There is no law or regulation instructing contractors how to mark commercial technical data delivered to the Department of Defense (DoD).[1] Yet the DoD Federal Acquisition Regulation Supplement (DFARS) is quite clear that contractors and their suppliers must mark such data to protect them; if unmarked, the U.S. government and third parties may use and disclose data without restriction, and DoD contracts include a mandatory release of liability for such disclosure.[2]
To date, DoD has declined to prescribe a particular marking for commercial data, part of a “long-standing approach allowing contractor discretion to choose and use its favored restrictive marking, consistent with commercial practices or other contractor preferences.”[3] This helps to avoid the expense and impracticality of reprinting or reproducing—or worse, trying to convince a supplier of commercially available off-the-shelf (COTS) items to reprint or reproduce—the same specifications, manuals, drawings, and other technical data provided to commercial customers, simply to apply the government’s preferred legend.
That changed last month with the Federal Circuit’s decision in FlightSafety.[4] Per the court, any commercial marking that could be read to limit the government’s contractual license rights—by, for example, labeling the data as “Proprietary” or including a standard copyright notice—is prohibited and should be stricken.[5] Defense contractors now must revisit their commercial markings, and those of their suppliers, to ensure the markings are consistent with the court’s decision and the license granted in DFARS 252.227-7015, Technical Data—Commercial Products and Commercial Services (the “-7015 clause”).
Background
At issue in FlightSafety were various markings applied to “OMIT data” related to commercial components installed on virtual flight training systems. To explain what that means, let us first take a step back.
The government’s license rights in technical data delivered under a government contract generally depend on the nature of the data and whether they describe items, components, or processes developed with government funding. By law, contractors may restrict the government’s rights in data related to items or components developed exclusively at private expense.[6] And, by law, there is a presumption that commercial products, like those at issue in FlightSafety, were developed at private expense.[7] But, commercial or not, there are exceptions for certain categories of data in which the government receives broad “unlimited” or “unrestricted” rights. Included among these is a category for data that are necessary for operation, maintenance, installation, or training but that also are not detailed manufacturing or process data, commonly known as “OMIT” data.[8]
The categorical exceptions for OMIT data and others are not intended to undermine a contractor’s trade secrets, but instead apply (primarily) to data that are often provided to consumers and end users without any obligation of confidentiality. For example, you might think of OMIT data like the user’s manual in your car’s glovebox: it includes basic information on how to operate the vehicle (e.g., how to use the windshield wipers), perform routine maintenance (e.g., how often to change the oil), and install various add-on components (e.g., attach a roof rack), and it may contain links to online training videos for all of the above; but it does not include the detailed information required to rebuild the car, manufacture replacement parts, or perform overhaul or depot-level maintenance.
Under the -7015 clause, the government has an “unrestricted right” to “use, modify, reproduce, release, perform, display, or disclose” commercial OMIT data and to “permit others to do so” as well.[9] For other commercial technical data that are neither OMIT data nor another categorical exception, the government’s rights are instead limited to “within the Government only,” and the government is prohibited from using such data for manufacture or releasing the data outside the government except in very limited circumstances. By analogy, with respect to noncommercial technical data, we would say the government has “unlimited rights” in the OMIT data and “limited rights” in the latter (consistent with the commercial presumption of development at private expense) although the ‑7015 clause notably does not adopt these well-known terms or their definitions verbatim.[10]
Marking data appropriately is essential to asserting restrictions on the government’s rights and thus safeguarding a contractor’s intellectual property. Whether commercial or noncommercial, the government generally may use and disclose unmarked data without restriction.[11] For noncommercial technical data, the DFARS goes further and prescribes specific legends the contractor must apply or risk having data returned as nonconforming or stripped of restricted markings altogether.[12] Only those specific legends authorized by the DFARS and a notice of copyright are permissible to restrict the government’s rights in noncommercial data (if not necessarily those of third parties).[13] But the -7015 commercial data rights clause lacks any similar guidance or prescribed marking, nor is one found anywhere else in the DFARS. Which brings us back to FlightSafety.
