Can I open source this?
Publishing is a release. Once it is public you cannot unpublish it, and the two regimes do not treat publication the same way.
Written for: Engineering teams that publish code, papers, or detailed specifications
The short answer
- Published information is generally outside the EAR, with real carve outs.
- The ITAR does not treat publication the same way.
- Publication cannot be undone, so the decision has to come first.
- Encryption source code can carry a notification requirement.
The general position under the EAR
Information that is genuinely published is generally not subject to the EAR. Fundamental research carve outs exist for basic and applied research in science and engineering where the results are ordinarily published and shared broadly, and there are carve outs for educational information and for patent applications. This is why a great deal of academic and open source work proceeds without a licence.
Where the ITAR differs
The ITAR does not have the same shape, and the public domain concept under it is narrower and more specific. Assuming that publishing solves the problem because it does under the EAR is a common and serious error when the underlying item sits on the Munitions List.
The irreversibility problem
A push to a public repository cannot be undone. Deleting the repository does not retrieve the copies, and the record of the release remains. This makes publication one of the few compliance decisions with no practical remedy after the fact, which is the argument for deciding before rather than after.
A workable process
Decide once what a project's publishable surface is, rather than case by case under deadline. Route anything outside it through a written release decision with a named approver. Keep the approved version or its hash. For encryption source code specifically, check whether a notification requirement attaches, because it often does.
The rules behind this
- 15 CFR 734.7
- 15 CFR 734.8
- 15 CFR 742.15
- 22 CFR 120.34
This is a plain reading of published rules, not legal advice, and it is not a determination about your item. What decides your case is your exact configuration, your parties, and your destination. The limits, in full.
Next
Related questions
ITAR or EAR, which one applies to me?
Two regimes, two agencies, and the wrong guess is expensive. The test is what the item is and what it was designed for, not what industry you are in.
What does EAR99 actually mean?
It means no Commerce entry describes your item. It does not mean you can ship it anywhere, and it is not a licence.
Can I hire an engineer who is not a U.S. citizen?
Yes. Export control regulates what you show them, not who you employ, and treating it as a hiring rule creates a different legal problem.
What is a deemed export?
Showing controlled technology to a foreign person inside the United States counts as exporting it to their country. Nothing has to ship.