bmad-plus 0.7.5 → 0.9.0

package/src/bmad-plus/packs/pack-shield/references/itar/usml-categories.md

@@ -1,93 +1,93 @@
-# USML Categories — United States Munitions List (22 CFR § 121.1)
-
-The USML consists of 21 categories. Items **specifically enumerated** here are ITAR-controlled as defense articles.
-
----
-
-## Category I — Firearms, Close Assault Weapons and Combat Shotguns
-Firearms with calibre ≤ 20mm; rifles, carbines, pistols, revolvers, shotguns intended for military use; suppressors; bayonets.
-
-## Category II — Guns and Armament
-Guns, howitzers, cannons >20mm; mortars; recoilless rifles; flamethrowers (military); launch tubes.
-
-## Category III — Ammunition/Ordnance
-Ammunition for items in Cat I/II; military explosives and propellants; military pyrotechnics; guided projectiles.
-
-## Category IV — Launch Vehicles, Guided Missiles, Ballistic Missiles, Rockets, Torpedoes, Bombs and Mines
-All military rockets, missiles, bombs, torpedoes, depth charges, land mines; space launch vehicles used for military purposes; re-entry vehicles.
-
-## Category V — Explosives and Energetic Materials, Propellants, Incendiary Agents and their Precursors
-Military explosives and fuels (e.g., PETN, RDX, HMX, TATB); incendiary agents; smoke/obscurant materials specifically designed for military use.
-
-## Category VI — Vessels of War and Special Naval Equipment
-Warships (surface and submarine); armed vessels; military SCUBA and underwater breathing devices; naval nuclear reactors.
-
-## Category VII — Tanks and Military Vehicles
-Tanks; armoured combat vehicles; military tactical vehicles; mine-clearing vehicles; military bridges.
-
-## Category VIII — Aircraft and Associated Equipment
-Military aircraft (manned and unmanned) — fighters, bombers, attack, patrol, transport; military aero-engines; related airframes; certain civil aircraft modified for military use; military life support systems.
-
-## Category IX — Military Training Equipment
-Flight simulators; parachutes (military); military survival equipment; training aircraft simulators.
-
-## Category X — Protective Personnel Equipment and Shelters
-Body armour (beyond NIJ Level III+); combat helmets; NBC protective suits; military nuclear/biological/chemical detection equipment.
-
-## Category XI — Military Electronics
-Military electronic systems: radar (military); jamming equipment; IFF (Identification Friend or Foe); military navigation; electronic warfare (EW); targeting systems; military cryptographic equipment (see also Cat XIII).
-
-## Category XII — Fire Control, Range Finder, Optical and Guidance and Control Equipment
-Military targeting optics; laser rangefinders (military); infrared imaging (military); night-vision devices (NVDs); military gyroscopes; fire control computers.
-
-## Category XIII — Auxiliary Military Equipment
-Chemical/biological agents (listed); military nuclear materials; depleted uranium; military explosives detection; military training devices; TEMPEST/emissions security equipment; cryptographic items not in Cat XI.
-
-## Category XIV — Toxicological Agents, Including Chemical Agents, Biological Agents, and Associated Equipment
-Schedule 1, 2, 3 chemical weapons agents and precursors (CWC Schedules applied to USML); biological agents suitable for weaponisation; medical countermeasures (military).
-
-## Category XV — Spacecraft Systems and Associated Equipment
-Military satellites; spacecraft systems for intelligence, surveillance, reconnaissance (ISR); directed energy weapons in space; associated ground control equipment.
-
-## Category XVI — Nuclear Weapons, Design and Testing Related Items
-Nuclear weapons; nuclear weapon design and testing software; all items primarily useful for nuclear weapons development.
-
-## Category XVII — Classified Articles, Technical Data and Defense Services Not Otherwise Enumerated
-Catch-all for classified items. No exports without prior DDTC authorisation.
-
-## Category XVIII — Directed Energy Weapons
-High-energy lasers (military); particle beam weapons; high-power radio frequency (HPM) weapons.