FlightSafety
The commercial OMIT data at issue in FlightSafety had been marked with a longform and a shortform legend, both of which identified the data as “Proprietary” to FlightSafety. The longform legend expanded this to “confidential and/or proprietary” and added a generic copyright notice – “Copyright © 2014. All rights reserved.” – along with a statement that the data “shall not be reproduced, distributed, or disclosed to others, except as expressly authorized in writing.” When the Air Force rejected these markings, FlightSafety proposed an alternative legend stating the data were “provided to the U.S. Government with unrestricted rights only pursuant to the requirements in [the relevant contracts], the procedures specified in DFARS 252.227-7015 and limited by DFARS 227.7103-1,” which sets out DoD’s policy for acquiring rights in noncommercial technical data.[14]
None of these satisfied the Air Force, which initiated a formal challenge to the markings under the procedures in DFARS 252.227-7037, Validation of Asserted Restrictions on Technical Data, and found the markings impermissible. FlightSafety appealed to the Armed Services Board of Contract Appeals on three counts: (1) the government cannot challenge markings on commercial technical data without evidence of development at government expense; (2) the legends were permissible for commercial technical data; and (3) the drawings at issue were not properly categorized as OMIT data. The parties settled the third count, leaving only the government’s authority to challenge the markings and their propriety under the commercial data rights clause. The Board ruled in the government’s favor on both, and FlightSafety appealed.
It is worth a brief aside to note the Board’s decision in FlightSafety marks the first time the Board has taken jurisdiction over a data rights challenge appeal filed directly by a subcontractor without sponsorship by the prime contractor.[15] This is a straightforward (and good) result of the applicable statute and regulation, but nevertheless has been the source of some confusion for years, due mostly to deep-rooted concepts of privity and the somewhat odd fact that the same laws do not apply to software data rights challenges.[16] The government does not appear to have contested jurisdiction before the Federal Circuit.
On appeal, the Federal Circuit wrestled not only with the text of FlightSafety’s markings, but the scope of the government’s unrestricted rights and its authority to challenge commercial markings in the first place. The court reached three noteworthy holdings:
1. DoD may use – and authorize others to use – “unrestricted” rights data for any purpose, including manufacture.
In defending its restrictive markings, FlightSafety argued the government’s “unrestricted” rights in commercial OMIT data were not, in fact, without restriction; rather, they were limited to “OMIT” purposes—operation, maintenance, installation, and training—and did not permit future manufacture. The court rejected the argument and went even further to conclude there is “no meaningful difference” between the “unrestricted” rights granted in -7015 and “unlimited rights” granted in noncommercial technical data in -7013, which permit use and disclosure “in any manner, and for any purpose whatsoever.” The underlying data rights statute does not require “unrestricted” rights to equal “unlimited” rights, and the regulators’ decision to use different words suggests they may not have meant the same thing. But in practice, contractors should understand the word “unrestricted” to mean just that: there is no restriction on what the government may do, including give the data to competitors for manufacturing or competitive reprocurement. Keep in mind, though, that the categories of data subject to “unrestricted” rights under the -7015 clause should not include detailed manufacturing or process data describing how to manufacture or produce the commercial product.
2. DoD may challenge restrictive markings on commercial technical data on the basis that the data are properly characterized as OMIT data or another category of unrestricted rights data, without producing evidence of development at government expense.
FlightSafety also argued the government could not challenge restrictive markings on commercial technical data unless its challenge was based on evidence of government-funded development, rather than categorical mischaracterization of data. The Federal Circuit disagreed, finding support for categorical challenges in the statutory text and noting that to hold otherwise could “effectively defeat the government’s rights in technical data” by permitting unchecked restriction-by-marking.
The bilaterally executed contract, not one party’s chosen marking, should determine the government’s rights, and the DFARS contemplates formal challenges to asserted restrictions not the particular form of any marking. But there is a practical persuasiveness to the court’s point. Such markings serve as the primary means for informing the government of applicable restrictions, particularly for commercial technical data, and the regulations lack any other clear mechanism for hashing out in writing which data are categorically subject to unrestricted rights and which are protected by the restrictions in ‑7015(c)(2). Still, there are other readily available ways to resolve questions over appliable restrictions without upending a supplier’s standard commercial markings.
