Jan

28

Fun BIS Fact: Companies May Actually Know What They Don’t Know


Posted by at 3:41 pm on January 28, 2014
Category: BISCriminal Penalties

Amplifier Research HQ Street View from Google http://www.google.com/permissions/geoguidelines/attr-guide.html [By Permission]
ABOVE: Amplifier Research HQ


There seems to be a recent plague of rogue export control managers with a penchant for forging licenses, making up authorizations, fudging exemptions and exceptions and engaging in other nefarious practices in order to avoid having to do any actual work while on the job they are being paid for. First it was LeAnne Lesmeister who specialized in photoshopping fake export licenses. Now we have Timothy Gormley at Amplifier Research Corporation who among other things falsified paperwork to conceal correct export classifications, listed fake license numbers on export documentation, authorized exports before license applications were granted and lied to other employees at the company about the existence of required export licenses.

The BIS settlement documents assert that Amplifier Research never conducted any compliance audits during the time that Gormley was running the export show. BIS imposed a $500,000 suspended fine on Amplifier Research to settle the violations and required the company to conduct a complete export compliance audit. A federal judge awarded Gormley a 42-month vacation in a federal correctional facility.

This all seems pretty routine until you get to the last count against the Company in which BIS charges Amplifier Research with “acting with knowledge” of the illegal exports at issue. The Export Administration Regulations define knowledge as follows:

Knowledge of a circumstance (the term may be a variant, such as “know,” “reason to know,” or “reason to believe”) includes not only positive knowledge that the circumstance exists or is substantially certain to occur, but also an awareness of a high probability of its existence or future occurrence. Such awareness is inferred from evidence of the conscious disregard of facts known to a person and is also inferred from a person’s willful avoidance of facts.

Neither this definition of knowledge, nor section 764.2 of the EAR, addresses when a company knows something. Additionally, neither addresses the issue as to whether the knowledge of each and every employee can be imputed to the company for purposes of “acting with knowledge” violations under section 764.2. Certainly, Gormley can be said to have acted with knowledge, but should the company also be said to have acted with knowledge unless senior management had “knowledge” as defined above of Gormley’s actions? Certainly those standards of knowledge would not be met simply because the company failed to conduct a compliance audit on Gormley and the export program. Rather, it seems to me, there would need to some red flags that senior management ignored and there is no evidence or assertion by BIS that there were any such ignored red flags.

Permalink Comments (5)



Copyright © 2014 Clif Burns. All Rights Reserved.
(No republication, syndication or use permitted without my consent.)



Jan

24

DTrade Vulnerability Could Allow Foreign Spies to Hack Your Network


Posted by at 2:25 pm on January 24, 2014
Category: DDTC

Chinese Army training with computers [Fair Use]Back in December, IBM issued a security alert relating to the IBM Forms Viewer 8.0.1 which must be used as part of filing licenses through DTrade. The alert says this:

A XFDL form can be created in such a way that could cause a stack buffer overflow to occur in the IBM Forms Viewer that could allow remote code execution to occur if the form is loaded.

That, of course, is geekspeak meaning that running DTrade on your network can allow a hacker to take over your system remotely and download whatever strikes his or her fancy, including ITAR-controlled technical data.

There is a fix. The security bulletin says to download IBM Forms Viewer 8.0.1.1. Sadly you can’t download that version without a Support Agreement with IBM. I know. I tried. And the only version available on DDTC’s site, even though the vulnerability is almost two months old, is version 8.0.1.

Query: since using DTrade exposes your system to data theft by foreign nationals, does everyone using DTrade have to file a voluntary disclosure with DDTC admitting that their ITAR-controlled technical data is, by virtue of the DTrade vulnerability, accessible to foreign nationals?

Seriously, DDTC needs to either make the new version available immediately or enable users to uninstall DTrade and use an alternate method for filing license applications. (Oh, and remember that DDTC selected the IBM XFDL format over PDF because it was, allegedly, more secure.)

Permalink Comments (2)



Copyright © 2014 Clif Burns. All Rights Reserved.
(No republication, syndication or use permitted without my consent.)



Jan

23

We Get Mail


Posted by at 12:54 pm on January 23, 2014
Category: Iran Sanctions

Somebody was reading Export Law Blog but was so busy looking for an email address to spam that they forgot to, you know, read the blog and see that I might have some difficulty in using her services to ship things through the port of Bandar Abbas in Iran.  Or perhaps she just has a very wry sense of humor:

And thank you, “Ms. Pari,” for the kind offer of your services. I’m glad you were glad to take the opportunity to contact me. So sorry it didn’t work out.

Permalink Comments Off on We Get Mail



Copyright © 2014 Clif Burns. All Rights Reserved.
(No republication, syndication or use permitted without my consent.)



