Tools of Trade License Exception

In order to use the “Tools of Trade” license exception, both of the following must apply:   

1. Personal requirements for Using “Tools of Trade” license exception:

• You must be a U.S. person or the employee of a U.S. person,

• Any accompanying family member must be a U.S. person,

• You must take only the usual and reasonable kinds and quantities of items for use in a lawful enterprise or undertaking, or the trade, occupation, employment, vocation or hobby of you or an accompanying family member,

• You must bring the items back with you upon your return or within 12 months,

• You must keep the item under your effective control at all times rather than leaving it in your locked hotel room, and

• You must take precautions against the unauthorized release of software and technology.

2.  Hardware, Software, and Data requirements for Using “Tools of Trade” license exception:

• The laptops and other computing and data storage devices are all standard, off-the-shelf products and are generally available to the public through retail outlets.

• The operating system and all software applications are generally available to the public and are either pre-installed on standard, off-the-shelf hardware or can be purchased and installed by a user without vendor support.

• Any "mass market" encryption, i.e., encryption of the kind that is generally available to the public and does not allow for user revisions to enhance communciations security capabilities. "Mass market" encryption software is either pre-installed on standard, off-the-shelf hardware or can be purchased and installed by a user without vendor support. Examples include: FileVault for Mac, Bitlocker for Windows, U-M Cisco VPN, and Duo.

• Any data and analyses you take are publicly available (e.g., published in journals or published on the web). Data and analysis from research that ordinarily would be published and that are not restricted by contract from general dissemination can be treated as publicly available; and

• There are no other export constraints on any of the equipment, software, data or information that would apply to your intended travel. Examples of items with export constraints that are not eligible for this exception include satellite or other space related equipment, components or software, high level encryption products, and defense items covered by the International Trade in Arms Regulations (ITAR).

PLEASE NOTE:  The Duo Mobile app, Security Keys (e.g., Yubikey), and hardware tokens are encryption items subject to U.S. export control regulations. Generally, you may travel with Duo and ship it internationally, except to a few countries. Duo is controlled as follows:

Shipping Duo:

You may ship Duo internationally, except to Cuba, Iran, North Korea, Syria and the Crimea, Donetsk People’s Republic (DNR) and Luhansk People’s Republic (LNR) regions of Ukraine where you must first notify the U-M Export Control Program (exportcontrols@umich.edu) and obtain an export license. 

Traveling with Duo:

You may take Duo with you when traveling internationally, with the following restrictions:

In order to comply with U.S. regulations, Duo has began blocking authentications from users whose IP address originates in a country or region subject to economic and trade sanctions enforced by the U.S. Office of Foreign Assets Control (OFAC). Faculty, Staff and Students attempting to authenticate using Duo from the following OFAC-regulated countries or regions will be blocked from completing their login and will receive an error message:

• Cuba
• North Korea
• Iran
• Syria
• Crimea region
• Donetsk region
• Luhansk region
• Sevastopol region

Online Learning:

You may use Duo internationally, except in Cuba, Iran, North Korea, Syria and the Crimea, Donetsk People’s Republic (DNR), Luhansk People’s Republic (LNR) and Sevastopol regions of Ukraine where the hard and soft tokens are export controlled as encryption technology. Please note: Duo has began blocking authentications from users whose IP address originates in a country or region subject to economic and trade sanctions enforced by the U.S. Office of Foreign Assets Control (OFAC). Faculty, Staff and Students attempting to authenticate using Duo from the following OFAC-regulated countries or regions will be blocked from completing their login and will receive an error message: Cuba, North Korea, Iran, Syria, Crimea region, Donetsk region, Luhansk region, Sevastopol region. Upon request, U-M's Office of Information Assurance is able to generate passcodes for two-factor authentication needs for online learners.  Please contact the ITS Service Center for further assistance.

If you would like to document your export compliance and self-assess that your electronic device complies with the "Tools of the Trade" license exception, you may download either the TMP for U-M-owned technology form or the BAG for personally-owned technology form to take with you when you travel.