-
-## Category XIX — Gas Turbine Engines and Associated Equipment
-Military gas turbine engines for aircraft/vessels/vehicles; hot section components; military engine test equipment.
-
-## Category XX — Submersible Vessels, Oceanographic and Associated Equipment
-Military submarines; autonomous underwater vehicles (military); deep-submergence rescue vehicles; military sonar.
-
-## Category XXI — Articles, Technical Data and Defense Services Not Otherwise Enumerated
-Catch-all for items not covered by Cat I–XX that are determined to provide critical military/intelligence advantage. Used sparingly via CJ determination.
-
----
-
-## Key Definitions
-
-**Defense article** (22 CFR § 120.31): Any item or technical data designated on the USML.
-
-**Defense service** (22 CFR § 120.32): Furnishing assistance (training, technical data, engineering) to a foreign person for the design, manufacture, production, operation, maintenance, or modification of defense articles.
-
-**Technical data** (22 CFR § 120.33): Information directly related to defense articles in any tangible form — blueprints, drawings, specifications, software source code, test reports.
-
-**Specially designed** (22 CFR § 120.41): The primary test for whether a component or part falls under ITAR. An item is specially designed if it was developed, configured, or adapted to provide a critical performance parameter enabling the military capability of a USML end-item.
-
----
-
-## USML vs CCL Jurisdiction Tips
-
-| Scenario | Likely Jurisdiction |
-|----------|-------------------|
-| Item specifically listed in USML (Cat I–XXI) | ITAR |
-| Item removed from USML via Export Control Reform | EAR (often ECCN 0Yxxx) |
-| Commercial item with no military application | EAR / EAR99 |
-| Ambiguous — file a Commodity Jurisdiction (CJ) request | DDTC determines |
-
-A **Commodity Jurisdiction (CJ)** determination (22 CFR § 120.4) is the official process to obtain DDTC's ruling on whether an item is on the USML. Submit via DDTC's online portal with item description, specifications, and intended use.
+# USML Categories — United States Munitions List (22 CFR § 121.1)
+
+The USML consists of 21 categories. Items **specifically enumerated** here are ITAR-controlled as defense articles.
+
+---
+
+## Category I — Firearms, Close Assault Weapons and Combat Shotguns
+Firearms with calibre ≤ 20mm; rifles, carbines, pistols, revolvers, shotguns intended for military use; suppressors; bayonets.
+
+## Category II — Guns and Armament
+Guns, howitzers, cannons >20mm; mortars; recoilless rifles; flamethrowers (military); launch tubes.
+
+## Category III — Ammunition/Ordnance
+Ammunition for items in Cat I/II; military explosives and propellants; military pyrotechnics; guided projectiles.
+
+## Category IV — Launch Vehicles, Guided Missiles, Ballistic Missiles, Rockets, Torpedoes, Bombs and Mines
+All military rockets, missiles, bombs, torpedoes, depth charges, land mines; space launch vehicles used for military purposes; re-entry vehicles.
+
+## Category V — Explosives and Energetic Materials, Propellants, Incendiary Agents and their Precursors
+Military explosives and fuels (e.g., PETN, RDX, HMX, TATB); incendiary agents; smoke/obscurant materials specifically designed for military use.
+
+## Category VI — Vessels of War and Special Naval Equipment
+Warships (surface and submarine); armed vessels; military SCUBA and underwater breathing devices; naval nuclear reactors.
+
+## Category VII — Tanks and Military Vehicles
+Tanks; armoured combat vehicles; military tactical vehicles; mine-clearing vehicles; military bridges.
+
+## Category VIII — Aircraft and Associated Equipment
+Military aircraft (manned and unmanned) — fighters, bombers, attack, patrol, transport; military aero-engines; related airframes; certain civil aircraft modified for military use; military life support systems.
+
+## Category IX — Military Training Equipment
+Flight simulators; parachutes (military); military survival equipment; training aircraft simulators.