Jan

22

New Sentencing Hearing Scheduled for Professor Roth


Posted by at 6:27 pm on January 22, 2014
Category: General

Professor John Roth
ABOVE: Professor Reece Roth


John Reece Roth, a former professor at the University of Tennessee who was convicted of violating U.S. export laws for, among other things, transferring technical data relating to drones to foreign graduate students, is getting another sentencing hearing. Currently serving a four year sentence in a federal penitentiary, Mr. Roth can thank Jeffrey Skilling of Enron infamy, for his new sentencing hearing.

In addition to the export law violations, Roth was also convicted under the “honest services” provision of 18 U.S.C. § 1346. That provision was subsequently interpreted by the U.S. Supreme Court on appeal by Skilling of his conviction under that statute to apply only in cases in which a bribe or kickback had been paid, something which both the government and Roth’s counsel agree did not occur in his case. The issue at the hearing will be whether his conviction on the remaining 16 counts will be enough to justify his four-year sentence. You can, of course, guess which side of this argument each side is on. The hearing is scheduled for February 24, 2014

The only news story on the resentencing hearing is in the Knoxville News Sentinel. No link to that story is provided because, unbelievably, every single word of that newspaper is behind a paywall. The idea that the News Sentinel should charge for all of its content (unlike, say, the New York Times which provides a limited number of articles free to each reader per month) is particularly ironic when you consider that the reporter said this about the original Roth trial

His trial served as a test case nationwide for whether information itself can be a “defense article” subject to export control. Traditionally, export control violations have involved actual equipment or devices.

Er, no. Obviously the reporter neither reads this blog or knows how to work the Google or she might have stumbled on the Chi Mak trial which preceded Roth’s and where the defendant was convicted for exporting technical data about submarine engines to China.

Permalink Comments (3)



Copyright © 2014 Clif Burns. All Rights Reserved.
(No republication, syndication or use permitted without my consent.)



Jan

21

Wide World of (North Korean) Sports: Piste Off Edition


Posted by at 7:23 pm on January 21, 2014
Category: ChinaEconomic SanctionsEUForeign Export ControlsNorth Korea Sanctions

By Mark Scott Johnson from Sydney, Australia (IMG_7688) [CC-BY-2.0] (http://creativecommons.org/licenses/by/2.0)], via Wikimedia Commons http://commons.wikimedia.org/wiki/File%3AMount_Paektu7.jpgDennis Rodman and his coterie of NBA All-Stars recently returned to the United States from North Korea after Rodman’s birthday basketball bash for his “friend for life” Kim Jong Un.  While Rodman’s zealous zaniness has grabbed global media headlines, another sports-related development in North Korea, is more significant to sanctions and export control issues: the grand opening this month of the Masik Pass luxury ski and hotel resort.

Pictures taken of the resort show the 120-room hotel, indoor swimming pool and 11 ski runs.  Other pictures also show, however, Italian snow plows, Canadian snowmobiles and Swedish snow cannons.  Recent news reports began to shed light on the obvious sanctions issue: how did North Korea build a ski resort without someone violating sanctions.  U.N. Security Council Resolution 2094 and others prohibit members from selling “luxury goods” to North Korea and even though “luxury goods” are not defined and are not limited to the specific luxury items delineated in Annex IV of Resolution 2094, it seems hard to deny that snowmobiles, snow cannons and the other accoutrements of a “luxury” resort are not “luxury goods.”

According to SkyNews, the Italian snow plow manufacturer has predictably said, “Snow groomers are sold directly to ski resorts and distributors and it is possible that a used snow groomer is than sold to another final user by ski resorts or distributors themselves. On this kind of business we as a producer do not have any influence, no company can avoid that this happens.”

Western goods flowing into North Korea is not new.  In fact, we reported last year on the curious infiltration of an Apple iMac on Kim Jong Un’s desk and suggested it, like many Western goods in North Korea, came from China.  Plausible deniability about to whom a manufacturer’s customers sell its products becomes, of course, more attenuated when your business is selling “state-of-the-art snow cannons” that retail for 14,000 Euros each.

U.N., U.S., E.U. and Canadian sanctions policies fail if a repressive regime like North Korea’s so-called supreme leadership continues to violate human rights but opens a ski resort to sustain its control.  Like sanctions against Iran, Cuba and other countries, a principal goal is to curtail infrastructure projects that support the sanctioned governments.  While a ski resort is not the largest national infrastructure project, sanctions were designed to prohibit it being built and supported by Western goods and technology.

Even if the sales of the items found at Masik Pass were beyond detection of reasonable know-your-customer requirements, Italian, Canadian and Swedish enforcement authorities would at least have grounds to inquire further, especially company records and communications involving sales to Chinese resellers that may have been possible routes to North Korea.  While any manufacturer or retailer can’t know everything about its customers, knowing more gives a company greater support to conclude that its business does not involve impermissible activities or give law enforcement a reason to examine its business further.

Clif adds: Blame me, not George, for the terrible pun in the post title.

Permalink Comments (1)



Copyright © 2014 Clif Burns. All Rights Reserved.
(No republication, syndication or use permitted without my consent.)


« Previous posts | Next posts »