) at the Department of Commerce. (9) In the event of a suspected violation, BIS has three options. At the extremes, it may either refer the case to the Department of Justice for criminal prosecution or issue a letter of warning. In the middle, it may pursue an administrative enforcement case. (10) If the case is severe enough to merit criminal prosecution, the United States Sentencing Guidelines provide some guidance on the determination of penalties. (11) There has been little guidance on appropriate punishment in cases that are not severe enough to merit criminal prosecution--those cases where administrative penalties are appropriate. Until recently, the extent of published guidance has been the maximum administrative sanctions found in the EAR, with no explanation of intermediate levels of sanctions falling short of the maximum. (12)

The Department of Commerce has recently acted to provide clearer penalty guidance. On September 17, 2003, BIS proposed amendments to the EAR in order to provide guidance on "how BIS makes penalty determinations when settling administrative enforcement cases" for violation of the EAR. (13) BIS then incorporated that proposed rule into a final ruling on February 20, 2004. (14) As a result, the EAR now include a supplement at 15 C.F.R. [section] 766 that, for the first time, provides government criteria for setting a penalty in these administrative proceedings. (15) The penalty guidance is largely advisory. In fact, in publishing its penalty guidance, BIS included a disclaimer that the guidance was not binding on any party--even itself. (16)

Nevertheless, the guidance is significant for three reasons. First, it is the only published scheme for determining an administrative punishment for EAR violations, and therefore it likely would be persuasive to an administrative law judge presiding over an administrative enforcement action. Second, since many administrative cases are settled with BIS, it will represent the de facto penalty determination method in many such cases. (17) Third, the guidance is informative since it reflects BIS's institutional experience about what factors have been relevant to determining penalties in the past.

The new penalty guidance sets out six "general factors" for determining appropriate sanctions, then lists eight aggravating factors and nine mitigating factors. (18) The general factors BIS will consider are: degree of willfulness, the destination involved, the commission of related violations, the commission of multiple unrelated violations, the timing of the settlement, and any related criminal or civil violations. (19) Of the eight listed aggravating factors, three are to be given "great weight": making a deliberate effort to conceal the violation, demonstrating a serious disregard for compliance responsibilities, and "the sensitivity of the items involved and/or the reason for controlling them to the destination in question." (20) Of the nine listed mitigating factors, two are to be given "great weight": voluntary self-disclosure of the violation and the company's having an effective export compliance culture. (21)

This Note argues that this last factor--the effective export compliance culture--should be the first step in the analysis rather than a mere mitigating circumstance to be considered after weighing all the other factors. Instead of first considering what BIS describes as the general factors and then mitigating for the presence of an effective compliance program, the degree of culpability should be determined through examining the culture of compliance, tempered by considering the other general factors. Part I argues that the nature of export control enforcement requires extensive self-governing behavior on the part of exporters and that enforcement should be directed toward that end. Part II examines several possible justifications for penalizing a business entity and concludes that deterrence and rehabilitation through education are the most viable, particularly in a self-regulating industry. Part III argues that examining the export compliance program is actually a necessary prerequisite to determining the general culpability required under the general factors, and on that basis alone cannot be relegated to a mitigating factor. Part IV argues that an emphasis on corporate compliance programs in punishment is the most effective route to deterrence and rehabilitation. Finally, Part V argues that findings from the field of corporate social responsibility indicate that the creation of a culture of compliance focused on executive accountability is most likely to result in effective controls.

1. SELF-REGULATING REQUIREMENTS OF EXPORT CONTROLS

   This Part argues that export controls rely largely, in fact almost entirely, on self-regulatory behavior by exporters. This is a result of the export regulations themselves, as well as the enforcement resources available to BIS and the small percentage of exports that require a license. Although BIS provides some level of after-the-fact enforcement, the primary effort is to prevent violations through education and guidance.

   Only a small fraction of total United States industrial exports--four percent by one estimate--require a BIS export license. (22) Given then that ninety-six percent of exports do not require licensing, and that BIS, like any government agency, must economize the use of its enforcement resources, the Department of Commerce cannot reasonably be expected to place an agent at the site of every export transaction to watch over the shoulder of industry and ensure perfect compliance.

   Industrial exports can now occur at almost any location in the United States, yet BIS export enforcement field offices are located at only nine locations, with each field office providing enforcement supervision over a specified region. (23) Although these field offices provide on-site enforcement abilities, there are significant export hubs that are not serviced by an on-site enforcement team, including Seattle, San Diego, and New Orleans. And while the chosen enforcement locations are sensible, any small firm could hypothetically commit an illegal unlicensed export by placing handcuffs in a padded envelope and mailing them to Turkey. (24)

   The complicated nature of the export license process itself makes diligent efforts at self-regulation all the more necessary. When contemplating an export, it falls to the exporter to determine whether an item is restricted and what steps to take thereafter. In fact, the EAR confront an exporter with a total of at least twenty-nine steps that must be taken to determine how to comply. (25) If, in just the very first step, the exporter incorrectly determines whether this is an item "subject to" the EAR, the exporter might ignore the rest of the process and the export will proceed unless some outside force intervenes. (26) The licensing process itself is triggered only upon an application by the exporter, which comes at step twenty-six of the process. (27) An error in the preceding twenty-five steps, or the failure to comply with step twenty-six, could effectively remove the Department of Commerce from the equation.

   Of concern to both BIS and industry, the definition of the term "export" has expanded to include many activities that do not fit the traditional description, making it even harder to predict when and where controlled exports will occur and to dispatch a government regulator to oversee the process. The so-called "deemed export" rule provides that the release to a foreign national of technology or software source code that would otherwise be subject to the EAR is deemed to be an export of the technology in question to the country of origin of the foreign national. (28) For example, by this standard it would be deemed an export to China to allow a Chinese professor visiting at a research university hundreds of miles from the nearest border to "visually inspect" technology that is covered by the EAR--including the object itself, plans, blueprints, schematics, or specification sheets. (29) Admittedly this construction of the controls might be a necessary reflection of the changing nature of the ways that damaging items and technology can leave United States control. The point is that requiring on-site, prior inspection of every export is simply impossible.

   BIS...