+
+## Category X — Protective Personnel Equipment and Shelters
+Body armour (beyond NIJ Level III+); combat helmets; NBC protective suits; military nuclear/biological/chemical detection equipment.
+
+## Category XI — Military Electronics
+Military electronic systems: radar (military); jamming equipment; IFF (Identification Friend or Foe); military navigation; electronic warfare (EW); targeting systems; military cryptographic equipment (see also Cat XIII).
+
+## Category XII — Fire Control, Range Finder, Optical and Guidance and Control Equipment
+Military targeting optics; laser rangefinders (military); infrared imaging (military); night-vision devices (NVDs); military gyroscopes; fire control computers.
+
+## Category XIII — Auxiliary Military Equipment
+Chemical/biological agents (listed); military nuclear materials; depleted uranium; military explosives detection; military training devices; TEMPEST/emissions security equipment; cryptographic items not in Cat XI.
+
+## Category XIV — Toxicological Agents, Including Chemical Agents, Biological Agents, and Associated Equipment
+Schedule 1, 2, 3 chemical weapons agents and precursors (CWC Schedules applied to USML); biological agents suitable for weaponisation; medical countermeasures (military).
+
+## Category XV — Spacecraft Systems and Associated Equipment
+Military satellites; spacecraft systems for intelligence, surveillance, reconnaissance (ISR); directed energy weapons in space; associated ground control equipment.
+
+## Category XVI — Nuclear Weapons, Design and Testing Related Items
+Nuclear weapons; nuclear weapon design and testing software; all items primarily useful for nuclear weapons development.
+
+## Category XVII — Classified Articles, Technical Data and Defense Services Not Otherwise Enumerated
+Catch-all for classified items. No exports without prior DDTC authorisation.
+
+## Category XVIII — Directed Energy Weapons
+High-energy lasers (military); particle beam weapons; high-power radio frequency (HPM) weapons.
+
+## Category XIX — Gas Turbine Engines and Associated Equipment
+Military gas turbine engines for aircraft/vessels/vehicles; hot section components; military engine test equipment.
+
+## Category XX — Submersible Vessels, Oceanographic and Associated Equipment
+Military submarines; autonomous underwater vehicles (military); deep-submergence rescue vehicles; military sonar.
+
+## Category XXI — Articles, Technical Data and Defense Services Not Otherwise Enumerated
+Catch-all for items not covered by Cat I–XX that are determined to provide critical military/intelligence advantage. Used sparingly via CJ determination.
+
+---
+
+## Key Definitions
+
+**Defense article** (22 CFR § 120.31): Any item or technical data designated on the USML.
+
+**Defense service** (22 CFR § 120.32): Furnishing assistance (training, technical data, engineering) to a foreign person for the design, manufacture, production, operation, maintenance, or modification of defense articles.
+
+**Technical data** (22 CFR § 120.33): Information directly related to defense articles in any tangible form — blueprints, drawings, specifications, software source code, test reports.
+
+**Specially designed** (22 CFR § 120.41): The primary test for whether a component or part falls under ITAR. An item is specially designed if it was developed, configured, or adapted to provide a critical performance parameter enabling the military capability of a USML end-item.
+
+---
+
+## USML vs CCL Jurisdiction Tips
+
+| Scenario | Likely Jurisdiction |
+|----------|-------------------|
+| Item specifically listed in USML (Cat I–XXI) | ITAR |
+| Item removed from USML via Export Control Reform | EAR (often ECCN 0Yxxx) |
+| Commercial item with no military application | EAR / EAR99 |
+| Ambiguous — file a Commodity Jurisdiction (CJ) request | DDTC determines |
+
+A **Commodity Jurisdiction (CJ)** determination (22 CFR § 120.4) is the official process to obtain DDTC's ruling on whether an item is on the USML. Submit via DDTC's online portal with item description, specifications, and intended use.

package/src/bmad-plus/packs/pack-shield/references/lgpd/anpd-enforcement.md

@@ -1,147 +1,147 @@
-# ANPD Enforcement Reference
-
-## Autoridade Nacional de Proteção de Dados (ANPD)
-
-Brazil's national data protection authority, established by Law 13,853/2019 as part of the federal government, with technical and decisional autonomy.
