Bailey Reichelt (7:33)

Alice well, some of the news may still be a little bit difficult to swallow, but if you're looking for further information on any of the stories mentioned throughout the show, then head to the Selected Reading section of our Show Notes. There you'll find links to the original sources of all the stories. With more information, we also like to add a few additional stories to the list.

Maria Varmazes (7:52)

Yes, we certainly do. And what do we have today?

Bailey Reichelt (7:54)

ALICE We've included three additional stories today. One on one of the NS32 mission pass just from this weekend's Blue Origin New shepherd launch, another on North Korea apparently withdrawing their ban on the use of space for defense purposes. And the third is on SES's O3B mpower system receiving a Platinum Space Sustainability rating.

Maria Varmazes (8:15)

And a reminder as always, that those links can be found on our website space.n2k.com/t/crew if you would like daily updates from us directly in your LinkedIn feed, be sure to follow the official N2K team minus page over on LinkedIn. And if you're more interested in the lighter side of what we do, here we are T minus daily on Instagram. That's where we post videos and pictures from events, excursions, and even some behind the scenes treats. Links are in the Show Notes. Hope you'll join us there.

Jack Shelton (8:58)

Foreign.

Dave (9:06)

Hey everybody, Dave here. I've talked about Delete Me before and I'm still using it because it still works. It's been a few months now and I'm just as impressed today as I was when I signed up. Delete Me keeps finding and removing my personal information from data broker sites and they keep me updated with detailed reports so I know exactly what's been taken down. I'm genuinely relieved. Knowing my privacy isn't something I have to worry about every day. The Deleteme team handles everything. It's the set it and forget it piece of mind. And it's not just for individuals. Deleteme also offers solutions for businesses, helping companies protect their employees personal information and reduce exposure to social engineering and phishing threats. And right now our listeners get a special deal. 20% off your DeleteMe plan. Just go to JoinDeleteMe.com N2K and use promo code N2K at checkout. That's JoinDeleteMe.com N2k code N2K.

Sponsor Voice (10:15)

Foreign.

Maria Varmazes (10:21)

Space law attorneys Bailey Reichelt and Jack Shelton are here now for our monthly Aegis Space Law segment.

Jack Shelton (10:30)

Welcome back. It's Jack and Bailey talking about space law questions. Bailey, let's talk a little bit about export controls.

Alice Cruz (10:39)

I am always ready to talk about export controls, Jack.

Jack Shelton (10:43)

All right, well, why is this something we should care about at all?

Alice Cruz (10:46)

Yeah, well, if you're a U.S. company or a U.S. person, or you're just in the geographical U.S. you have to care about export controls. They apply to you. The US Government has jurisdiction. And so whether you started your company or you're in grad school, no matter what you're doing, if you're in the U.S. you're a U.S. entity, a U.S. person, export controls apply.

Jack Shelton (11:08)

Or even if you're working with US Origin technology, maybe you're a completely foreign company, but you've got some US origin technology you're developing.

Alice Cruz (11:15)

Oh, yeah, that's an episode for another day. But certainly, yeah, we have extraterritorial export control jurisdiction. So we like to attach export controls to either activities or things that the US Government wants to control, even when it goes abroad. So, yeah, even if you're tuning in from the uk I know everyone thinks aukus means export controls no longer exist, but that's not true. That's not how that works. But yeah, there's a couple things you still have to think about. So it's always worth, if you're in the space industry, knowing a little bit more about US Export controls.

Jack Shelton (11:53)

Well, I know export controls are super complicated and people in good faith make mistakes a lot, but what are some of the penalties that can happen if you make a little boo boo or if you maybe even intentionally do something wrong in violation of the rules?

Alice Cruz (12:08)

Sure. Well, the penalties really run the gamut in range. It can start from everything from warning letters, it can go all the way to consent agreements, or having a monitor assigned to you in house, really depending on a whole bunch of different factors that the government will consider. Like how intentional was the violation, the egregiousness of the violation, like, did you forget that one of your employees was Canadian and accidentally include them in a conversation you shouldn't have? Or did you export a spacecraft to China? I mean, it's really going to make a big difference on what you did. The intentionality, if you should have known better, if you voluntarily told the government Whole bunch of things. There are very specific numbers on what the penalties can be. I generally just tell people in aggregate it can be a million dollars per violation. And yes, I know it gets more specific than that, but it can be big, big numbers.

Jack Shelton (13:10)

Okay, well, let's drill down a little bit into. Let's say that we're working with a space company here in the US and they want to put some sort of set of policies and procedures together so they can actually abide by the rules. Let's talk about some of the important procedures that a company might want to have, particularly focusing on some of the major areas where people make mistakes. What is one area where people make a lot of mistakes, where they really need to focus on their procedures?

