Category: 
Reader Mike Deal forwarded to me some of the documents filed in the prosecution of Mohammad Alavi, who has been charged with exporting copies of simulation software to Iran in violation of the Iranian Transaction Regulations. The affidavit filed in support of the arrest warrant provides some interesting background to the Alavi case.
According to that affidavit, Alavi was a naturalized U.S. citizen who was born in Tehran. He had worked at the Palo Verde Nuclear Generating Station since 1989 as a software engineer. In the summer of 2006, Alavi requested, and was granted, access to the site of Western Services Corporation in order to obtain a registration key to use Western Services Corporation’s software 3KeyMaster. That software is used, among other things, to simulate operations of power plants, including nuclear plants, fossil fuel plants and co-generation facilities. It is not used to control the actual operation of any power facilities.
Alavi resigned his position at Palo Verde in July 2006. Shortly after Alavi’s last day at Palo Verde, he traveled with his wife to Iran. In October 2006, while Alavi was in Iran, Alavi’s user name and password was used to log onto the Western Services site and download another registration key. The IP Address of the computer that logged on to the Western Services, 84.47.215.172, traced back to an Internet service provider located in Tehran, Iran. Alavi was arrested on his return to the United States on April 9.
The circumstantial case against Alavi, at least as set forth in the affidavit, seems strong. Each computer on which the 3KeyMaster software is downloaded needs a separate registration key for the software to operate. The registration key is generated by the Western Services website based on the serial number of the computer’s hard drive. The only reason for Alavi to log on to the Western Services site while in Iran was to obtain a 3KeyMaster registration key for the computer in Iran from which he logged on.
But Alavi may not be the only one who violated the Iran sanctions here. Western Services, after all, supplied the registration key even though the IP Address to which it supplied the key traced back to Iran. Without the registration key, the software would not continue to work. And a simple reverse DNS look-up by Western Services on the IP Address 84.47.215.172 would show that the computer was located in Iran. Click here to see for yourself.
The issue here is whether providers of Internet services should be required to take steps to determine the location of the computer requesting those services. As we previously noted, Google Earth took such steps to prevent download of the Google Earth software to computers located in Sudan. Should this be done by everyone providing services over the Internet? Did Western Services have an obligation to do a reverse DNS look-up before allowing a user to download a registration key? Let me hear your thoughts on this in the comments.
Permalink 
Feeds
Subscribe