-
-**Website:** https://www.gov.br/anpd/pt-br  
-**Contact:** anpd@anpd.gov.br
-
----
-
-## ANPD Organisational Structure
-
-- **Board of Directors (Conselho Diretor):** 5 directors appointed by the President of Brazil; 4-year staggered terms
-- **National Council for Personal Data and Privacy Protection (CNPD):** Advisory body; civil society, government, and expert representatives
-- **Internal Structure:** Departments for enforcement, regulation, international affairs, communications
-
----
-
-## Enforcement Process
-
-### Phase 1 — Preliminary Investigation (Processo Administrativo Preliminar)
-1. ANPD receives complaint, monitoring signal, or self-initiated referral
-2. Preliminary investigation to determine whether to open formal proceedings
-3. Duration: typically 60 days (extendable)
-4. Controller/processor may be contacted for information
-
-### Phase 2 — Administrative Investigation (Processo Administrativo Sancionador)
-1. Formal notice to accused party
-2. Right of defence: 15 business days to present response
-3. Evidence gathering, hearings if necessary
-4. Reporting officer prepares draft decision
-5. Board votes on decision
-6. Final administrative decision issued
-
-### Phase 3 — Appeal
-1. Decision may be appealed internally to ANPD Board within 10 business days
-2. After ANPD appeal: judicial review available in Federal District courts
-
-### Timelines
-- **Prescription:** 5 years from when ANPD becomes aware (Art. 54)
-- **Complaint response:** ANPD aims to respond to complaints within 30 days (varies in practice)
-
----
-
-## Penalty Calculation Methodology
-
-### Simple Fine (Art. 52, II)
-**Cap:** Lesser of 2% of Brazilian revenue (prior FY) or R$50,000,000 per violation.
-
-**For groups of companies:** 2% of group's Brazilian revenue.
-
-**Factors considered (Art. 52, §1º):**
-
-| Factor | Impact |
-|--------|--------|
-| Gravity and nature of violation | Higher gravity → higher fine |
-| Data subjects' good faith | Mitigating |
-| Advantage gained from violation | Higher advantage → higher fine |
-| Conditions of controller (size, economic position) | Proportionality |
-| Recidivism | Aggravating |
-| Degree of damage | Higher damage → higher fine |
-| Cooperation with investigation | Mitigating |
-| Good faith and internal controls | Mitigating |
-| Promptness of corrective measures | Mitigating |
-| Proportionality and necessity | Baseline consideration |
-
-### Daily Fine (Art. 52, III)
-Daily accrual to compel compliance; same R$50M cap per violation.
-
-### Multiple Violations
-Each violation may be treated separately. Multiple fines may be stacked.
-
----
-
-## Enforcement Priorities (ANPD Strategic Agenda)
-
-ANPD has indicated priority focus areas:
-1. **Large-scale data breaches** — incidents affecting many Brazilians
-2. **Sensitive data processing without legal basis** — health, biometric, financial
-3. **Children's data** — processing without verifiable parental consent
-4. **International transfers** — to countries without adequate protection
-5. **Failure to respond to data subject rights** — especially access and deletion
-6. **Lack of DPO appointment** for controllers required to appoint
-
----
-
-## Notable ANPD Enforcement Actions
-
-### Telemarketing / Call Centre Sector (2023)
-ANPD investigated multiple companies for unlawful processing of personal data for telemarketing without adequate legal basis. Issued warnings and remediation orders.
-
-### Health Sector Data Sharing (2022–2023)
-ANPD investigated sharing of health data (sensitive data) with third parties without express consent. Issued compliance orders.
-
-### Large-Scale Data Breach Investigations
-ANPD has opened investigations following major data leaks affecting millions of Brazilian CPF (taxpayer ID) numbers. Status of fines pending as of 2025.
-
-### Clarification Orders
-ANPD has issued numerous "Comunicados" and "Notas de Esclarecimento" setting expectations for sectors on specific topics (facial recognition, cookies, employee monitoring).