The issue demanded lengthy discussion by both the Board and the court. Both concluded the government may, through the formal challenge process, dispute a contractor’s categorization of data as something other than OMIT data or another category of unrestricted rights data. Further, they opened up for scrutiny not only the asserted restrictions themselves but also the commercial markings contractors place on privately developed data.
3. Markings on commercial technical data must reflect the government’s contractual license rights.
The practical impacts of FlightSafety will be felt most in its final holding, that “markings that impair the government’s rights are impermissible” even on commercial technical data. Although there is no legal authority or contract clause prohibiting commercial markings,[17] the Federal Circuit found such markings may “contradict” the “statutory scheme” and the government’s contractual license rights in data if they do not “accurately describe” those rights, are “misleading” or “ambiguous,” or “serve[] to confuse the scope of the government’s rights.”
In particular, the court took issue with FlightSafety’s use of the terms “proprietary” and “confidential” when applied to unrestricted rights data such as OMIT data. It found those words indicate a need to treat with protection and refrain from routinely transmitting data outside the government, in conflict with the government’s unrestricted right to release or disclose such data and permit others to do the same.
The Federal Circuit also rejected FlightSafety’s “all rights reserved” copyright legend. Never mind that a copyright legend is one of the few markings expressly authorized even for noncommercial technical data; without recognizing the government’s copyright license, the court found such notice misleading and thus impermissible. So too was FlightSafety’s general use of the phrase “Rights Reserved” in its shortform legend because it “did not specify which rights were reserved nor which rights were granted.”
Nor was FlightSafety able to overcome these concerns by including general language deferring to the rights granted in the applicable contracts. The qualifier “except as expressly authorized in writing” was no good because, according to the court, it “contemplated individualized written authorization,” not broad authorization by contract license grant. And saying the government had “unrestricted rights only pursuant to the requirements in [the relevant contracts], the procedures specified in DFARS 252.227-7015 and limited by DFARS 227.7103-1” did not work because it failed to specify which part of DFARS 252.227-7015—the government’s unrestricted rights in OMIT data and other categories under -7015(c)(1), or its limited rights in other technical data under -7015(c)(2)—applied to the data being marked.
The Federal Circuit declined to pick up where the DFARS leaves off and suggest a marking it finds acceptable, a brainteaser that now falls to contractors to figure out. The trick is not in finding words that accurately describe the government’s rights under either -7015(c)(1) or -7015(c)(2), but doing so in a way that reserves the contractor’s rights with respect to third parties and balances the substantial effort of extensively portion-marking commercial technical data. It is easy to scrutinize the text of a restrictive legend when imagining a defense contractor starting from a blank page with only the government in mind as a recipient of data. But that is rarely the case for commercial technical data, which are often created and marked long before the government enters the picture.
Take a real-world example. A lower-tier subcontractor on a major weapons program delivers a system that incorporates certain COTS components, which it buys online with a credit card just like anyone else. The subcontractor is contractually obligated to deliver commercially available specifications and manuals for these components, which are also published online and available for download by anyone with an internet connection. Unsurprisingly, these materials are marked with the vendor’s standard copyright legend and a general reservation of rights, even though they are hardly confidential and almost certainly qualify as OMIT data or other unrestricted rights data under the -7015 clause, which is of course incorporated into the subcontractor’s agreement with the prime. Under FlightSafety, the subcontractor must either negotiate an exception (with the prime contractor and potentially the government as well), strip or modify the marking itself (at its own risk), or ask the COTS vendor to do so—that is, if the subcontractor can even figure out who to ask (imagine undertaking the same process with, say, the installation guide for your ceiling fan). If unsuccessful, the subcontractor must decide between contractual noncompliance or replacing the COTS components with something bespoke and almost certainly more expensive. This is hardly an efficient or desirable result, perhaps explaining why DoD regulators have for so long declined to restrict commercial markings.