Alice Cruz (13:42)

Oh, I would have to go with deemed exports is probably where they make the most mistakes. But I think to give you something useful here, what can companies do to prevent deemed exports? Well, actually, what is a deemed export? A deemed export is the export of technology without authorization to a foreign person here in the United States. So I gave you that example of including the Canadian in the meeting that you weren't supposed to, where you had some sort of design meeting about itar controlled information. That could be a way a deemed export occurs. But what's really dangerous about how deemed exports occurs is there somewhat innocuous everyday situations that you're not thinking about unless you've had specific export training. What are ways that you can prevent these types of innocuous situations from occurring? Well, a compliance program, obviously. What are some aspects of a compliance program? So maybe having physical security. And when I say physical security, I mean where are you putting your physical controlled information? Like where are you putting drawings when you are not in a room, in a meeting? Are you leaving them on the printer? Are you leaving them up on your computer, on your computer screen while someone's walking by on a tour of the facility? Are you screening your visitors as they come in? Are you aware who's foreign when they come through your company? Maybe your owners are foreign. You need to have an understanding of who's authorized within your facility and who isn't and what types of physical controls you need to have on export data, literally just in your workplace. So that's a really easy one to think about putting physical barriers and reminders in place literally in your building.

Jack Shelton (15:37)

Well, let's say that I've got a spacecraft company and we have a foreign person coming from a foreign company. Maybe they're a client of ours and they want to come tour the facility and they want to like, take a look at the clean room where we're putting our spacecraft together, things like that. How do we deal with that?

Alice Cruz (15:55)

So I think the answer everyone dreads is, oh, no, no, no, you can't allow foreign people in the facility. But that's not true. You certainly can have foreign people in your facility. You just have to have a plan, and that might mean finding one. Do they even need a license or authorization to see what it is that you want to show them? They may not. Or if they do need an authorization, you can get an authorization to take someone on a tour, or maybe even an exception will allow you to do that. So don't see export controls as a no. It doesn't always have to be this insurmountable barrier. You don't have to construct ways at loopholes to get around it. You can just get an authorization if you want to bring someone on a tour. But also, a lot of companies will just have a facility security plan where they'll literally have portions of their facility that are all access, their general access. And there'll be a conference room right behind the entrance to the building. And you can bring anyone there. You can have meetings. Of course, you still need a procedure to know what you're going to discuss at a meeting if there's a foreign person. But then you can section them off from the rest of the facility so that you can better control access. So there are ways to deal with this. It could be getting an authorization, it could just be limiting access so that, you know, no one's getting unauthorized access. It's creating visitor screening programs so that you know how far in advance to apply for a license. And it's also like training your employees on hosting procedures so that they know to do these things and how far in advance they need to do these things.

Jack Shelton (17:27)

I've seen some scenarios that sometimes fall outside of what people might normally put into their procedures because they just don't think about them. Once I was visiting one of my clients and I walked up to their facility maybe 20 minutes before our appointment, and I walked in behind a young employee who just let me in the building. And I walked into the building and there was nobody sitting at reception at the time. And so I just walked past reception and I walked right into the facility. And I walked right up to the clean room, and I wanted to see what would happen. So I pulled out my phone and I pretended to record what was happening in the clean room. And there was people everywhere. Nobody stopped me. So I think, you know, you also need to think about some of these things that aren't in the normal everyday course of business and training people and making sure that people are spotting people they don't recognize and saying, hey, what are you doing back here?

Alice Cruz (18:23)

Yeah, you bring up a really good point in that most people, most your employees, they do want to obey the rules, they want to do a good job, they certainly don't want to break the law, but they can only do what they know. And no one starts their career being taught export controls, unfortunately. So you're going to have to teach your employees about export controls and what your procedures are for your particular company. And if it's a visitor policy where everyone either has an employee badge or they're marked as a foreign person or a US person, then that's a policy you need to implement. But then you need to train your staff on it and they need to know if someone's there and they don't have a badge, they should not be in the building at all. They need to be escorted back to the front desk. And that's a really common procedure and best practice that we see a lot of our companies implement. And the company you're talking about has now implemented. I certainly hope so. You'll have to go back eventually and check.

Jack Shelton (19:23)

Well, I did give the compliance manager a really hard time. So let's talk, let's shift gears a little bit and talk about software. One of the issues that I hear a lot is companies wanting to use some cloud based software, let's say Fusion 360 or something like that. They're trying to design something in CAD and they've got some software that's not necessarily storing everything on an on premise server at their office. Instead it's going up into the cloud. What do we need to be concerned about there?