-
----
-
-## Cooperation with Other Authorities
-
-### Brazilian Authorities
-- **SENACON (Secretaria Nacional do Consumidor):** Consumer protection — joint enforcement on matters affecting consumers
-- **CADE (Conselho Administrativo de Defesa Econômica):** Competition — data and market power interactions
-- **Banco Central:** Financial data oversight
-- **ANS/ANVISA:** Health sector data
-
-### International Cooperation
-ANPD has signed MoUs with:
-- Portuguese DPA (CNPD — Portugal)
-- Uruguayan authority (URCDP)
-- CNIL (France)
-- UK ICO
-- Ibero-American Data Protection Network (RIPD)
-
-ANPD participates in Global Privacy Assembly (GPA).
-
----
-
-## Complaint Filing Process
-
-Data subjects may file complaints with ANPD at: https://www.gov.br/anpd/pt-br/assuntos/peticoes
-
-**Required information:**
-- Identity of data subject (CPF required for Brazilian residents)
-- Identity of controller (CNPJ/name)
-- Description of alleged violation
-- Evidence where available
-- Rights already exercised with the controller
-
-**ANPD first refers complaint to controller** (gives opportunity to resolve); escalates to investigation if unresolved.
-
----
-
-## LGPD vs. Other Brazilian Law Obligations
-
-| Law | Interaction with LGPD |
-|-----|----------------------|
-| Consumer Defence Code (CDC) | LGPD supplements CDC for data; CDC remedies still apply |
-| Marco Civil da Internet (MCI) | MCI governs internet intermediaries; LGPD applies to personal data |
-| LGPD for financial sector | Central Bank regulations + LGPD | 
-| Health Sector | ANVISA/ANS rules + LGPD (stricter for health/sensitive data) |
-| Credit reporting (Cadastro Positivo) | Art. 7, X — specific legal basis for credit protection |
+# ANPD Enforcement Reference
+
+## Autoridade Nacional de Proteção de Dados (ANPD)
+
+Brazil's national data protection authority, established by Law 13,853/2019 as part of the federal government, with technical and decisional autonomy.
+
+**Website:** https://www.gov.br/anpd/pt-br  
+**Contact:** anpd@anpd.gov.br
+
+---
+
+## ANPD Organisational Structure
+
+- **Board of Directors (Conselho Diretor):** 5 directors appointed by the President of Brazil; 4-year staggered terms
+- **National Council for Personal Data and Privacy Protection (CNPD):** Advisory body; civil society, government, and expert representatives
+- **Internal Structure:** Departments for enforcement, regulation, international affairs, communications
+
+---
+
+## Enforcement Process
+
+### Phase 1 — Preliminary Investigation (Processo Administrativo Preliminar)
+1. ANPD receives complaint, monitoring signal, or self-initiated referral
+2. Preliminary investigation to determine whether to open formal proceedings
+3. Duration: typically 60 days (extendable)
+4. Controller/processor may be contacted for information
+
+### Phase 2 — Administrative Investigation (Processo Administrativo Sancionador)
+1. Formal notice to accused party
+2. Right of defence: 15 business days to present response
+3. Evidence gathering, hearings if necessary
+4. Reporting officer prepares draft decision
+5. Board votes on decision
+6. Final administrative decision issued
+
+### Phase 3 — Appeal
+1. Decision may be appealed internally to ANPD Board within 10 business days
+2. After ANPD appeal: judicial review available in Federal District courts
+
+### Timelines
+- **Prescription:** 5 years from when ANPD becomes aware (Art. 54)
+- **Complaint response:** ANPD aims to respond to complaints within 30 days (varies in practice)
+
+---
+
+## Penalty Calculation Methodology
+
+### Simple Fine (Art. 52, II)
+**Cap:** Lesser of 2% of Brazilian revenue (prior FY) or R$50,000,000 per violation.
+
+**For groups of companies:** 2% of group's Brazilian revenue.
