The Context
The arithmetic is brutal. Former U.S. Air Force Major Gerald Eddie “Runner” Brown Jr. faces up to 20 years’ imprisonment and a $1,000,000 fine per count under the Arms Export Control Act. The charge: training Chinese military pilots without a licence. The DOJ alleges he travelled to China in December 2023, remained until February 2024, and used a convicted Chinese hacker as his broker. This is not an accident. It is a deliberate, monetised transfer of classified tactical knowledge. For a board of a defence contractor, simulator firm, or aviation consultancy, this case is a spreadsheet of unmanaged risk: the value of a single ex-pilot’s knowledge, the cost of a missing licence, and the penalty for a governance gap.
The Risk
Directors should calculate their exposure precisely. Under the Arms Export Control Act (22 U.S.C. § 2778(c)), “any person who willfully violates any provision of this section… shall upon conviction be fined for each violation not more than $1,000,000 or imprisoned not more than 20 years, or both.” The term “any person” includes corporate officers and directors. If a board approves or tolerates a business model that monetises ex-military tactical knowledge for foreign clients without robust export controls, they risk being characterised as having “caused or permitted” a violation. The DOJ’s language in this case is explicit: Brown allegedly “betrayed his country by training Chinese pilots to fight against those he swore to protect.” That is not a regulatory fine. That is a criminal narrative. For a director, the personal liability hook is not merely financial—it is a permanent debarment from any entity engaged in controlled technology. The ITAR (22 C.F.R. § 127.1) allows for individual debarment. That ends a career. The fiduciary duty under New Zealand’s Companies Act 1993 (section 135) similarly requires directors to avoid reckless trading and to ensure proper oversight of material risks. Export controls are a material risk. Ignoring them is a breach of duty.
The Control
The solution is not a policy document. It is a closed-loop audit. Every ex-military employee or contractor with access to tactical knowledge must have a signed, board-approved export-control agreement. Their consulting engagements must be screened against the ITAR’s definition of “defense services” (22 C.F.R. § 120.9). Any foreign client must be vetted for military end-use. The board must receive quarterly reports on all such engagements, including the dollar value and the jurisdiction. If a director cannot trace the revenue from a training contract to a licensed, authorised end-user, they are carrying unhedged risk. The cost of a compliance system is negligible compared to $1,000,000 per count and 20 years in prison.
The Challenge
These are the critical questions you should be raising at the board table:
| Can you trace the end-user of every defence service contract your company has entered in the last 24 months? If not, what is the dollar value of the unverified revenue? | |
| Do your compliance systems flag any engagement—whether through a broker, intermediary, or subsidiary—that involves a foreign military, especially a designated adversary? If not, why is that gap acceptable? | |
| If a director were individually debarred from defence work tomorrow, what is the financial and reputational impact on your board? Have you modelled that scenario? |