Share this article

What Civilian Trainers Must Know (and Prove) to Stay Legal

Why this matters now: The State Department’s ITAR still regulates “defense services”—including training—to foreign persons, whether the training happens in the U.S. or abroad. BIS (Commerce) controls many hardware exports today, but ITAR continues to govern defense services and technical data tied to USML items (and some activity even when no hardware changes hands). Penalties can be civil or criminal, and OFAC/§126.1 country policies add extra landmines. (pmddtc.state.gov)

Core rules (the non-negotiables)

• “Defense service” = training for foreign persons. ITAR explicitly defines defense service as furnishing assistance including training to a foreign person on the use/operation/repair/etc. of a defense article—inside or outside the U.S. (22 C.F.R. §120.32). If your curriculum touches USML-controlled capabilities, you are in ITAR territory. (eCFR)
• Authorization is required before you train. DDTC confirms U.S. persons must obtain approval even if the training occurs overseas and even if no physical item is exported. DDTC often authorizes via §120.22(b) “general correspondence” (for individuals abroad) or formal agreements (e.g., TAAs) depending on scope. (Akin – Akin, an Elite Global Law Firm)
• Brokering can apply even when you don’t teach. Arranging or facilitating someone else’s defense service (introductions, financing, logistics) can trigger ITAR Part 129 brokering registration/licensing requirements. (eCFR)
• Country & end-user screens are mandatory. ITAR §126 lists “policy of denial” destinations and proscribed parties; licenses to those end-uses are generally denied (with narrow exceptions). You must screen nationality, residency, dual-/third-country nationality, and sanctions. (eCFR)

Hardware vs. services today: Many commercial-market firearms transitioned from USML (State) to CCL/EAR (Commerce) in recent years, and BIS issued further revisions in 2024–2025. That does not remove ITAR from defense services. If your training is an ITAR defense service, State’s rules still apply, regardless of where the gun now sits in the EAR. (bis.doc.gov)

Scenario 1 — U.S. civilian instructor (certified, not state-licensed or LE) teaching in a foreign country

Risk posture: High unless you have DDTC authorization in hand.

What triggers control

• Any training to foreign persons that teaches the operation, employment, maintenance, modification, or tactical use of USML-controlled articles can be a defense service—even without handing over a single round of ammo or a PDF. (eCFR)
• DDTC’s FAQs for U.S. persons abroad: you generally must secure authorization prior to furnishing the service; DDTC frequently uses §120.22(b) authorizations for individuals employed by foreign entities. (pmddtc.state.gov)

Narrow relief that does not cover tactics/CQB

• ITAR §124.2 exempts basic operation & maintenance training when tied to a lawfully exported defense article to the same recipient. It does not cover intermediate/depot-level maintenance or broader tactics/CQB/employment. Most “tactical” courses exceed this basic-O&M carve-out. (eCFR)

Legal exposure if you proceed without approval

• AECA/ITAR violations can be civil (consent agreements, heavy fines, debarment) or criminal (willful violations). DDTC consent agreements routinely cite unauthorized defense services and poor recordkeeping. (pmddtc.state.gov)
• Country policies & sanctions add strict-liability traps. §126.1 destinations are presumptive denials; OFAC programs may independently prohibit your activity. (eCFR)

Practical: How to be compliant

1. Scope your course against §120.32. If it involves tactics/CQB/defensive employment of USML-controlled articles, treat as defense service. (eCFR)
2. Apply to DDTC: for individuals abroad, request §120.22(b) authorization; for broader/recurring work or multi-party data sharing, use a TAA (Part 124). Keep a CJ (commodity jurisdiction) handy if there’s USML/EAR ambiguity. (pmddtc.state.gov)
3. Screen the host, end-users, and nationalities (dual/third-country nationals are adjudicated as exports to each nationality). (space.commerce.gov)
4. Recordkeeping: ITAR requires robust records; DDTC routinely cites §122.5 lapses in charging letters. (pmddtc.state.gov)

Scenario 2 — Non-U.S. persons (not U.S. LPRs) attending your U.S. tactical/CQB/defensive class

Risk posture: High without a data/services firewall.

Why: Furnishing ITAR-controlled defense services in the United States to foreign persons is still an export under ITAR (“deemed export”). Same analysis as overseas. (Akin – Akin, an Elite Global Law Firm)

Operational pitfalls

• Mixed cohorts: A U.S. class with foreign students can become a defense services export the moment you provide controlled instruction or technical data (lesson plans, slide decks, TTPs for specific USML systems). (Akin – Akin, an Elite Global Law Firm)
• EAR vs. ITAR split: The firearm used on the line may be EAR-controlled, but your tactics and controlled “know-how” can still be ITAR defense services if tied to USML capabilities (e.g., night-vision integration, suppressed weapons employment, specialized breaching/marking tactics). (eCFR)

Controls to implement

• Gate your curriculum: offer a “public/sporting” track that contains no ITAR technical data or defense services; isolate any ITAR-sensitive modules and exclude foreign persons absent DDTC authorization.
• Student screening: verify citizenship/LPR status; identify dual nationals; apply §126.1/OFAC screening. (eCFR)
• If in doubt, apply for authorization describing the exact modules foreign persons may receive. DDTC has expressly stated the requirement applies inside the U.S. (Akin – Akin, an Elite Global Law Firm)