Alice Cruz (19:58)

Yeah, this is a question that comes up all the time. And another one of those areas that's just an innocuous situation that you might not think about without some trouble training. CAD software, Fusion 360 SolidWorks, they're used by everyone all the time. But you have to watch out because a lot of times they're auto uploading data, storing it in a cloud. So is your cell phone. I know you've taken like a thousand pictures of your cat, they're all on a cloud somewhere. Well, if you're taking controlled information photos and a lot of engineers do this just to help them with their, their work within the building. They share it with another engineer who's in a different section. So hey, what do you Think you have to be careful. Information is leaving that device. It's going up to a cloud most likely. And you need to know who has access to that cloud, because if it's a foreign person, then you might have an export violation. Now there are ways you can protect that data. You can encrypt it, you can make sure that the servers are located in the US there's lots of different things you can do, but the first thing you need to do is be thinking about that data and where the data is going and if a foreign person has access to.

Jack Shelton (21:09)

So often we really think about this topic when we're thinking about the software that the company has purchased for a specific thing. But you mentioned something really interesting. You got two engineers working on a project. One of them uses their iPhone to take a picture of something and then text message it to another engineer within the same building. And they're not even thinking, wait a second, I have the Apple whatever it is backup of all my photos going into the cloud somewhere. And Apple is not necessarily making sure that everything is controlled in a certain way. In fact, Apple employees are possibly able to see my photos and see what's going on. We don't know if those are foreign persons or not.

Alice Cruz (21:50)

Yeah, the best way to deal with that is to not allow employees to use personal devices for work applications. We haven't come up with a better way to do that. There's probably some apps out there by now that might like limit to local storage. You can turn off the auto upload to the cloud feature, but really the best practice is just to not allow personal devices to interact with company controlled data.

Jack Shelton (22:16)

Well, there's a million other things to talk about in the export control world and we're running out of time. But anybody, if you'd like to reach out to us to find out more about any particular questions you have, please reach out.

Maria Varmazes (22:42)

We'll be right back.

Sponsor Voice (22:47)

On WhatsApp, no one can see or hear your personal messages. Whether it's a voice call message or sending a password to WhatsApp, it's all just this. So whether you're sharing the streaming password in the family chat, or trading those late night voice messages that could basically become a podcast, your personal messages stay between you, your friends and your family. No one else, not even us. WhatsApp message privately with everyone.

Maria Varmazes (23:19)

Welcome back. Just imagine being the voice of your nation's Space program for 38 years. A gal can dream. And that actually is the real life story of Dr. G. Grihadurai. After 38 stellar years of service. And yes, we did that on purpose. Dr. G. Grahadurai, the Range Operations Director at Sadish Dhawan Space center and the man behind ISRO's iconic launch announcements, has officially signed off for the last time, according to the many posts wishing him well in his retirement, his voice became the heartbeat of every launch, echoing confidence, coordination, and India's growing capabilities in space exploration. His liftoff normal has been heard on repeat from PSLV to Chandrayaan. Dr. Gahadurai leaves behind a legacy that those of us in space can dream to achieve. So from one space voice to another, happy retirement, sir. That's it for T minus for June 2, 2025 brought to you by N2K CyberWire for additional resources from today's report, check out our show notes@spare.n2k.com we'd love to hear from you. We are are conducting our annual audience survey to learn more about our listeners and we're collecting your insights until August 31, 2025. And there's a link in the Show Notes for you. As always, we would love to know what you think of our podcast. Your feedback ensures we deliver the insights that keep you a step ahead in the rapidly changing space industry. If you like our show, please share a rating and review in your podcast app or you can send us an email the space@n2k.com we are privileged that N2K CyberWire is part of the daily routine of the most influential leaders and operators in the public and private sector. From the Fortune 500 to many of the world's preeminent intelligence and law enforcement agencies, N2K makes it easy for companies to optimize your biggest investment your people. We make you smarter about your teams while making your teams smarter. Learn how@n2k.com N2K Senior Producer is Alice Carruth. Our producer is Liz Stokes. We are mixed by Elliot Peltzman and Trey Hester with original music by Elliot Peltzman. Our Executive producer is Jennifer Ibin. Peter Kilpe is our publisher and I am your host, Maria Varmazes. Thanks for listening. We'll see you tomorrow. T.

Dave (26:13)

And now a word from our sponsor. Spy Cloud Identity is the new battleground and attackers are exploiting stolen identities to infiltrate your organization. Traditional defenses can't keep up. Spy Cloud's Holistic Identity Threat Protection helps security teams uncover and automatically remediate hidden exposures across your users from breaches, malware and phishing to neutralize identity based threats like account takeover, fraud and ransomware. Don't let invisible threats compromise your business. Get your free corporate darknet exposure report@spycloud.com cyberwire and see what attackers already know. That's spycloud.com cyberwire.