+
+**Factors considered (Art. 52, §1º):**
+
+| Factor | Impact |
+|--------|--------|
+| Gravity and nature of violation | Higher gravity → higher fine |
+| Data subjects' good faith | Mitigating |
+| Advantage gained from violation | Higher advantage → higher fine |
+| Conditions of controller (size, economic position) | Proportionality |
+| Recidivism | Aggravating |
+| Degree of damage | Higher damage → higher fine |
+| Cooperation with investigation | Mitigating |
+| Good faith and internal controls | Mitigating |
+| Promptness of corrective measures | Mitigating |
+| Proportionality and necessity | Baseline consideration |
+
+### Daily Fine (Art. 52, III)
+Daily accrual to compel compliance; same R$50M cap per violation.
+
+### Multiple Violations
+Each violation may be treated separately. Multiple fines may be stacked.
+
+---
+
+## Enforcement Priorities (ANPD Strategic Agenda)
+
+ANPD has indicated priority focus areas:
+1. **Large-scale data breaches** — incidents affecting many Brazilians
+2. **Sensitive data processing without legal basis** — health, biometric, financial
+3. **Children's data** — processing without verifiable parental consent
+4. **International transfers** — to countries without adequate protection
+5. **Failure to respond to data subject rights** — especially access and deletion
+6. **Lack of DPO appointment** for controllers required to appoint
+
+---
+
+## Notable ANPD Enforcement Actions
+
+### Telemarketing / Call Centre Sector (2023)
+ANPD investigated multiple companies for unlawful processing of personal data for telemarketing without adequate legal basis. Issued warnings and remediation orders.
+
+### Health Sector Data Sharing (2022–2023)
+ANPD investigated sharing of health data (sensitive data) with third parties without express consent. Issued compliance orders.
+
+### Large-Scale Data Breach Investigations
+ANPD has opened investigations following major data leaks affecting millions of Brazilian CPF (taxpayer ID) numbers. Status of fines pending as of 2025.
+
+### Clarification Orders
+ANPD has issued numerous "Comunicados" and "Notas de Esclarecimento" setting expectations for sectors on specific topics (facial recognition, cookies, employee monitoring).
+
+---
+
+## Cooperation with Other Authorities
+
+### Brazilian Authorities
+- **SENACON (Secretaria Nacional do Consumidor):** Consumer protection — joint enforcement on matters affecting consumers
+- **CADE (Conselho Administrativo de Defesa Econômica):** Competition — data and market power interactions
+- **Banco Central:** Financial data oversight
+- **ANS/ANVISA:** Health sector data
+
+### International Cooperation
+ANPD has signed MoUs with:
+- Portuguese DPA (CNPD — Portugal)
+- Uruguayan authority (URCDP)
+- CNIL (France)
+- UK ICO
+- Ibero-American Data Protection Network (RIPD)
+
+ANPD participates in Global Privacy Assembly (GPA).
+
+---
+
+## Complaint Filing Process
+
+Data subjects may file complaints with ANPD at: https://www.gov.br/anpd/pt-br/assuntos/peticoes
+
+**Required information:**
+- Identity of data subject (CPF required for Brazilian residents)
+- Identity of controller (CNPJ/name)
+- Description of alleged violation
+- Evidence where available
+- Rights already exercised with the controller
+
+**ANPD first refers complaint to controller** (gives opportunity to resolve); escalates to investigation if unresolved.
+
+---
+
+## LGPD vs. Other Brazilian Law Obligations
+
+| Law | Interaction with LGPD |
+|-----|----------------------|
+| Consumer Defence Code (CDC) | LGPD supplements CDC for data; CDC remedies still apply |
+| Marco Civil da Internet (MCI) | MCI governs internet intermediaries; LGPD applies to personal data |
+| LGPD for financial sector | Central Bank regulations + LGPD | 
+| Health Sector | ANVISA/ANS rules + LGPD (stricter for health/sensitive data) |
+| Credit reporting (Cadastro Positivo) | Art. 7, X — specific legal basis for credit protection |