Other scenarios you should plan for

A) Online/virtual instruction, video libraries, course PDFs

Posting or emailing controlled technical data or controlled TTPs to foreign persons is an export; posting controlled files publicly (e.g., 3D-print receiver files) has been litigated (Defense Distributed v. State). Even when policies evolve, the case history shows State treats wide dissemination as export activity. (Fifth Circuit Court)

B) “Arranging” foreign training you don’t teach

Introducing a foreign unit to another U.S. trainer, lining up facilities, or financing the event may be Part 129 brokering—distinct from the teaching itself—and can require separate broker registration/approvals. (eCFR)

C) Hardware exports vs. services split

Since 2020, many commercial firearms/parts moved from USML Cats. I–III to the CCL (0A501 et al.), and BIS adopted new firearm rules in 2024 and revised them again in 2025. You must evaluate both: (i) whether the item needs a BIS license and (ii) whether the training is an ITAR defense service needing DDTC approval. (bis.doc.gov)

Enforcement & precedent signals you should internalize

• DDTC penalties & consent agreements: Repeated themes—unauthorized defense services/technical data, poor screening, and weak records. These have produced large settlements (e.g., Honeywell, Keysight; and at the scale of Raytheon, hundreds of millions across export portfolios). Lesson: process and proof matter as much as substance. (Global Training Center)
• Courts upholding AECA/ITAR application: Attempts to export defense articles without a license have been sustained on appeal; constitutional challenges rarely help defendants in export cases. While not instructor-specific, they confirm courts back AECA/ITAR’s reach. (Justia Law)
• Defense Distributed litigation: Confirms the government’s position that sharing controlled weapons files online can constitute an export (even as rules and policy lines have shifted). Any online tactics/technical data dissemination deserves a legal review before publication. (Fifth Circuit Court)

What “certified” vs. “licensed” means for ITAR compliance

• “Certified Instructor” (private credential): No legal effect under AECA/ITAR. Certification does not authorize defense services to foreign persons. Plaintiffs/regulators will ignore it if you lack DDTC authorization and records.
• “Licensed/Authorized” under ITAR: Means you have DDTC registration where required and, crucially, an approval (e.g., §120.22(b) authorization or TAA) describing exactly what training you may furnish to whom, where, and how. This is your legal shield. (pmddtc.state.gov)

Action checklist (battle-tested)

1. Map your syllabus to §120.32; stripe modules “public/non-ITAR” vs. “ITAR-controlled.” Document the rationale. (eCFR)
2. Student intake: citizenship/LPR attestation + passport review; check OFAC/§126.1; record dual-nationalities. (eCFR)
3. Facility rules: “no foreign-person access” to ITAR modules without DDTC approval; physical and digital segregation (LMS permissions, watermarked handouts).
4. Authorizations: For overseas teaching to foreign employers, request §120.22(b) authorization (or TAA) before travel; in the U.S., seek authorization if any foreign person will receive ITAR-controlled content. (pmddtc.state.gov)
5. Brokering: If you arrange a third party to deliver defense services or move USML kit, analyze Part 129 and register/license if triggered. (eCFR)
6. Recordkeeping: Keep rosters, nationality screens, agendas, slides, handouts, Q&A logs, and copies of DDTC approvals (DDTC regularly cites §122.5 lapses). (pmddtc.state.gov)
7. Country watch: Maintain an internal §126.1/OFAC matrix and a “red flag” SOP for proscribed destinations/parties; add a hard stop for those cases. (eCFR)
8. EAR overlay: If any hardware crosses borders, run a BIS license analysis (CCL 0A501 et al.) in addition to the ITAR services analysis. Track 2024–2025 BIS changes. (Federal Register)

Consequences of non-compliance (what’s actually happened)

• Civil/administrative: Consent agreements with monitors, multi-million-dollar penalties, and debarment from defense trade for unauthorized defense services/technical data exports and weak controls. (pmddtc.state.gov)
• Criminal: Willful AECA violations (e.g., exporting defense articles/services without a license) have resulted in convictions; appellate courts routinely uphold AECA/ITAR’s application. (Justia Law)

Executive bottom line

• If your class teaches tactics/CQB/defensive employment to foreign persons (here or abroad), presume ITAR defense service and obtain DDTC authorization in advance.
• Certification is marketing; authorization is law. Without DDTC paperwork, your risk is not theoretical.
• Treat screening, scoping, approvals, and records as a competitive advantage: they protect you, your students, and your brand—and they’ll stand up in discovery.

Sources (select)

• ITAR scope & definitions (DDTC/ECFR): ITAR landing page; §120.32 Defense service; Part 124 agreements; Part 129 brokering. (pmddtc.state.gov)
• DDTC guidance for U.S. persons abroad & in U.S.: FAQs on defense services/§120.22(b) and furnishing services to foreign persons inside the U.S. (pmddtc.state.gov)
• Country policies/denials: ITAR §126 (proscribed destinations & policies of denial). (eCFR)
• Hardware transfer to EAR & 2024–2025 BIS changes: USML I–III to CCL brief; BIS 2025 Final Rule; industry explainers. (bis.doc.gov)
• Enforcement/precedent signals: Raytheon press release; Keysight/Honeywell consent-agreement analyses; AECA appellate upholding in United States v. Smith. (Department of Justice)