Software, Source Code & Encryption
Overview
Software and source code are routinely developed, acquired, modified, shared, and used throughout the research lifecycle. In most cases, research software may be used and shared without additional research security or export control requirements.
However, depending on the software, source code, encryption capabilities, recipient, intended use, sponsor requirements, or other project-specific circumstances, additional research security, export control, contractual, or information protection requirements may apply.
The Office of Research Security (ORS) assists researchers in identifying when software, source code, or encryption technologies may be subject to research security or export control requirements.
REQUEST AN EXPORT CONTROL REVIEW
Contact ORS Before You
Contact ORS before you:
- Share software or source code with collaborators outside the United States when export control or sponsor requirements may apply.
- Develop, acquire, or use software incorporating advanced encryption technologies that may be subject to export control regulations.
- Develop or use specialized cybersecurity software or technologies that may be subject to export control regulations.
- Transfer software or source code internationally by electronic transmission, cloud services, downloads, or other means.
- Are uncertain whether research security, export control, sponsor, or contractual requirements apply.
Key Considerations
Software and source code are frequently shared with collaborators, sponsors, companies, and other research partners. Before sharing software or source code, researchers should determine whether sponsor requirements, contractual restrictions, export control regulations, or other research security considerations apply.
Researchers should also consider whether software contains proprietary information, controlled technology, or other information that may not be shared without authorization.
Providing software or source code to recipients outside the United States—including through email, cloud-based collaboration platforms, remote access, downloads, or other electronic means—may be subject to U.S. export control regulations.
Researchers should contact ORS before transferring software or source code internationally when they are uncertain whether export control, sponsor, contractual, or other research security requirements apply.
Software or source code received from sponsors, collaborators, companies, or other external organizations may be subject to license agreements, confidentiality obligations, publication restrictions, or other contractual requirements.
Researchers should review applicable agreements before using, modifying, distributing, or sharing proprietary software or source code.
Software or source code that is published, publicly available, or released as open source may be treated differently under U.S. export control regulations than proprietary or restricted software.
However, researchers should not assume that software is outside export control requirements solely because it is intended for publication or distributed under an open-source license. Encryption functionality, sponsor restrictions, contractual requirements, or other circumstances may still require review.
Contact ORS if you are uncertain whether software or source code qualifies as publicly available for export control purposes.
Certain encryption technologies, cybersecurity software, and related technologies are subject to specialized U.S. export control regulations.
Because these regulations are highly technical and depend on the capabilities of the software, the intended use, the recipient, and other project-specific circumstances, researchers should consult ORS whenever projects involve advanced encryption technologies or specialized cybersecurity capabilities.
Much software developed at Stony Brook University in support of research may be developed, used, published, and shared without additional export control requirements.
However, software developed under sponsor restrictions, involving controlled technology, incorporating specialized encryption capabilities, or intended for certain military, defense, intelligence, or other controlled applications may require additional review.
Researchers should consult ORS whenever they are uncertain whether software developed as part of a research project may be subject to export control or other research security requirements.
Related Guidance
| Related Guidance | Description |
|---|---|
| Sharing Research Information | Guidance for sharing research information, data, software, technology, technical information, presentations, publications, or other research outputs with collaborators, sponsors, companies, government agencies, or other third parties. |
| Publicly Available Information | Learn when publicly available information is excluded from export control requirements and when additional restrictions may still apply. |
| International Transfers (Shipments, Hand-Carry & Electronic Transmissions) | Guidance for shipping, mailing, hand-carrying, or electronically transferring research equipment, materials, software, technology, technical information, or research information internationally. |
| Working with Proprietary & Confidential Research Information | Guidance for receiving, accessing, using, storing, sharing, and protecting proprietary or confidential research information received from sponsors, collaborators, companies, universities, and other external organizations. |
| Sponsor & Agreement Requirements | Guidance for reviewing and complying with research security, export control, information protection, publication, and other project-specific requirements contained in sponsor solicitations, award terms, and research agreements. |
| Deemed Exports | Learn when releasing controlled technology or source code to a foreign person within the United States may constitute a deemed export. |
| Export Control Classification | Learn how equipment, materials, software, technology, and technical information are classified under U.S. export control regulations. |
Frequently Asked Questions
Does all research software require review by ORS?
No. Most research software does not require review by ORS. Additional review is generally appropriate only when export control regulations, sponsor requirements, contractual restrictions, or other research security considerations apply.
Can I share software or source code with collaborators?
Usually. However, researchers should first determine whether export control regulations, sponsor requirements, contractual obligations, software licenses, or confidentiality restrictions apply.
Does electronically sending software outside the United States count as an export?
It may. Electronic transmission or provision of access to software or source code outside the United States can constitute an export depending on the software, recipient, destination, and applicable regulations.
Are encryption technologies subject to export controls?
Certain encryption technologies are subject to specialized export control regulations. Researchers should contact ORS whenever software incorporates advanced encryption capabilities or when they are uncertain whether export control requirements apply.
Need Assistance?
Contact ORS when software, source code, encryption technologies, proprietary software, international transfers, or sponsor-specific restrictions may create export control or other research security-related requirements.