Recommendations
Going forward, contractors should consider the following when crafting markings for commercial technical data delivered to DoD:
1. Distinguish between restrictions on the government and non-government recipients. The Federal Circuit’s decision in FlightSafety is limited only to markings that restrict the government’s rights in technical data. Restrictions that apply only to third parties without impinging on the government’s rights are still permissible.[18] Be careful though: there is still an open question whether restrictions on third-party rights could be said to impinge on the government’s rights in data subject to “unlimited” or “unrestricted” rights.[19]
2. Avoid terms “Proprietary” or “Confidential” for unrestricted rights data. By the same token, references to Freedom of Information Act (FOIA) Exemption 4 (5 U.S.C. § 552(b)(4)) and the Trade Secrets Act (18 U.S.C. § 1905), which protect proprietary and confidential information from disclosure outside the government, are likely impermissible on unrestricted rights data under FlightSafety. However, these terms and references remain applicable to, and should be applied on, technical data subject to the more limited license granted in ‑7015(b)(2).
3. If including a copyright legend (e.g., “© [Year] [XYZ Company]”), omit the common “all rights reserved” language. U.S. copyright law requires only the symbol © (or word “Copyright” or abbreviation “Copr.”), year of publication, and name of the copyright owner to establish a valid copyright notice. You may continue to include a reservation of rights but only if it expressly acknowledges the government’s rights, whether they are unrestricted or limited in scope.
4. Where possible, portion mark data that are subject to the more limited license in ‑7015(c)(2). It is tempting, for efficiency’s sake, to try drafting a single legend applicable for all commercial technical data, whether OMIT data, another category of unrestricted rights data, or data subject to greater restriction under -7015(c)(2). Such legends, like the alternative proposed and rejected in FlightSafety, invariably rely on broad reference to the contract or ‑7015 clause, passing on to the reader the task of determining which license actually applies. Although as in all things there must be a balancing of practicalities, contractors should create separate legends for unrestricted rights data under -7015(c)(1) and data subject to more limited rights under -7015(c)(2) and, where feasible, portion mark data deliverables accordingly.
[1] For civilian agencies, Federal Acquisition Regulation (FAR) clause 52.227-14 instructs contractors to mark such data with a prescribed “Limited Rights” legend where appropriate.
[2] DFARS 252.227-7015(e).
[3] 87 Fed. Reg. 77680, 77681 (Dec. 19, 2022).
[4] FlightSafety Int’l, Inc. v. Sec’y of the Air Force, No. 2023-1700, 2025 WL 648650 (Fed. Cir. Feb. 28, 2025).
[5] It is worth noting DoD regulators recently proposed to amend the DFARS to implement this very rule by adding a contractual requirement to “ensure that restrictive markings on [commercial] technical data accurately reflect the rights granted to the Government,” 87 Fed. Reg. at 77695, but withdrew the proposal for further consideration following a negative public response, 89 Fed. Reg. 103338 (Dec. 18, 2024).
[6] 10 U.S.C. § 3771(b)(2).
[7] 10 U.S.C. § 3784.
[8] See 10 U.S.C. § 3771(b)(3)(B)–(C).
[9] DFARS 252.227-7015(c)(1)(iv).
[10] See DFARS 252.227-7013(a).
[11] See DFARS 252.227-7013(g)(2); DFARS 252.227-7015(e).
[12] DFARS 252.227-7013(i)(2).
[13] DFARS 252.227-7013(g); see Boeing v. Sec’y of the Air Force, 983 F.3d 1321, 1328 (Fed. Cir. 2020).
[14] DFARS 227.7102-1 sets forth DoD’s more restrictive policy for acquiring rights in commercial technical data, which contains similar and in some respects greater protections for contractors.
[15] FlightSafety Int’l, Inc., ASBCA No. 62659, 23-1 BCA ¶ 38,245 at 185,709 n.8.
[16] See id. (contrasting the Board’s dismissal for lack of jurisdiction in Binghamton Simulator Co., ASBCA No. 59117, 14-1 BCA ¶ 35,715).
[17] This is in stark contrast with the express contractual requirements for marking noncommercial data in -7013(g).
[18] See Boeing, 983 F.3d at 1329.
[19] Boeing, 983 F.3d at 1330; FlightSafety, 2025 WL 648650 at *9.