User with Muslim name blocked from downloading Sophos AV for Mac | Hacker News Reader

User with Muslim name blocked from downloading Sophos AV for Mac

theregister.co.uk

52 pointsteh_klev29 comments

It seems odd to me that people would be blacklisted from accessing anti-virus at all. Imagine if that block extended to other protections like locks on the front door of your house, or access to infrastructure like hospitals.

It doesn't sit well with me, even if you do believe that they are 'evil people'. Antivirus strikes me as something that everyone should have access to. It's not an offensive tool.

The thought process with export controls is that bad actors may be able to discover vulnerabilities more easily by having unrestricted access to defensive technologies.

And of course the first vulnerability these bad actors will use is a false identity.

The US SDN lists and other blacklists apply to all trade, not just special categories.

In theory, Ali should not be able to buy anything from US companies at all, if they see his name. In practice this requirement is so absurd that compliance is poor, both due to difficulty and practicality.

What kind of AV software requires your personal info when you download it?

What kind of naive person ever fills out one of those forms honestly? Usually my address is "123 Fuckyou Boulevard" on those things.

Hm, Hassan Ali does not actually seem to be on the denied persons list:

http://www.bis.doc.gov/dpl/dpl.txt

It could have been flagged by another country's system. Or there are names not on that specific list.

Almost certainly the US Treasury's Specially Designated Nationals list:

http://www.treasury.gov/resource-center/sanctions/SDN-List/

Sure enough, searching the list for "Hasan Ali" gives seven hits.

The SDN and other blacklists are a little discussed travesty of civil rights.

There is no process for getting off the list. Names just ..... appear there. No evidence or other legal case is required. Just a bureaucrat deciding they don't like you.

The US Constitution explicitly forbids blacklisting of individuals via law for this sort of reason (laws of attainder). Unfortunately such laws are rarely struck down because blacklisted individuals are usually foreign, and thus don't have much access to the US legal system or interest in taking things to the Supreme Court. Also the term "law of attainder" or "bill of attainder" usually means a law that explicitly enumerates the people it's meant to effect, such as the Magnitsky Bill. Laws that create blacklists maintained by the executive branch isn't something the framers appear to have anticipated, though their intention is quite obvious.

Specially Designated Nationals. Wow. I wonder whether the people who come up with these terms have read 1984 and it's a form of in-joke, or if they're actually serious.

"More time passed and we got to Korea, 1950. By that time, Madison Avenue had learned well how to manipulate the language, and the same condition became _operational exhaustion_. It had been stretched out to eight syllables. It took longer to say, so the impact was reduced, and the humanity was completely squeezed out of the term. It was now absolutely sterile: operational exhaustion. It sounded like something that might happen to your car." - George Carlin, When Will Jesus Bring the Pork Chops (2004)

Isn't "Hassan Ali" an incredibly common name?

Yes, it is.

Source: someone who lives in the region of many a Hassan Ali.

Hmm, Egypt by any chance?

Currently, no. I avoid directly mentioning which countries I circulate between.

But I did however live in Egypt during my years of studies 5+ years ago. I was not into IT and programming then, I was an Arabic language major.

Oh, I see.

I can download lots of software packages (whether open source, or even freeware/shareware/trialware) without giving my name, including even antivirus software (e.g. ClamAV). I am aware of the export control laws Sophos (and other software companies) have to comply with, but I wonder how those allowing anonymous software downloads stay in compliance with the same laws.

What a bullshit title. Was the ban really based on the "muslimness" of his name?

As the article points out, "Hasan Ali" is a stupendously common Muslim name.

Imagine blocking anyone called "John Williams" and then claiming you were blocking terrorists, not just people with English-sounding names.

It turns out that in practice (and law), companies are held responsible for grossly discriminatory effects of their actions, without a detailed process of examining motivations at the time.

Terrorists really should start using aliases like "John Williams", "George Bush", "Donald Trump" etc. to circumvent these name lists, as they already managed to max out the patdown ineffectiveness with the shoe bomber and the underwear bomber.

They could use the name "Ted Kennedy." That'd show 'em.

Oops, no, our wonderful, benevolent, and omniscient government is one step ahead of the curve as usual. http://www.washingtonpost.com/wp-dyn/articles/A17073-2004Aug...

That's not up to Sophos to know though. Companies are required to comply with the regulations, at the penalty of incredibly stiff penalties. And the cost of paying manual attention to every match would be debilitating. It is much more advantageous for them to automate it and be safe rather than sorry. Their policy of asking for more information on an initial positive match is reasonable.

If you want to blame anyone, blame the U.S. agencies who implemented these restrictions. Sophos is just obeying the law.

Imagine blocking anybody named "academy of natural sciences" and then claiming you were blocking terrorists, not just organizations devoted to science.

"User on list blocked by downloading Sophos AV for Mac"

Yes, it's a bullshit/flamebait title. This would be an excellent opportunity for an admin to step in and edit the title.

Those who are modding you down have no clue how the various government lists work, and what the penalties are for exporting anything to someone on them.

Yes, as with most US export law, these lists are arbitrary, feckless, and generally stupid, and yes, they contain a lot of very common names. But the "Muslim"-ness of the name has absolutely nothing to do with anything. (Exactly what is a "Muslim" name, anyway? Am I a Christian because my name is John?)

SDN list is not an export control list, despite that it's maintained by OFAC.

Americans are not allowed to trade with people on the SDN even if they live in America and are American citizens:

http://ccrjustice.org/home/what-we-do/our-cases/salah-v-us-d...

His statement is not wrong. He is caught up in this net because the US Government is waging various kinds of economic warfare against Muslim countries, and one of their tools is literally just a list of names. If USG didn't hate Iran or view the Middle East as a strategic interest, there would not be so many Muslim names on the list and this probably wouldn't have happened to him.

Sounds like it was based on the "terrorist"-ness of his name, i.e. whether the name is on a watchlist, which (rightfully or wrongfully, in the West) correlates with "Muslimness".

Has anyone else tried using that name to see if it triggers and do they really call you?

I can't wait for the Naked Security writeup on this cockup.

Reply on news.ycombinator.com